Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
15-01-2023 00:16
Static task
static1
Behavioral task
behavioral1
Sample
D0037BE72720BB05C0207342411A883B883C8F4A371C6.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
D0037BE72720BB05C0207342411A883B883C8F4A371C6.exe
Resource
win10v2004-20220812-en
General
-
Target
D0037BE72720BB05C0207342411A883B883C8F4A371C6.exe
-
Size
2.9MB
-
MD5
6d182f29e494791dde6d7cfedeb59575
-
SHA1
a08ca262504b114bb4a2059e275533ab0424dba6
-
SHA256
d0037be72720bb05c0207342411a883b883c8f4a371c6c7e6bacd9cff5615df7
-
SHA512
df09b85f7c6e4b43bb9043dca7fdae5384093d74df4ad1b1d9a435e0187c191222e964723aada731a0171c33ea3fcee99cd8fe77a3b333e58ff2583a53b6503c
-
SSDEEP
49152:EgruQopjSHN32ocMdmXL6vushQbZYik4o5bn0AR8VDC+0gDu6BM5QNhr+7iKWN9O:JPoumHX+WsSVc4gD0ARvqDuzQ7+7il2b
Malware Config
Extracted
nullmixer
http://razino.xyz/
Extracted
vidar
39.4
933
https://sergeevih43.tumblr.com/
-
profile_id
933
Extracted
gcleaner
45.139.105.171
85.31.46.167
107.182.129.235
171.22.30.106
Extracted
vidar
2
831
https://t.me/tgdatapacks
https://steamcommunity.com/profiles/76561199469677637
-
profile_id
831
Extracted
redline
LogsDiller Cloud (TG: @logsdillabot)
51.210.137.6:47909
-
auth_value
3a050df92d0cf082b2cdaf87863616be
Signatures
-
Detects Smokeloader packer 3 IoCs
resource yara_rule behavioral2/memory/5116-254-0x0000000000550000-0x0000000000559000-memory.dmp family_smokeloader behavioral2/memory/748-343-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral2/memory/2192-345-0x0000000002CE0000-0x0000000002CE9000-memory.dmp family_smokeloader -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRawWriteNotification = "1" sahiba_7.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection sahiba_7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" sahiba_7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" sahiba_7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" sahiba_7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" sahiba_7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" sahiba_7.exe -
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 872 3340 rUNdlL32.eXe 70 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ op8Yy3kQdLSP3PHDeQOWA6K1.exe -
Vidar Stealer 3 IoCs
resource yara_rule behavioral2/memory/1840-260-0x00000000021D0000-0x000000000226D000-memory.dmp family_vidar behavioral2/memory/1840-261-0x0000000000400000-0x00000000004A4000-memory.dmp family_vidar behavioral2/memory/1840-269-0x0000000000400000-0x00000000004A4000-memory.dmp family_vidar -
resource yara_rule behavioral2/files/0x0006000000022e12-136.dat aspack_v212_v242 behavioral2/files/0x0006000000022e0d-141.dat aspack_v212_v242 behavioral2/files/0x0006000000022e0d-145.dat aspack_v212_v242 behavioral2/files/0x0006000000022e10-146.dat aspack_v212_v242 behavioral2/files/0x0006000000022e10-149.dat aspack_v212_v242 behavioral2/files/0x0006000000022e0d-144.dat aspack_v212_v242 behavioral2/files/0x0006000000022e0e-140.dat aspack_v212_v242 behavioral2/files/0x0006000000022e0e-139.dat aspack_v212_v242 behavioral2/files/0x0006000000022e12-137.dat aspack_v212_v242 -
Downloads MZ/PE file
-
Executes dropped EXE 31 IoCs
pid Process 3376 setup_installer.exe 4620 setup_install.exe 1236 sahiba_4.exe 5116 sahiba_2.exe 208 sahiba_5.exe 220 sahiba_6.exe 1840 sahiba_3.exe 5088 sahiba_7.exe 4372 sahiba_10.exe 1412 sahiba_1.exe 508 sahiba_8.exe 476 sahiba_9.exe 3364 sahiba_1.exe 3944 1.exe 5032 2.exe 4280 3.exe 1240 4.exe 2084 o8cRPAsRHGxQ6Z4qQhQnNncd.exe 2192 2pb4C7IP4LocGuweujEajPOD.exe 4404 p0Gg8JRdKT7CDGW3zDlFSHhg.exe 4628 xw1RZYgEeOK2Ox7zHkPjtymD.exe 5112 o8cRPAsRHGxQ6Z4qQhQnNncd.tmp 1296 vxP_qniqOmUKkkn_4rETyWkm.exe 3216 OitFiles450.exe 4572 eLtdms7tFp0odEKhGGqunV71.exe 1180 op8Yy3kQdLSP3PHDeQOWA6K1.exe 2256 7Qi6EKY3PZu3Sc1YBPPtCiPH.exe 1372 4zTqeS.exe 4120 123.exe 4084 321.exe 748 2pb4C7IP4LocGuweujEajPOD.exe -
resource yara_rule behavioral2/files/0x000200000001e795-296.dat vmprotect behavioral2/files/0x000200000001e795-295.dat vmprotect behavioral2/memory/1296-298-0x0000000140000000-0x000000014061B000-memory.dmp vmprotect -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion op8Yy3kQdLSP3PHDeQOWA6K1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion op8Yy3kQdLSP3PHDeQOWA6K1.exe -
Checks computer location settings 2 TTPs 8 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation sahiba_10.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation sahiba_7.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation p0Gg8JRdKT7CDGW3zDlFSHhg.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 7Qi6EKY3PZu3Sc1YBPPtCiPH.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation OitFiles450.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation D0037BE72720BB05C0207342411A883B883C8F4A371C6.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation setup_installer.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation sahiba_1.exe -
Loads dropped DLL 14 IoCs
pid Process 4620 setup_install.exe 4620 setup_install.exe 4620 setup_install.exe 4620 setup_install.exe 4620 setup_install.exe 4620 setup_install.exe 4620 setup_install.exe 5116 sahiba_2.exe 2280 rundll32.exe 5112 o8cRPAsRHGxQ6Z4qQhQnNncd.tmp 2308 rundll32.exe 4892 rundll32.exe 5056 AppLaunch.exe 5056 AppLaunch.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/1180-320-0x0000000000560000-0x0000000000BCA000-memory.dmp themida -
Uses the VBS compiler for execution 1 TTPs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA op8Yy3kQdLSP3PHDeQOWA6K1.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 14 ipinfo.io 9 ipinfo.io -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1180 op8Yy3kQdLSP3PHDeQOWA6K1.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 4572 set thread context of 5056 4572 eLtdms7tFp0odEKhGGqunV71.exe 143 PID 2192 set thread context of 748 2192 2pb4C7IP4LocGuweujEajPOD.exe 148 PID 4120 set thread context of 4432 4120 123.exe 147 PID 4084 set thread context of 4980 4084 321.exe 149 -
Drops file in Program Files directory 17 IoCs
description ioc Process File created C:\Program Files (x86)\Oit Files\language\is-0D07S.tmp o8cRPAsRHGxQ6Z4qQhQnNncd.tmp File created C:\Program Files (x86)\Oit Files\language\is-G1N1C.tmp o8cRPAsRHGxQ6Z4qQhQnNncd.tmp File created C:\Program Files (x86)\Oit Files\language\is-AFJG1.tmp o8cRPAsRHGxQ6Z4qQhQnNncd.tmp File created C:\Program Files (x86)\Oit Files\is-5UA7N.tmp o8cRPAsRHGxQ6Z4qQhQnNncd.tmp File created C:\Program Files (x86)\Oit Files\is-H2RG2.tmp o8cRPAsRHGxQ6Z4qQhQnNncd.tmp File created C:\Program Files (x86)\Oit Files\language\is-N4PGD.tmp o8cRPAsRHGxQ6Z4qQhQnNncd.tmp File created C:\Program Files (x86)\Oit Files\language\is-2C4QL.tmp o8cRPAsRHGxQ6Z4qQhQnNncd.tmp File opened for modification C:\Program Files (x86)\Oit Files\unins000.dat o8cRPAsRHGxQ6Z4qQhQnNncd.tmp File created C:\Program Files (x86)\Oit Files\is-VBNUR.tmp o8cRPAsRHGxQ6Z4qQhQnNncd.tmp File created C:\Program Files (x86)\Oit Files\is-IQ6MK.tmp o8cRPAsRHGxQ6Z4qQhQnNncd.tmp File created C:\Program Files (x86)\Oit Files\is-7G61G.tmp o8cRPAsRHGxQ6Z4qQhQnNncd.tmp File opened for modification C:\Program Files (x86)\Oit Files\OitFiles450.exe o8cRPAsRHGxQ6Z4qQhQnNncd.tmp File created C:\Program Files (x86)\Oit Files\unins000.dat o8cRPAsRHGxQ6Z4qQhQnNncd.tmp File created C:\Program Files (x86)\Oit Files\language\is-764H0.tmp o8cRPAsRHGxQ6Z4qQhQnNncd.tmp File created C:\Program Files (x86)\Oit Files\language\is-B223P.tmp o8cRPAsRHGxQ6Z4qQhQnNncd.tmp File created C:\Program Files (x86)\Oit Files\language\is-T6JJP.tmp o8cRPAsRHGxQ6Z4qQhQnNncd.tmp File created C:\Program Files (x86)\Oit Files\language\is-8DT1T.tmp o8cRPAsRHGxQ6Z4qQhQnNncd.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 8 IoCs
pid pid_target Process procid_target 5052 4620 WerFault.exe 81 408 2280 WerFault.exe 4076 1840 WerFault.exe 96 1776 1236 WerFault.exe 99 2412 4120 WerFault.exe 142 4724 4084 WerFault.exe 146 4468 4628 WerFault.exe 130 1924 5056 WerFault.exe 143 -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sahiba_2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sahiba_2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sahiba_2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2pb4C7IP4LocGuweujEajPOD.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2pb4C7IP4LocGuweujEajPOD.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2pb4C7IP4LocGuweujEajPOD.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AppLaunch.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString AppLaunch.exe -
Kills process with taskkill 1 IoCs
pid Process 3464 taskkill.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings p0Gg8JRdKT7CDGW3zDlFSHhg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5116 sahiba_2.exe 5116 sahiba_2.exe 2556 Process not Found 2556 Process not Found 2556 Process not Found 2556 Process not Found 2556 Process not Found 2556 Process not Found 2556 Process not Found 2556 Process not Found 2556 Process not Found 2556 Process not Found 2556 Process not Found 2556 Process not Found 2556 Process not Found 2556 Process not Found 2556 Process not Found 2556 Process not Found 2556 Process not Found 2556 Process not Found 2556 Process not Found 2556 Process not Found 2556 Process not Found 2556 Process not Found 2556 Process not Found 2556 Process not Found 2556 Process not Found 2556 Process not Found 2556 Process not Found 2556 Process not Found 2556 Process not Found 2556 Process not Found 2556 Process not Found 2556 Process not Found 2556 Process not Found 2556 Process not Found 2556 Process not Found 2556 Process not Found 2556 Process not Found 2556 Process not Found 2556 Process not Found 2556 Process not Found 2556 Process not Found 2556 Process not Found 2556 Process not Found 2556 Process not Found 2556 Process not Found 2556 Process not Found 2556 Process not Found 2556 Process not Found 2556 Process not Found 2556 Process not Found 2556 Process not Found 2556 Process not Found 2556 Process not Found 2556 Process not Found 2556 Process not Found 2556 Process not Found 2556 Process not Found 2556 Process not Found 2556 Process not Found 2556 Process not Found 2556 Process not Found 2556 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2556 Process not Found -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 5116 sahiba_2.exe 748 2pb4C7IP4LocGuweujEajPOD.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 208 sahiba_5.exe Token: SeDebugPrivilege 220 sahiba_6.exe Token: SeDebugPrivilege 476 sahiba_9.exe Token: SeDebugPrivilege 3944 1.exe Token: SeDebugPrivilege 5032 2.exe Token: SeDebugPrivilege 4280 3.exe Token: SeDebugPrivilege 1240 4.exe Token: SeDebugPrivilege 508 sahiba_8.exe Token: SeShutdownPrivilege 2556 Process not Found Token: SeCreatePagefilePrivilege 2556 Process not Found Token: SeShutdownPrivilege 2556 Process not Found Token: SeCreatePagefilePrivilege 2556 Process not Found Token: SeShutdownPrivilege 2556 Process not Found Token: SeCreatePagefilePrivilege 2556 Process not Found Token: SeShutdownPrivilege 2556 Process not Found Token: SeCreatePagefilePrivilege 2556 Process not Found Token: SeShutdownPrivilege 2556 Process not Found Token: SeCreatePagefilePrivilege 2556 Process not Found Token: SeShutdownPrivilege 2556 Process not Found Token: SeCreatePagefilePrivilege 2556 Process not Found Token: SeShutdownPrivilege 2556 Process not Found Token: SeCreatePagefilePrivilege 2556 Process not Found Token: SeShutdownPrivilege 2556 Process not Found Token: SeCreatePagefilePrivilege 2556 Process not Found Token: SeShutdownPrivilege 2556 Process not Found Token: SeCreatePagefilePrivilege 2556 Process not Found Token: SeShutdownPrivilege 2556 Process not Found Token: SeCreatePagefilePrivilege 2556 Process not Found Token: SeShutdownPrivilege 2556 Process not Found Token: SeCreatePagefilePrivilege 2556 Process not Found Token: SeShutdownPrivilege 2556 Process not Found Token: SeCreatePagefilePrivilege 2556 Process not Found Token: SeShutdownPrivilege 2556 Process not Found Token: SeCreatePagefilePrivilege 2556 Process not Found Token: SeShutdownPrivilege 2556 Process not Found Token: SeCreatePagefilePrivilege 2556 Process not Found Token: SeShutdownPrivilege 2556 Process not Found Token: SeCreatePagefilePrivilege 2556 Process not Found Token: SeShutdownPrivilege 2556 Process not Found Token: SeCreatePagefilePrivilege 2556 Process not Found Token: SeShutdownPrivilege 2556 Process not Found Token: SeCreatePagefilePrivilege 2556 Process not Found Token: SeShutdownPrivilege 2556 Process not Found Token: SeCreatePagefilePrivilege 2556 Process not Found Token: SeShutdownPrivilege 2556 Process not Found Token: SeCreatePagefilePrivilege 2556 Process not Found Token: SeShutdownPrivilege 2556 Process not Found Token: SeCreatePagefilePrivilege 2556 Process not Found Token: SeShutdownPrivilege 2556 Process not Found Token: SeCreatePagefilePrivilege 2556 Process not Found Token: SeDebugPrivilege 4628 xw1RZYgEeOK2Ox7zHkPjtymD.exe Token: SeDebugPrivilege 1180 op8Yy3kQdLSP3PHDeQOWA6K1.exe Token: SeShutdownPrivilege 2556 Process not Found Token: SeCreatePagefilePrivilege 2556 Process not Found Token: SeShutdownPrivilege 2556 Process not Found Token: SeCreatePagefilePrivilege 2556 Process not Found Token: SeShutdownPrivilege 2556 Process not Found Token: SeCreatePagefilePrivilege 2556 Process not Found Token: SeShutdownPrivilege 2556 Process not Found Token: SeCreatePagefilePrivilege 2556 Process not Found Token: SeShutdownPrivilege 2556 Process not Found Token: SeCreatePagefilePrivilege 2556 Process not Found Token: SeShutdownPrivilege 2556 Process not Found Token: SeCreatePagefilePrivilege 2556 Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4532 wrote to memory of 3376 4532 D0037BE72720BB05C0207342411A883B883C8F4A371C6.exe 80 PID 4532 wrote to memory of 3376 4532 D0037BE72720BB05C0207342411A883B883C8F4A371C6.exe 80 PID 4532 wrote to memory of 3376 4532 D0037BE72720BB05C0207342411A883B883C8F4A371C6.exe 80 PID 3376 wrote to memory of 4620 3376 setup_installer.exe 81 PID 3376 wrote to memory of 4620 3376 setup_installer.exe 81 PID 3376 wrote to memory of 4620 3376 setup_installer.exe 81 PID 4620 wrote to memory of 4384 4620 setup_install.exe 84 PID 4620 wrote to memory of 4384 4620 setup_install.exe 84 PID 4620 wrote to memory of 4384 4620 setup_install.exe 84 PID 4620 wrote to memory of 4332 4620 setup_install.exe 105 PID 4620 wrote to memory of 4332 4620 setup_install.exe 105 PID 4620 wrote to memory of 4332 4620 setup_install.exe 105 PID 4620 wrote to memory of 1084 4620 setup_install.exe 85 PID 4620 wrote to memory of 1084 4620 setup_install.exe 85 PID 4620 wrote to memory of 1084 4620 setup_install.exe 85 PID 4620 wrote to memory of 1180 4620 setup_install.exe 104 PID 4620 wrote to memory of 1180 4620 setup_install.exe 104 PID 4620 wrote to memory of 1180 4620 setup_install.exe 104 PID 4620 wrote to memory of 4548 4620 setup_install.exe 86 PID 4620 wrote to memory of 4548 4620 setup_install.exe 86 PID 4620 wrote to memory of 4548 4620 setup_install.exe 86 PID 4620 wrote to memory of 1136 4620 setup_install.exe 87 PID 4620 wrote to memory of 1136 4620 setup_install.exe 87 PID 4620 wrote to memory of 1136 4620 setup_install.exe 87 PID 4620 wrote to memory of 2548 4620 setup_install.exe 103 PID 4620 wrote to memory of 2548 4620 setup_install.exe 103 PID 4620 wrote to memory of 2548 4620 setup_install.exe 103 PID 4620 wrote to memory of 4588 4620 setup_install.exe 102 PID 4620 wrote to memory of 4588 4620 setup_install.exe 102 PID 4620 wrote to memory of 4588 4620 setup_install.exe 102 PID 4620 wrote to memory of 3268 4620 setup_install.exe 101 PID 4620 wrote to memory of 3268 4620 setup_install.exe 101 PID 4620 wrote to memory of 3268 4620 setup_install.exe 101 PID 4620 wrote to memory of 1052 4620 setup_install.exe 100 PID 4620 wrote to memory of 1052 4620 setup_install.exe 100 PID 4620 wrote to memory of 1052 4620 setup_install.exe 100 PID 1180 wrote to memory of 1236 1180 cmd.exe 99 PID 1180 wrote to memory of 1236 1180 cmd.exe 99 PID 4332 wrote to memory of 5116 4332 cmd.exe 98 PID 4332 wrote to memory of 5116 4332 cmd.exe 98 PID 4332 wrote to memory of 5116 4332 cmd.exe 98 PID 4548 wrote to memory of 208 4548 cmd.exe 97 PID 4548 wrote to memory of 208 4548 cmd.exe 97 PID 1136 wrote to memory of 220 1136 cmd.exe 88 PID 1136 wrote to memory of 220 1136 cmd.exe 88 PID 1084 wrote to memory of 1840 1084 cmd.exe 96 PID 1084 wrote to memory of 1840 1084 cmd.exe 96 PID 1084 wrote to memory of 1840 1084 cmd.exe 96 PID 2548 wrote to memory of 5088 2548 cmd.exe 94 PID 2548 wrote to memory of 5088 2548 cmd.exe 94 PID 2548 wrote to memory of 5088 2548 cmd.exe 94 PID 1052 wrote to memory of 4372 1052 cmd.exe 91 PID 1052 wrote to memory of 4372 1052 cmd.exe 91 PID 1052 wrote to memory of 4372 1052 cmd.exe 91 PID 4384 wrote to memory of 1412 4384 cmd.exe 92 PID 4384 wrote to memory of 1412 4384 cmd.exe 92 PID 4384 wrote to memory of 1412 4384 cmd.exe 92 PID 3268 wrote to memory of 476 3268 cmd.exe 90 PID 3268 wrote to memory of 476 3268 cmd.exe 90 PID 4588 wrote to memory of 508 4588 cmd.exe 89 PID 4588 wrote to memory of 508 4588 cmd.exe 89 PID 4588 wrote to memory of 508 4588 cmd.exe 89 PID 1412 wrote to memory of 3364 1412 sahiba_1.exe 107 PID 1412 wrote to memory of 3364 1412 sahiba_1.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\D0037BE72720BB05C0207342411A883B883C8F4A371C6.exe"C:\Users\Admin\AppData\Local\Temp\D0037BE72720BB05C0207342411A883B883C8F4A371C6.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\7zS03D63F36\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS03D63F36\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_1.exe4⤵
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\7zS03D63F36\sahiba_1.exesahiba_1.exe5⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\7zS03D63F36\sahiba_1.exe"C:\Users\Admin\AppData\Local\Temp\7zS03D63F36\sahiba_1.exe" -a6⤵
- Executes dropped EXE
PID:3364
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_3.exe4⤵
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\7zS03D63F36\sahiba_3.exesahiba_3.exe5⤵
- Executes dropped EXE
PID:1840 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 11646⤵
- Program crash
PID:4076
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_5.exe4⤵
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\7zS03D63F36\sahiba_5.exesahiba_5.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:208
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_6.exe4⤵
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\7zS03D63F36\sahiba_6.exesahiba_6.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:220
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_10.exe4⤵
- Suspicious use of WriteProcessMemory
PID:1052
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_9.exe4⤵
- Suspicious use of WriteProcessMemory
PID:3268
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_8.exe4⤵
- Suspicious use of WriteProcessMemory
PID:4588
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_7.exe4⤵
- Suspicious use of WriteProcessMemory
PID:2548
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_4.exe4⤵
- Suspicious use of WriteProcessMemory
PID:1180
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_2.exe4⤵
- Suspicious use of WriteProcessMemory
PID:4332
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4620 -s 5644⤵
- Program crash
PID:5052
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS03D63F36\sahiba_8.exesahiba_8.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:508
-
C:\Users\Admin\AppData\Local\Temp\7zS03D63F36\sahiba_9.exesahiba_9.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:476
-
C:\Users\Admin\AppData\Local\Temp\7zS03D63F36\sahiba_10.exesahiba_10.exe1⤵
- Executes dropped EXE
- Checks computer location settings
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3944
-
-
C:\Users\Admin\AppData\Local\Temp\2.exe"C:\Users\Admin\AppData\Local\Temp\2.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5032
-
-
C:\Users\Admin\AppData\Local\Temp\3.exe"C:\Users\Admin\AppData\Local\Temp\3.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4280
-
-
C:\Users\Admin\AppData\Local\Temp\4.exe"C:\Users\Admin\AppData\Local\Temp\4.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1240
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4620 -ip 46201⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\7zS03D63F36\sahiba_7.exesahiba_7.exe1⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Checks computer location settings
PID:5088 -
C:\Users\Admin\Documents\o8cRPAsRHGxQ6Z4qQhQnNncd.exe"C:\Users\Admin\Documents\o8cRPAsRHGxQ6Z4qQhQnNncd.exe"2⤵
- Executes dropped EXE
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\is-SCELT.tmp\o8cRPAsRHGxQ6Z4qQhQnNncd.tmp"C:\Users\Admin\AppData\Local\Temp\is-SCELT.tmp\o8cRPAsRHGxQ6Z4qQhQnNncd.tmp" /SL5="$E0040,1086575,229888,C:\Users\Admin\Documents\o8cRPAsRHGxQ6Z4qQhQnNncd.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:5112 -
C:\Program Files (x86)\Oit Files\OitFiles450.exe"C:\Program Files (x86)\Oit Files\OitFiles450.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
PID:3216 -
C:\Users\Admin\AppData\Roaming\{cd0d74c0-1ab4-11ed-b686-806e6f6e6963}\4zTqeS.exe
- Executes dropped EXE
PID:1372
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "OitFiles450.exe" /f & erase "C:\Program Files (x86)\Oit Files\OitFiles450.exe" & exit5⤵PID:2044
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "OitFiles450.exe" /f6⤵
- Kills process with taskkill
PID:3464
-
-
-
-
-
-
C:\Users\Admin\Documents\2pb4C7IP4LocGuweujEajPOD.exe"C:\Users\Admin\Documents\2pb4C7IP4LocGuweujEajPOD.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2192 -
C:\Users\Admin\Documents\2pb4C7IP4LocGuweujEajPOD.exe"C:\Users\Admin\Documents\2pb4C7IP4LocGuweujEajPOD.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:748
-
-
-
C:\Users\Admin\Documents\xw1RZYgEeOK2Ox7zHkPjtymD.exe"C:\Users\Admin\Documents\xw1RZYgEeOK2Ox7zHkPjtymD.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4628 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4628 -s 17603⤵
- Program crash
PID:4468
-
-
-
C:\Users\Admin\Documents\p0Gg8JRdKT7CDGW3zDlFSHhg.exe"C:\Users\Admin\Documents\p0Gg8JRdKT7CDGW3zDlFSHhg.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
PID:4404 -
C:\Windows\SysWOW64\control.exe"C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\ESMJYI6O.cPl",3⤵PID:3556
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\ESMJYI6O.cPl",4⤵
- Loads dropped DLL
PID:2308 -
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\ESMJYI6O.cPl",5⤵PID:1788
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\ESMJYI6O.cPl",6⤵
- Loads dropped DLL
PID:4892
-
-
-
-
-
-
C:\Users\Admin\Documents\vxP_qniqOmUKkkn_4rETyWkm.exe"C:\Users\Admin\Documents\vxP_qniqOmUKkkn_4rETyWkm.exe"2⤵
- Executes dropped EXE
PID:1296
-
-
C:\Users\Admin\Documents\7Qi6EKY3PZu3Sc1YBPPtCiPH.exe"C:\Users\Admin\Documents\7Qi6EKY3PZu3Sc1YBPPtCiPH.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
PID:2256 -
C:\Windows\Temp\123.exe"C:\Windows\Temp\123.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4120 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"4⤵PID:4432
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4120 -s 3004⤵
- Program crash
PID:2412
-
-
-
C:\Windows\Temp\321.exe"C:\Windows\Temp\321.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4084 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"4⤵PID:4980
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bebra.exe5⤵PID:4608
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4084 -s 1404⤵
- Program crash
PID:4724
-
-
-
-
C:\Users\Admin\Documents\op8Yy3kQdLSP3PHDeQOWA6K1.exe"C:\Users\Admin\Documents\op8Yy3kQdLSP3PHDeQOWA6K1.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:1180 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵PID:2248
-
-
-
C:\Users\Admin\Documents\eLtdms7tFp0odEKhGGqunV71.exe"C:\Users\Admin\Documents\eLtdms7tFp0odEKhGGqunV71.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4572 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"3⤵
- Loads dropped DLL
- Checks processor information in registry
PID:5056 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5056 -s 18324⤵
- Program crash
PID:1924
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS03D63F36\sahiba_2.exesahiba_2.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:5116
-
C:\Users\Admin\AppData\Local\Temp\7zS03D63F36\sahiba_4.exesahiba_4.exe1⤵
- Executes dropped EXE
PID:1236 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1236 -s 10362⤵
- Program crash
PID:1776
-
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
PID:872 -
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main2⤵
- Loads dropped DLL
PID:2280
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 6001⤵
- Program crash
PID:408
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2280 -ip 22801⤵PID:1152
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1840 -ip 18401⤵PID:4188
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 440 -p 1236 -ip 12361⤵PID:4612
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4120 -ip 41201⤵PID:3792
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4084 -ip 40841⤵PID:4748
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4628 -ip 46281⤵PID:3180
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5056 -ip 50561⤵PID:2164
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD5952636e8b0b77093f745d8578737c1cf
SHA1d36ebe71cb55f81b03df5200b891d8a7c5c14a90
SHA256f9cf2976e47f83397cb2b4dfdf049638c0282ec2b243f3d9dad425366df1a8aa
SHA512088bf68b88838038aa4335f502e9fb8419ff30ee9624e99626c20671e21b07ba1fcb7c235096c4514c763bbbda3c3789252786687efd1a79b41b5caba97e8c47
-
Filesize
1.9MB
MD5952636e8b0b77093f745d8578737c1cf
SHA1d36ebe71cb55f81b03df5200b891d8a7c5c14a90
SHA256f9cf2976e47f83397cb2b4dfdf049638c0282ec2b243f3d9dad425366df1a8aa
SHA512088bf68b88838038aa4335f502e9fb8419ff30ee9624e99626c20671e21b07ba1fcb7c235096c4514c763bbbda3c3789252786687efd1a79b41b5caba97e8c47
-
Filesize
110KB
MD5fe502e329a84d66bda799044590f25d3
SHA10514ceaf0fe4bb449a2ac8c58712295e3443a936
SHA2565e87ad15af3701aa5a39091280fe01799b064ef4087d9364dfd5ac6449346e03
SHA512423a20b93683977e24cf69e61c71c26abdefa126350f92991a9c67e154154bf22a22b2d082c441be1c8731fb9168d3f18ae2428d4b8953b2b6951cc7608a37b3
-
Filesize
110KB
MD5fe502e329a84d66bda799044590f25d3
SHA10514ceaf0fe4bb449a2ac8c58712295e3443a936
SHA2565e87ad15af3701aa5a39091280fe01799b064ef4087d9364dfd5ac6449346e03
SHA512423a20b93683977e24cf69e61c71c26abdefa126350f92991a9c67e154154bf22a22b2d082c441be1c8731fb9168d3f18ae2428d4b8953b2b6951cc7608a37b3
-
Filesize
110KB
MD5f877fb92d1f28a8644ac61fb6172a929
SHA1f121559b38f54956c937183f7c272b396faf271e
SHA2568173f4c89e3e5bbd179326d196499ecdde3beba7d138424c2e746dffe83621b1
SHA512f4080a43ecc2986ad52b3c9fc4e435e9ea2c49c0adccc8b93f4c8f82ce16657c924d7e08f432efaa6cbe347e21cd72ba8b54a1449ffa779604ab88a23814d48a
-
Filesize
110KB
MD5f877fb92d1f28a8644ac61fb6172a929
SHA1f121559b38f54956c937183f7c272b396faf271e
SHA2568173f4c89e3e5bbd179326d196499ecdde3beba7d138424c2e746dffe83621b1
SHA512f4080a43ecc2986ad52b3c9fc4e435e9ea2c49c0adccc8b93f4c8f82ce16657c924d7e08f432efaa6cbe347e21cd72ba8b54a1449ffa779604ab88a23814d48a
-
Filesize
110KB
MD54b6c32863af87213475d0b6182cfd387
SHA100a4e483bd89db5a36be867764efcd6871fb659f
SHA256f46cd9ffa766f1ee1f68405d607d655fe5a655e1f9b3a33716b5713d56d0a853
SHA51263810ab5ec325dcf7eb31c18899a869b33f9757937b2edff436debe72a64e687b4d9c8664eedadf75e16450676953ae6b37b43c921bb8022b879da153d3f69d0
-
Filesize
110KB
MD54b6c32863af87213475d0b6182cfd387
SHA100a4e483bd89db5a36be867764efcd6871fb659f
SHA256f46cd9ffa766f1ee1f68405d607d655fe5a655e1f9b3a33716b5713d56d0a853
SHA51263810ab5ec325dcf7eb31c18899a869b33f9757937b2edff436debe72a64e687b4d9c8664eedadf75e16450676953ae6b37b43c921bb8022b879da153d3f69d0
-
Filesize
110KB
MD583b06b32fe0110f9f36a960adc82f443
SHA1ef9cb14c6c15c9ea322c94bb13435dd59b7abbb5
SHA2561c0667901a1814a155d900e7eb0dbd427e2c9a469b0963fddf3b9531a6b1232f
SHA51220a6cad8c13f0377637cbaa59168c30899b15d2512a62edd3471482037ccea35d9e2b2fdb0ba3d03d93f77cb1339bc98479a46adfcbc71a8fe2d55f37b219109
-
Filesize
110KB
MD583b06b32fe0110f9f36a960adc82f443
SHA1ef9cb14c6c15c9ea322c94bb13435dd59b7abbb5
SHA2561c0667901a1814a155d900e7eb0dbd427e2c9a469b0963fddf3b9531a6b1232f
SHA51220a6cad8c13f0377637cbaa59168c30899b15d2512a62edd3471482037ccea35d9e2b2fdb0ba3d03d93f77cb1339bc98479a46adfcbc71a8fe2d55f37b219109
-
Filesize
218KB
MD5d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
Filesize
218KB
MD5d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
Filesize
218KB
MD5d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
Filesize
54KB
MD5e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
Filesize
54KB
MD5e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
Filesize
113KB
MD59aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
Filesize
113KB
MD59aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
Filesize
113KB
MD59aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
Filesize
647KB
MD55e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
Filesize
647KB
MD55e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
Filesize
69KB
MD51e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
Filesize
69KB
MD51e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
Filesize
712KB
MD56e43430011784cff369ea5a5ae4b000f
SHA15999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f
SHA256a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a
SHA51233ef732056182b9ab073d2eacfd71d3f1cb969ee038a19336fb5e0263a4e870742082c756a57010a26e7eab747a2332523d638f2570b8070b933bf957d2dea96
-
Filesize
712KB
MD56e43430011784cff369ea5a5ae4b000f
SHA15999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f
SHA256a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a
SHA51233ef732056182b9ab073d2eacfd71d3f1cb969ee038a19336fb5e0263a4e870742082c756a57010a26e7eab747a2332523d638f2570b8070b933bf957d2dea96
-
Filesize
712KB
MD56e43430011784cff369ea5a5ae4b000f
SHA15999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f
SHA256a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a
SHA51233ef732056182b9ab073d2eacfd71d3f1cb969ee038a19336fb5e0263a4e870742082c756a57010a26e7eab747a2332523d638f2570b8070b933bf957d2dea96
-
Filesize
566KB
MD54957c80dd29b5528759cb5c81c212aac
SHA1bc48e8009ecd94af887e4a598566010dccd567ad
SHA2565486fc48a976f958a9d1ab48305365dc26b28df3958b1be7e1994522df44c820
SHA5125ebe35ac1d6a512f18fb8e1aff33cfb17836580ee41dacd0bc35f6c441de8d764667c1e1d1036601ae004c866c524e69b305d7e8e1cb651d1a71c23490fc2c3f
-
Filesize
566KB
MD54957c80dd29b5528759cb5c81c212aac
SHA1bc48e8009ecd94af887e4a598566010dccd567ad
SHA2565486fc48a976f958a9d1ab48305365dc26b28df3958b1be7e1994522df44c820
SHA5125ebe35ac1d6a512f18fb8e1aff33cfb17836580ee41dacd0bc35f6c441de8d764667c1e1d1036601ae004c866c524e69b305d7e8e1cb651d1a71c23490fc2c3f
-
Filesize
286KB
MD57673460dffe0cbeb8447f395ee489fde
SHA1d2e110969d8a40a069e0568020066836c66fac24
SHA256451f378c29a038c08641c24b07f478098e95b70d18310d3207e29bcf42e2a58c
SHA512cc2f5fe4723a8a6337be098e36538661e6836ac0222de82b46cc9ab5ac0410146fce60453c00ff33567aba1bbde7b4a0c31a4960eef5db8912c5be28d37295c9
-
Filesize
286KB
MD57673460dffe0cbeb8447f395ee489fde
SHA1d2e110969d8a40a069e0568020066836c66fac24
SHA256451f378c29a038c08641c24b07f478098e95b70d18310d3207e29bcf42e2a58c
SHA512cc2f5fe4723a8a6337be098e36538661e6836ac0222de82b46cc9ab5ac0410146fce60453c00ff33567aba1bbde7b4a0c31a4960eef5db8912c5be28d37295c9
-
Filesize
623KB
MD50049dc5ee3390c472e2da280b92e2c26
SHA192aaede97adc658417b021cf9ed607784b62e503
SHA2568d5ee031b3069715a6f2920d9f82ad6844fc75980d211c5359d114e2582f386a
SHA51278b9a686ca2c6e0f25209b3e962659bef7ef45b3e2f27130c7fbf6c65283a433222c48001bfea31327404aef2ace0563b3bc278a8fc4e8d8b6e55d7e9800c765
-
Filesize
623KB
MD50049dc5ee3390c472e2da280b92e2c26
SHA192aaede97adc658417b021cf9ed607784b62e503
SHA2568d5ee031b3069715a6f2920d9f82ad6844fc75980d211c5359d114e2582f386a
SHA51278b9a686ca2c6e0f25209b3e962659bef7ef45b3e2f27130c7fbf6c65283a433222c48001bfea31327404aef2ace0563b3bc278a8fc4e8d8b6e55d7e9800c765
-
Filesize
246KB
MD51979a7b0970c99aa4eeccddd32175df0
SHA1d2fab2818f94d57273b2aed09f4ae38f28da13a7
SHA2567e3dd012bdc04bd04b0a06987ecba6bad7ce3fa7db26bf7866020954eaa0fc19
SHA512a0e738ed99003c53f59439ddcd5ca6f0bd8fb4e98156f726dbed2ec59d327e4c3e6c37be9f54039fdba4c370e9b563aca4e362049cd027c32130cb20678c4182
-
Filesize
246KB
MD51979a7b0970c99aa4eeccddd32175df0
SHA1d2fab2818f94d57273b2aed09f4ae38f28da13a7
SHA2567e3dd012bdc04bd04b0a06987ecba6bad7ce3fa7db26bf7866020954eaa0fc19
SHA512a0e738ed99003c53f59439ddcd5ca6f0bd8fb4e98156f726dbed2ec59d327e4c3e6c37be9f54039fdba4c370e9b563aca4e362049cd027c32130cb20678c4182
-
Filesize
156KB
MD59c18a24236bb56e9f69ad1488f5d64ff
SHA12cf7f8ac503949da3a8e7ef5245b9cfbfb6a3498
SHA25670b71de5159cc877c54fb792ec132e2ee741ed052e7803f9ccde5b503f0be91d
SHA5129f8c53fb8b36a2098f73471b945cf434bec534b10ba5748045ad0fb6034ec71d61ca53522e9b951e26b8aedc768ac73764176da65a505f8eb8804a2b37058e38
-
Filesize
156KB
MD59c18a24236bb56e9f69ad1488f5d64ff
SHA12cf7f8ac503949da3a8e7ef5245b9cfbfb6a3498
SHA25670b71de5159cc877c54fb792ec132e2ee741ed052e7803f9ccde5b503f0be91d
SHA5129f8c53fb8b36a2098f73471b945cf434bec534b10ba5748045ad0fb6034ec71d61ca53522e9b951e26b8aedc768ac73764176da65a505f8eb8804a2b37058e38
-
Filesize
152KB
MD588505063bfe174330a0b64921ae996b2
SHA1822ee3826ec4864a3799d88c8c44e720a821ca9f
SHA256118bd4bc740ceb90ee746885aa223d084df5ea457db13a826ed426fc9bf3add8
SHA51259c8732370a884a81896eb2c8e2da1c33bb901521f61440f6496589c95e5f23c3ce8a75de4d62512e49471990dfde08d6de97923019a9290c58a5029c24525b9
-
Filesize
152KB
MD588505063bfe174330a0b64921ae996b2
SHA1822ee3826ec4864a3799d88c8c44e720a821ca9f
SHA256118bd4bc740ceb90ee746885aa223d084df5ea457db13a826ed426fc9bf3add8
SHA51259c8732370a884a81896eb2c8e2da1c33bb901521f61440f6496589c95e5f23c3ce8a75de4d62512e49471990dfde08d6de97923019a9290c58a5029c24525b9
-
Filesize
812KB
MD5f8fdccdc4cc17f6781497d69742aeb58
SHA1026edf00ad6a4f77a99a8100060184caeb9a58ba
SHA25697f751d8e067a8ff661e6f4cb0eb7cd3033abdb89d5e87e50581e011ff4f4144
SHA512ee4969810435ab43fd7fe1cfc42667544cdb9766dacca2258cc4a860983b6477a9c8c74e6e41ef6230a89fd016f8f044eb83ca5e96796a6375dacd28e7254ac1
-
Filesize
812KB
MD5f8fdccdc4cc17f6781497d69742aeb58
SHA1026edf00ad6a4f77a99a8100060184caeb9a58ba
SHA25697f751d8e067a8ff661e6f4cb0eb7cd3033abdb89d5e87e50581e011ff4f4144
SHA512ee4969810435ab43fd7fe1cfc42667544cdb9766dacca2258cc4a860983b6477a9c8c74e6e41ef6230a89fd016f8f044eb83ca5e96796a6375dacd28e7254ac1
-
Filesize
354KB
MD56b4ac0ee3d52ba9636ae9ebe431fbd3c
SHA1b2c57b93ed94801d16c996059663ee7f252b29c6
SHA2562d82a6d61b624173e1492efa0eb272cd0ba50b950c3390d5aa4f8ca4f5141dfd
SHA512c3a75c8dda2ecb1fdd11bcf398036c9e28d4504c589d8b720fa398b03bebb101c752b0ff200b6977883015583fa8653624d6debbe10457f864f43b3c40dcc89c
-
Filesize
354KB
MD56b4ac0ee3d52ba9636ae9ebe431fbd3c
SHA1b2c57b93ed94801d16c996059663ee7f252b29c6
SHA2562d82a6d61b624173e1492efa0eb272cd0ba50b950c3390d5aa4f8ca4f5141dfd
SHA512c3a75c8dda2ecb1fdd11bcf398036c9e28d4504c589d8b720fa398b03bebb101c752b0ff200b6977883015583fa8653624d6debbe10457f864f43b3c40dcc89c
-
Filesize
159KB
MD5ca379d9f27877f8cd46f40663d6310a0
SHA1b987d948282b9ac460bddb667c673a289dfd1f17
SHA2568325fd805649d3037ccf0fb384876c211a5a8f78fd43275815aaa4211c0673e8
SHA512889ce30d0c36698dbe9347b076a4ccc2411a8ff13b4f28d5a465ebcab4954d63cd282f2a097d424286ed0c58b7ead9a2a63ed876728d1a7efe5cb747ffd828f8
-
Filesize
159KB
MD5ca379d9f27877f8cd46f40663d6310a0
SHA1b987d948282b9ac460bddb667c673a289dfd1f17
SHA2568325fd805649d3037ccf0fb384876c211a5a8f78fd43275815aaa4211c0673e8
SHA512889ce30d0c36698dbe9347b076a4ccc2411a8ff13b4f28d5a465ebcab4954d63cd282f2a097d424286ed0c58b7ead9a2a63ed876728d1a7efe5cb747ffd828f8
-
Filesize
287KB
MD591bb1a6c1cf044d60a57f3cf6a3d0b17
SHA1df5d1eeaf9abc0870c9b2a0a45856211bddabf7a
SHA25613e77e12451713bfb5c3ebe71a070d6486f029b679793565d0da40b7744421a0
SHA51238cfe7e012c4f3c4641a0d156b971982bf8d04f6e861793b356483ba9497bc7275d27cb6e4ad7979133e12850c4b79d3b257c07b2a8f839a54c43b3f4709716d
-
Filesize
287KB
MD591bb1a6c1cf044d60a57f3cf6a3d0b17
SHA1df5d1eeaf9abc0870c9b2a0a45856211bddabf7a
SHA25613e77e12451713bfb5c3ebe71a070d6486f029b679793565d0da40b7744421a0
SHA51238cfe7e012c4f3c4641a0d156b971982bf8d04f6e861793b356483ba9497bc7275d27cb6e4ad7979133e12850c4b79d3b257c07b2a8f839a54c43b3f4709716d
-
Filesize
1.6MB
MD54f3387277ccbd6d1f21ac5c07fe4ca68
SHA1e16506f662dc92023bf82def1d621497c8ab5890
SHA256767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
SHA5129da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
-
Filesize
552KB
MD599ab358c6f267b09d7a596548654a6ba
SHA1d5a643074b69be2281a168983e3f6bef7322f676
SHA256586339f93c9c0eed8a42829ab307f2c5381a636edbcf80df3770c27555034380
SHA512952040785a3c1dcaea613d2e0d46745d5b631785d26de018fd9f85f8485161d056bf67b19c96ae618d35de5d5991a0dd549d749949faea7a2e0f9991a1aa2b2b
-
Filesize
73KB
MD51c7be730bdc4833afb7117d48c3fd513
SHA1dc7e38cfe2ae4a117922306aead5a7544af646b8
SHA2568206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1
SHA5127936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e
-
Filesize
73KB
MD51c7be730bdc4833afb7117d48c3fd513
SHA1dc7e38cfe2ae4a117922306aead5a7544af646b8
SHA2568206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1
SHA5127936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
779KB
MD570f2afb7b9313b21cd852a33bebe23d8
SHA16d17a890977a7434fed0ab6f75f125335af36687
SHA2563f7c916efbd1fae45d696f00791a93d9ad2adf18b2ee66daddb30a9d431dfe18
SHA512dd00d319a17ee6eed692aa80426ce5004be98e550fe567c3b5d725d931e258107eb7fe2a2a181ba97b90093674bb50880b78de10ec4e64b75ecde3b303cdc447
-
Filesize
779KB
MD570f2afb7b9313b21cd852a33bebe23d8
SHA16d17a890977a7434fed0ab6f75f125335af36687
SHA2563f7c916efbd1fae45d696f00791a93d9ad2adf18b2ee66daddb30a9d431dfe18
SHA512dd00d319a17ee6eed692aa80426ce5004be98e550fe567c3b5d725d931e258107eb7fe2a2a181ba97b90093674bb50880b78de10ec4e64b75ecde3b303cdc447
-
Filesize
2.9MB
MD537b7f135d14d9619b4ba8be4e70fb1da
SHA13c057bf6c77427a0858a0de811ddd85d7997e637
SHA256ef0c34580084f9855c1e5c3fa9d902688d400baabc7366c8da9ba3d4b708da49
SHA512e524fe6e34ee565b72e3007e12b05bd18796b9d893bc09b491791f6685f76bc8c2ecbe2c6fe7db69392037677dbe341715ec67294e7f30318278a084dfb9ae9d
-
Filesize
2.9MB
MD537b7f135d14d9619b4ba8be4e70fb1da
SHA13c057bf6c77427a0858a0de811ddd85d7997e637
SHA256ef0c34580084f9855c1e5c3fa9d902688d400baabc7366c8da9ba3d4b708da49
SHA512e524fe6e34ee565b72e3007e12b05bd18796b9d893bc09b491791f6685f76bc8c2ecbe2c6fe7db69392037677dbe341715ec67294e7f30318278a084dfb9ae9d
-
Filesize
207KB
MD55af25bcc8fd797711169f7f52dbdd937
SHA170cf4c311d1e99370950127ca2356f7be394d7c6
SHA2569eb0745707844b1c221f21e39cdcdedb34d846d1b22f2ae42c04b1ba6cc705d2
SHA51244dcab3d1071a74767ea8a7f54fb981247821bec6fee473194f284ed39e38749756627c5f87febdd2e2d7c9c93a39c21169f3676f6f07d0691f900d0cead8e18
-
Filesize
207KB
MD55af25bcc8fd797711169f7f52dbdd937
SHA170cf4c311d1e99370950127ca2356f7be394d7c6
SHA2569eb0745707844b1c221f21e39cdcdedb34d846d1b22f2ae42c04b1ba6cc705d2
SHA51244dcab3d1071a74767ea8a7f54fb981247821bec6fee473194f284ed39e38749756627c5f87febdd2e2d7c9c93a39c21169f3676f6f07d0691f900d0cead8e18
-
Filesize
1.3MB
MD54fb5bc707c2f71fb67893ed1d183949e
SHA14ce9398b419e77538a4e0cef525047faab0a3c55
SHA256aca9dd38a2ba32a8719ebccce775b58d22aa46a6e72aaf86eb7c4e8e4226bc3a
SHA5128a1a0e61eec4bc2ff7d9c036d356d76cf96aa66330898774f3cdb5bbd9e4de6f8fb75acdd5c6bc3d5dca9669128324b906889f62c50dbebacfda52b2263a0fd3
-
Filesize
1.3MB
MD54fb5bc707c2f71fb67893ed1d183949e
SHA14ce9398b419e77538a4e0cef525047faab0a3c55
SHA256aca9dd38a2ba32a8719ebccce775b58d22aa46a6e72aaf86eb7c4e8e4226bc3a
SHA5128a1a0e61eec4bc2ff7d9c036d356d76cf96aa66330898774f3cdb5bbd9e4de6f8fb75acdd5c6bc3d5dca9669128324b906889f62c50dbebacfda52b2263a0fd3
-
Filesize
1.6MB
MD5801bb3459576ae9b42562b56bb62c11d
SHA12c7e04c2d7eeee2a4d02eb4e9f7e4eecca19f9de
SHA2561644caa0d0aaf9a1d752cdc5808ca930bb935cee74c94f8a9e3c9187b86fec4f
SHA512520e9483501908334e80567d54560d89627a477a430cd175f3b145c236d62868b3b5fb484bcfb0072bade949a2c108056c3cb371f6b8ea3a86f7679f5acd5ee8
-
Filesize
1.6MB
MD5801bb3459576ae9b42562b56bb62c11d
SHA12c7e04c2d7eeee2a4d02eb4e9f7e4eecca19f9de
SHA2561644caa0d0aaf9a1d752cdc5808ca930bb935cee74c94f8a9e3c9187b86fec4f
SHA512520e9483501908334e80567d54560d89627a477a430cd175f3b145c236d62868b3b5fb484bcfb0072bade949a2c108056c3cb371f6b8ea3a86f7679f5acd5ee8
-
Filesize
3.5MB
MD56a132fec0229a82f641efd9f2b489348
SHA1e54f7f270f155e813adcb1adbbd8b0d310c790d5
SHA25691b5dd1d3b3389471526471e7bbd23f70c9a94ce73733e21b8c7f99a6b3a6d1d
SHA512428438a50d4d937e5e4cb0118882c1ad8c979ee838a8220c4e2f74ed902113478f75c1c1c1db8702f3cb76c88a9cdc08bda40670d15b62d37b7fd4efe282045c
-
Filesize
3.5MB
MD56a132fec0229a82f641efd9f2b489348
SHA1e54f7f270f155e813adcb1adbbd8b0d310c790d5
SHA25691b5dd1d3b3389471526471e7bbd23f70c9a94ce73733e21b8c7f99a6b3a6d1d
SHA512428438a50d4d937e5e4cb0118882c1ad8c979ee838a8220c4e2f74ed902113478f75c1c1c1db8702f3cb76c88a9cdc08bda40670d15b62d37b7fd4efe282045c
-
Filesize
358KB
MD535146e6f59939bbab658447a4fc35a20
SHA12dba31b8a7e6b35c894c1eba8ecd6673c9629ac9
SHA25610ff493a786dc86d0e62dfedb9b80b9b8ceee61bfcf6cee78775f3479bfc28ac
SHA512dcb296031fddc53df37ace57ca2bd6e84da38770a91f6363a4bc91efbed330cbcfbe31c52a39faa1198b6586c8c7f7aed517db11cb908c1d48220c290cb4a4d9
-
Filesize
358KB
MD535146e6f59939bbab658447a4fc35a20
SHA12dba31b8a7e6b35c894c1eba8ecd6673c9629ac9
SHA25610ff493a786dc86d0e62dfedb9b80b9b8ceee61bfcf6cee78775f3479bfc28ac
SHA512dcb296031fddc53df37ace57ca2bd6e84da38770a91f6363a4bc91efbed330cbcfbe31c52a39faa1198b6586c8c7f7aed517db11cb908c1d48220c290cb4a4d9