Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
109s -
platform
windows7_x64 -
resource
win7-20230621-en -
resource tags
arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system -
submitted
01/07/2023, 09:44
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20230621-en
General
-
Target
file.exe
-
Size
830KB
-
MD5
8dbb1156df4a35f59fc6f61991c3182f
-
SHA1
6a3673d4cb082006d3eb7dc929afb2cc1c130e49
-
SHA256
a9781c88d549b9c7d208fdcd490c9ac64079263f647d566830216dc9266c3727
-
SHA512
37f834633d6ae8368d22820c8c067cccb23fa6bf0cbcd7223a1f7c70d2bec8bcc3c63f6fe79ae1a9e7d1fb11ab90d05eb3fa35af21ab00f0f6c7a4df0588fa08
-
SSDEEP
24576:1WnYh8gqkPSbODGA4lee73Ei8kVY2HCTO:1WYh8gBPSA4hP8kVeK
Malware Config
Extracted
redline
mucha
83.97.73.131:19071
-
auth_value
5d76e123341992ecf110010eb89456f0
Extracted
amadey
3.84
77.91.68.63/doma/net/index.php
Extracted
smokeloader
2022
http://77.91.68.29/fks/
Signatures
-
Detects Healer an antivirus disabler dropper 5 IoCs
resource yara_rule behavioral1/memory/824-104-0x0000000000020000-0x000000000002A000-memory.dmp healer behavioral1/files/0x0006000000014352-109.dat healer behavioral1/files/0x0006000000014352-111.dat healer behavioral1/files/0x0006000000014352-112.dat healer behavioral1/memory/1808-113-0x0000000000CE0000-0x0000000000CEA000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" a4137291.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" b9444360.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" b9444360.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" b9444360.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" b9444360.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" b9444360.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection a4137291.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" a4137291.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" a4137291.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" a4137291.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" a4137291.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 11 IoCs
pid Process 1460 v3438979.exe 584 v7686361.exe 2028 v8178489.exe 824 a4137291.exe 1808 b9444360.exe 1092 c5150846.exe 1468 d4724097.exe 1188 e7278973.exe 1540 rugen.exe 1796 rugen.exe 1524 rugen.exe -
Loads dropped DLL 22 IoCs
pid Process 1724 file.exe 1460 v3438979.exe 1460 v3438979.exe 584 v7686361.exe 584 v7686361.exe 2028 v8178489.exe 2028 v8178489.exe 2028 v8178489.exe 824 a4137291.exe 2028 v8178489.exe 584 v7686361.exe 584 v7686361.exe 1092 c5150846.exe 1460 v3438979.exe 1460 v3438979.exe 1468 d4724097.exe 1724 file.exe 1188 e7278973.exe 1764 rundll32.exe 1764 rundll32.exe 1764 rundll32.exe 1764 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" a4137291.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features b9444360.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" b9444360.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features a4137291.exe -
Adds Run key to start application 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce v7686361.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" v7686361.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce v8178489.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" v8178489.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce file.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" file.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce v3438979.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" v3438979.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d4724097.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d4724097.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d4724097.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1044 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 824 a4137291.exe 824 a4137291.exe 1808 b9444360.exe 1808 b9444360.exe 1092 c5150846.exe 1092 c5150846.exe 1468 d4724097.exe 1468 d4724097.exe 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1264 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1468 d4724097.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 824 a4137291.exe Token: SeDebugPrivilege 1808 b9444360.exe Token: SeDebugPrivilege 1092 c5150846.exe Token: SeShutdownPrivilege 1264 Process not Found -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1188 e7278973.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1724 wrote to memory of 1460 1724 file.exe 29 PID 1724 wrote to memory of 1460 1724 file.exe 29 PID 1724 wrote to memory of 1460 1724 file.exe 29 PID 1724 wrote to memory of 1460 1724 file.exe 29 PID 1724 wrote to memory of 1460 1724 file.exe 29 PID 1724 wrote to memory of 1460 1724 file.exe 29 PID 1724 wrote to memory of 1460 1724 file.exe 29 PID 1460 wrote to memory of 584 1460 v3438979.exe 30 PID 1460 wrote to memory of 584 1460 v3438979.exe 30 PID 1460 wrote to memory of 584 1460 v3438979.exe 30 PID 1460 wrote to memory of 584 1460 v3438979.exe 30 PID 1460 wrote to memory of 584 1460 v3438979.exe 30 PID 1460 wrote to memory of 584 1460 v3438979.exe 30 PID 1460 wrote to memory of 584 1460 v3438979.exe 30 PID 584 wrote to memory of 2028 584 v7686361.exe 31 PID 584 wrote to memory of 2028 584 v7686361.exe 31 PID 584 wrote to memory of 2028 584 v7686361.exe 31 PID 584 wrote to memory of 2028 584 v7686361.exe 31 PID 584 wrote to memory of 2028 584 v7686361.exe 31 PID 584 wrote to memory of 2028 584 v7686361.exe 31 PID 584 wrote to memory of 2028 584 v7686361.exe 31 PID 2028 wrote to memory of 824 2028 v8178489.exe 32 PID 2028 wrote to memory of 824 2028 v8178489.exe 32 PID 2028 wrote to memory of 824 2028 v8178489.exe 32 PID 2028 wrote to memory of 824 2028 v8178489.exe 32 PID 2028 wrote to memory of 824 2028 v8178489.exe 32 PID 2028 wrote to memory of 824 2028 v8178489.exe 32 PID 2028 wrote to memory of 824 2028 v8178489.exe 32 PID 2028 wrote to memory of 1808 2028 v8178489.exe 34 PID 2028 wrote to memory of 1808 2028 v8178489.exe 34 PID 2028 wrote to memory of 1808 2028 v8178489.exe 34 PID 2028 wrote to memory of 1808 2028 v8178489.exe 34 PID 2028 wrote to memory of 1808 2028 v8178489.exe 34 PID 2028 wrote to memory of 1808 2028 v8178489.exe 34 PID 2028 wrote to memory of 1808 2028 v8178489.exe 34 PID 584 wrote to memory of 1092 584 v7686361.exe 35 PID 584 wrote to memory of 1092 584 v7686361.exe 35 PID 584 wrote to memory of 1092 584 v7686361.exe 35 PID 584 wrote to memory of 1092 584 v7686361.exe 35 PID 584 wrote to memory of 1092 584 v7686361.exe 35 PID 584 wrote to memory of 1092 584 v7686361.exe 35 PID 584 wrote to memory of 1092 584 v7686361.exe 35 PID 1460 wrote to memory of 1468 1460 v3438979.exe 38 PID 1460 wrote to memory of 1468 1460 v3438979.exe 38 PID 1460 wrote to memory of 1468 1460 v3438979.exe 38 PID 1460 wrote to memory of 1468 1460 v3438979.exe 38 PID 1460 wrote to memory of 1468 1460 v3438979.exe 38 PID 1460 wrote to memory of 1468 1460 v3438979.exe 38 PID 1460 wrote to memory of 1468 1460 v3438979.exe 38 PID 1724 wrote to memory of 1188 1724 file.exe 39 PID 1724 wrote to memory of 1188 1724 file.exe 39 PID 1724 wrote to memory of 1188 1724 file.exe 39 PID 1724 wrote to memory of 1188 1724 file.exe 39 PID 1188 wrote to memory of 1540 1188 e7278973.exe 40 PID 1188 wrote to memory of 1540 1188 e7278973.exe 40 PID 1188 wrote to memory of 1540 1188 e7278973.exe 40 PID 1188 wrote to memory of 1540 1188 e7278973.exe 40 PID 1540 wrote to memory of 1044 1540 rugen.exe 41 PID 1540 wrote to memory of 1044 1540 rugen.exe 41 PID 1540 wrote to memory of 1044 1540 rugen.exe 41 PID 1540 wrote to memory of 1044 1540 rugen.exe 41 PID 1540 wrote to memory of 1532 1540 rugen.exe 43 PID 1540 wrote to memory of 1532 1540 rugen.exe 43 PID 1540 wrote to memory of 1532 1540 rugen.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3438979.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3438979.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7686361.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7686361.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:584 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8178489.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8178489.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a4137291.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a4137291.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:824
-
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b9444360.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b9444360.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1808
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c5150846.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c5150846.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1092
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d4724097.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d4724097.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1468
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e7278973.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e7278973.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe"C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rugen.exe /TR "C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe" /F4⤵
- Creates scheduled task(s)
PID:1044
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "rugen.exe" /P "Admin:N"&&CACLS "rugen.exe" /P "Admin:R" /E&&echo Y|CACLS "..\200f691d32" /P "Admin:N"&&CACLS "..\200f691d32" /P "Admin:R" /E&&Exit4⤵PID:1532
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:1672
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "rugen.exe" /P "Admin:N"5⤵PID:1696
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "rugen.exe" /P "Admin:R" /E5⤵PID:1808
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:292
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\200f691d32" /P "Admin:N"5⤵PID:1244
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\200f691d32" /P "Admin:R" /E5⤵PID:1928
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
PID:1764
-
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {89CC3B5E-9B5A-4400-9770-AD90BB9355DE} S-1-5-21-1437583205-2177757337-340526699-1000:XVLNHWCX\Admin:Interactive:[1]1⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exeC:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe2⤵
- Executes dropped EXE
PID:1796
-
-
C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exeC:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe2⤵
- Executes dropped EXE
PID:1524
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
205KB
MD5835f1373b125353f2b0615a2f105d3dd
SHA11aae6edfedcfe6d6828b98b114c581d9f15db807
SHA25600f972eb3d4d2fac05c10c0e6e212cf096b4142b5b5075b29c6c100d51432cd4
SHA5128826d5ff3ab691094eabf4cec3444752ed46714705dae25bc48b5c9ee36c7c9b9cf8606460e71df519dd26a91798ab8be3415e7465df82d362d602e96ebb25e5
-
Filesize
205KB
MD5835f1373b125353f2b0615a2f105d3dd
SHA11aae6edfedcfe6d6828b98b114c581d9f15db807
SHA25600f972eb3d4d2fac05c10c0e6e212cf096b4142b5b5075b29c6c100d51432cd4
SHA5128826d5ff3ab691094eabf4cec3444752ed46714705dae25bc48b5c9ee36c7c9b9cf8606460e71df519dd26a91798ab8be3415e7465df82d362d602e96ebb25e5
-
Filesize
205KB
MD5835f1373b125353f2b0615a2f105d3dd
SHA11aae6edfedcfe6d6828b98b114c581d9f15db807
SHA25600f972eb3d4d2fac05c10c0e6e212cf096b4142b5b5075b29c6c100d51432cd4
SHA5128826d5ff3ab691094eabf4cec3444752ed46714705dae25bc48b5c9ee36c7c9b9cf8606460e71df519dd26a91798ab8be3415e7465df82d362d602e96ebb25e5
-
Filesize
205KB
MD5835f1373b125353f2b0615a2f105d3dd
SHA11aae6edfedcfe6d6828b98b114c581d9f15db807
SHA25600f972eb3d4d2fac05c10c0e6e212cf096b4142b5b5075b29c6c100d51432cd4
SHA5128826d5ff3ab691094eabf4cec3444752ed46714705dae25bc48b5c9ee36c7c9b9cf8606460e71df519dd26a91798ab8be3415e7465df82d362d602e96ebb25e5
-
Filesize
205KB
MD5835f1373b125353f2b0615a2f105d3dd
SHA11aae6edfedcfe6d6828b98b114c581d9f15db807
SHA25600f972eb3d4d2fac05c10c0e6e212cf096b4142b5b5075b29c6c100d51432cd4
SHA5128826d5ff3ab691094eabf4cec3444752ed46714705dae25bc48b5c9ee36c7c9b9cf8606460e71df519dd26a91798ab8be3415e7465df82d362d602e96ebb25e5
-
Filesize
205KB
MD5835f1373b125353f2b0615a2f105d3dd
SHA11aae6edfedcfe6d6828b98b114c581d9f15db807
SHA25600f972eb3d4d2fac05c10c0e6e212cf096b4142b5b5075b29c6c100d51432cd4
SHA5128826d5ff3ab691094eabf4cec3444752ed46714705dae25bc48b5c9ee36c7c9b9cf8606460e71df519dd26a91798ab8be3415e7465df82d362d602e96ebb25e5
-
Filesize
205KB
MD5835f1373b125353f2b0615a2f105d3dd
SHA11aae6edfedcfe6d6828b98b114c581d9f15db807
SHA25600f972eb3d4d2fac05c10c0e6e212cf096b4142b5b5075b29c6c100d51432cd4
SHA5128826d5ff3ab691094eabf4cec3444752ed46714705dae25bc48b5c9ee36c7c9b9cf8606460e71df519dd26a91798ab8be3415e7465df82d362d602e96ebb25e5
-
Filesize
554KB
MD56943e9ce4c1893b30fdc40d24499d5f0
SHA1ba62f2b80f8d50dc849f196388ec1ef23f282ef8
SHA256213dad9a5b1d0e7ecd7a1cd4c0386b1a8d2c7b6918578acdd80db761f0fc0e48
SHA51275628a14c60b4786b910eed3fb0d898ae684f4775aff4ab7a373d250af178fe50329dfbba47c0d7a59a90d8e10f22bc2af30fe53b62bc3e63669fc11fe6469de
-
Filesize
554KB
MD56943e9ce4c1893b30fdc40d24499d5f0
SHA1ba62f2b80f8d50dc849f196388ec1ef23f282ef8
SHA256213dad9a5b1d0e7ecd7a1cd4c0386b1a8d2c7b6918578acdd80db761f0fc0e48
SHA51275628a14c60b4786b910eed3fb0d898ae684f4775aff4ab7a373d250af178fe50329dfbba47c0d7a59a90d8e10f22bc2af30fe53b62bc3e63669fc11fe6469de
-
Filesize
30KB
MD535a15fad3767597b01a20d75c3c6889a
SHA1eef19e2757667578f73c4b5720cf94c2ab6e60c8
SHA25690ccd84f28e4dd03fb70b8739c4636acbcf8a030404b5a24264afd1acd09ecbc
SHA512c1ea2659e28130f00869391a33dfdc2a763a710a56de2acaa6c71caa9c1eb5809e7ca1dfa1620ac5c3174052d3e277b832853a137a4663483855295fdab23577
-
Filesize
30KB
MD535a15fad3767597b01a20d75c3c6889a
SHA1eef19e2757667578f73c4b5720cf94c2ab6e60c8
SHA25690ccd84f28e4dd03fb70b8739c4636acbcf8a030404b5a24264afd1acd09ecbc
SHA512c1ea2659e28130f00869391a33dfdc2a763a710a56de2acaa6c71caa9c1eb5809e7ca1dfa1620ac5c3174052d3e277b832853a137a4663483855295fdab23577
-
Filesize
30KB
MD535a15fad3767597b01a20d75c3c6889a
SHA1eef19e2757667578f73c4b5720cf94c2ab6e60c8
SHA25690ccd84f28e4dd03fb70b8739c4636acbcf8a030404b5a24264afd1acd09ecbc
SHA512c1ea2659e28130f00869391a33dfdc2a763a710a56de2acaa6c71caa9c1eb5809e7ca1dfa1620ac5c3174052d3e277b832853a137a4663483855295fdab23577
-
Filesize
430KB
MD508f694f11cb5283a9bbb90d054d78960
SHA145b0d141165820f97bba1e32b77da225455402ba
SHA256db88f3817e1a82781d8abb995696644914888f30869776c2f15872965d0ed1b9
SHA512def161567610558cb6b97520520594549077f53683cbc5ac238b6f11e2b7ae3305c33cd5d7b2a6d64a099603151bb4056047d2049b0bc75d9b44185c24a871d5
-
Filesize
430KB
MD508f694f11cb5283a9bbb90d054d78960
SHA145b0d141165820f97bba1e32b77da225455402ba
SHA256db88f3817e1a82781d8abb995696644914888f30869776c2f15872965d0ed1b9
SHA512def161567610558cb6b97520520594549077f53683cbc5ac238b6f11e2b7ae3305c33cd5d7b2a6d64a099603151bb4056047d2049b0bc75d9b44185c24a871d5
-
Filesize
275KB
MD55739f7c4bffb0b1c95040c22137a7deb
SHA1dd3aa71593bd3ca68824940158af13f81bdbbf81
SHA256f768009dcdb486f303c498c5579535f8d4550aadced7db60e9cd501d1868e19e
SHA51281e8f126e338119d2dafbb515ba24a82c3619eda81398ecacba1ccda2637336d2153419629d5ab81dafc6d015f3cdf1ad98c24093800744ab850a2ef5bbf9bd4
-
Filesize
275KB
MD55739f7c4bffb0b1c95040c22137a7deb
SHA1dd3aa71593bd3ca68824940158af13f81bdbbf81
SHA256f768009dcdb486f303c498c5579535f8d4550aadced7db60e9cd501d1868e19e
SHA51281e8f126e338119d2dafbb515ba24a82c3619eda81398ecacba1ccda2637336d2153419629d5ab81dafc6d015f3cdf1ad98c24093800744ab850a2ef5bbf9bd4
-
Filesize
275KB
MD55739f7c4bffb0b1c95040c22137a7deb
SHA1dd3aa71593bd3ca68824940158af13f81bdbbf81
SHA256f768009dcdb486f303c498c5579535f8d4550aadced7db60e9cd501d1868e19e
SHA51281e8f126e338119d2dafbb515ba24a82c3619eda81398ecacba1ccda2637336d2153419629d5ab81dafc6d015f3cdf1ad98c24093800744ab850a2ef5bbf9bd4
-
Filesize
227KB
MD5631c77cc77f98e66f4c9778d0d0d7c8b
SHA16d11dbc545916e2228f3b5f48551d8b01ddac12a
SHA2560e38f7619ce11b8dd180efc5827d34776c70504c7bc728d97158aa6618212cad
SHA5122f7a6fc05744a7cce138b72b1579c83755c3248b4256268d4df4600dc07ef32bab1f9a7a362ecd5fcf08a3cafbe971648094de653f3c2b48db0f05b29f00527b
-
Filesize
227KB
MD5631c77cc77f98e66f4c9778d0d0d7c8b
SHA16d11dbc545916e2228f3b5f48551d8b01ddac12a
SHA2560e38f7619ce11b8dd180efc5827d34776c70504c7bc728d97158aa6618212cad
SHA5122f7a6fc05744a7cce138b72b1579c83755c3248b4256268d4df4600dc07ef32bab1f9a7a362ecd5fcf08a3cafbe971648094de653f3c2b48db0f05b29f00527b
-
Filesize
176KB
MD5211a06e9ae68ced1234252a48696431b
SHA169950e2ee2fafd177d1a295836713bfd8d18df9c
SHA2560bdca9c84103454e329cfde4e69dc41a0ec0196c078c8fc195b0fa739d2f905d
SHA512b1643ba376075619335b4bdf0d7610aece13b7c9db60eecb508465f97ef3e6a9d5297f9ac8529886efa052cdd8814ac7d4eeab44812f797a1b2dc5fa967ee7eb
-
Filesize
176KB
MD5211a06e9ae68ced1234252a48696431b
SHA169950e2ee2fafd177d1a295836713bfd8d18df9c
SHA2560bdca9c84103454e329cfde4e69dc41a0ec0196c078c8fc195b0fa739d2f905d
SHA512b1643ba376075619335b4bdf0d7610aece13b7c9db60eecb508465f97ef3e6a9d5297f9ac8529886efa052cdd8814ac7d4eeab44812f797a1b2dc5fa967ee7eb
-
Filesize
176KB
MD5211a06e9ae68ced1234252a48696431b
SHA169950e2ee2fafd177d1a295836713bfd8d18df9c
SHA2560bdca9c84103454e329cfde4e69dc41a0ec0196c078c8fc195b0fa739d2f905d
SHA512b1643ba376075619335b4bdf0d7610aece13b7c9db60eecb508465f97ef3e6a9d5297f9ac8529886efa052cdd8814ac7d4eeab44812f797a1b2dc5fa967ee7eb
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
89KB
MD583fc14fb36516facb19e0e96286f7f48
SHA140082ca06de4c377585cd164fb521bacadb673da
SHA25608dabdd0b0fb13d5d748daf1173f392aa27eb9943eef78bd29e6a8fa61007a6e
SHA512ba60d28195b8ce60fd6f4cd57919a190c910af3e71e2858ed266a958314798ed51323d3c870c572d2fb873aae34387afa0dd8c7624e5f5cf51e586aafb76efcf
-
Filesize
89KB
MD583fc14fb36516facb19e0e96286f7f48
SHA140082ca06de4c377585cd164fb521bacadb673da
SHA25608dabdd0b0fb13d5d748daf1173f392aa27eb9943eef78bd29e6a8fa61007a6e
SHA512ba60d28195b8ce60fd6f4cd57919a190c910af3e71e2858ed266a958314798ed51323d3c870c572d2fb873aae34387afa0dd8c7624e5f5cf51e586aafb76efcf
-
Filesize
273B
MD504a943771990ab49147e63e8c2fbbed0
SHA1a2bde564bef4f63749716621693a3cfb7bd4d55e
SHA256587c2fb0cf025a255a077b24fe6433fd67bdfac451d74d321d86db96c369841e
SHA51240e325e6e50e2d7b6c9dd0c555e23c85c4a45bd1829a76efa0383dcc05ac5fd19a14804079a5d2523ded92b03b6e3051c3e8780053795be3359bf32dd3094a6d
-
Filesize
205KB
MD5835f1373b125353f2b0615a2f105d3dd
SHA11aae6edfedcfe6d6828b98b114c581d9f15db807
SHA25600f972eb3d4d2fac05c10c0e6e212cf096b4142b5b5075b29c6c100d51432cd4
SHA5128826d5ff3ab691094eabf4cec3444752ed46714705dae25bc48b5c9ee36c7c9b9cf8606460e71df519dd26a91798ab8be3415e7465df82d362d602e96ebb25e5
-
Filesize
205KB
MD5835f1373b125353f2b0615a2f105d3dd
SHA11aae6edfedcfe6d6828b98b114c581d9f15db807
SHA25600f972eb3d4d2fac05c10c0e6e212cf096b4142b5b5075b29c6c100d51432cd4
SHA5128826d5ff3ab691094eabf4cec3444752ed46714705dae25bc48b5c9ee36c7c9b9cf8606460e71df519dd26a91798ab8be3415e7465df82d362d602e96ebb25e5
-
Filesize
554KB
MD56943e9ce4c1893b30fdc40d24499d5f0
SHA1ba62f2b80f8d50dc849f196388ec1ef23f282ef8
SHA256213dad9a5b1d0e7ecd7a1cd4c0386b1a8d2c7b6918578acdd80db761f0fc0e48
SHA51275628a14c60b4786b910eed3fb0d898ae684f4775aff4ab7a373d250af178fe50329dfbba47c0d7a59a90d8e10f22bc2af30fe53b62bc3e63669fc11fe6469de
-
Filesize
554KB
MD56943e9ce4c1893b30fdc40d24499d5f0
SHA1ba62f2b80f8d50dc849f196388ec1ef23f282ef8
SHA256213dad9a5b1d0e7ecd7a1cd4c0386b1a8d2c7b6918578acdd80db761f0fc0e48
SHA51275628a14c60b4786b910eed3fb0d898ae684f4775aff4ab7a373d250af178fe50329dfbba47c0d7a59a90d8e10f22bc2af30fe53b62bc3e63669fc11fe6469de
-
Filesize
30KB
MD535a15fad3767597b01a20d75c3c6889a
SHA1eef19e2757667578f73c4b5720cf94c2ab6e60c8
SHA25690ccd84f28e4dd03fb70b8739c4636acbcf8a030404b5a24264afd1acd09ecbc
SHA512c1ea2659e28130f00869391a33dfdc2a763a710a56de2acaa6c71caa9c1eb5809e7ca1dfa1620ac5c3174052d3e277b832853a137a4663483855295fdab23577
-
Filesize
30KB
MD535a15fad3767597b01a20d75c3c6889a
SHA1eef19e2757667578f73c4b5720cf94c2ab6e60c8
SHA25690ccd84f28e4dd03fb70b8739c4636acbcf8a030404b5a24264afd1acd09ecbc
SHA512c1ea2659e28130f00869391a33dfdc2a763a710a56de2acaa6c71caa9c1eb5809e7ca1dfa1620ac5c3174052d3e277b832853a137a4663483855295fdab23577
-
Filesize
30KB
MD535a15fad3767597b01a20d75c3c6889a
SHA1eef19e2757667578f73c4b5720cf94c2ab6e60c8
SHA25690ccd84f28e4dd03fb70b8739c4636acbcf8a030404b5a24264afd1acd09ecbc
SHA512c1ea2659e28130f00869391a33dfdc2a763a710a56de2acaa6c71caa9c1eb5809e7ca1dfa1620ac5c3174052d3e277b832853a137a4663483855295fdab23577
-
Filesize
430KB
MD508f694f11cb5283a9bbb90d054d78960
SHA145b0d141165820f97bba1e32b77da225455402ba
SHA256db88f3817e1a82781d8abb995696644914888f30869776c2f15872965d0ed1b9
SHA512def161567610558cb6b97520520594549077f53683cbc5ac238b6f11e2b7ae3305c33cd5d7b2a6d64a099603151bb4056047d2049b0bc75d9b44185c24a871d5
-
Filesize
430KB
MD508f694f11cb5283a9bbb90d054d78960
SHA145b0d141165820f97bba1e32b77da225455402ba
SHA256db88f3817e1a82781d8abb995696644914888f30869776c2f15872965d0ed1b9
SHA512def161567610558cb6b97520520594549077f53683cbc5ac238b6f11e2b7ae3305c33cd5d7b2a6d64a099603151bb4056047d2049b0bc75d9b44185c24a871d5
-
Filesize
275KB
MD55739f7c4bffb0b1c95040c22137a7deb
SHA1dd3aa71593bd3ca68824940158af13f81bdbbf81
SHA256f768009dcdb486f303c498c5579535f8d4550aadced7db60e9cd501d1868e19e
SHA51281e8f126e338119d2dafbb515ba24a82c3619eda81398ecacba1ccda2637336d2153419629d5ab81dafc6d015f3cdf1ad98c24093800744ab850a2ef5bbf9bd4
-
Filesize
275KB
MD55739f7c4bffb0b1c95040c22137a7deb
SHA1dd3aa71593bd3ca68824940158af13f81bdbbf81
SHA256f768009dcdb486f303c498c5579535f8d4550aadced7db60e9cd501d1868e19e
SHA51281e8f126e338119d2dafbb515ba24a82c3619eda81398ecacba1ccda2637336d2153419629d5ab81dafc6d015f3cdf1ad98c24093800744ab850a2ef5bbf9bd4
-
Filesize
275KB
MD55739f7c4bffb0b1c95040c22137a7deb
SHA1dd3aa71593bd3ca68824940158af13f81bdbbf81
SHA256f768009dcdb486f303c498c5579535f8d4550aadced7db60e9cd501d1868e19e
SHA51281e8f126e338119d2dafbb515ba24a82c3619eda81398ecacba1ccda2637336d2153419629d5ab81dafc6d015f3cdf1ad98c24093800744ab850a2ef5bbf9bd4
-
Filesize
227KB
MD5631c77cc77f98e66f4c9778d0d0d7c8b
SHA16d11dbc545916e2228f3b5f48551d8b01ddac12a
SHA2560e38f7619ce11b8dd180efc5827d34776c70504c7bc728d97158aa6618212cad
SHA5122f7a6fc05744a7cce138b72b1579c83755c3248b4256268d4df4600dc07ef32bab1f9a7a362ecd5fcf08a3cafbe971648094de653f3c2b48db0f05b29f00527b
-
Filesize
227KB
MD5631c77cc77f98e66f4c9778d0d0d7c8b
SHA16d11dbc545916e2228f3b5f48551d8b01ddac12a
SHA2560e38f7619ce11b8dd180efc5827d34776c70504c7bc728d97158aa6618212cad
SHA5122f7a6fc05744a7cce138b72b1579c83755c3248b4256268d4df4600dc07ef32bab1f9a7a362ecd5fcf08a3cafbe971648094de653f3c2b48db0f05b29f00527b
-
Filesize
176KB
MD5211a06e9ae68ced1234252a48696431b
SHA169950e2ee2fafd177d1a295836713bfd8d18df9c
SHA2560bdca9c84103454e329cfde4e69dc41a0ec0196c078c8fc195b0fa739d2f905d
SHA512b1643ba376075619335b4bdf0d7610aece13b7c9db60eecb508465f97ef3e6a9d5297f9ac8529886efa052cdd8814ac7d4eeab44812f797a1b2dc5fa967ee7eb
-
Filesize
176KB
MD5211a06e9ae68ced1234252a48696431b
SHA169950e2ee2fafd177d1a295836713bfd8d18df9c
SHA2560bdca9c84103454e329cfde4e69dc41a0ec0196c078c8fc195b0fa739d2f905d
SHA512b1643ba376075619335b4bdf0d7610aece13b7c9db60eecb508465f97ef3e6a9d5297f9ac8529886efa052cdd8814ac7d4eeab44812f797a1b2dc5fa967ee7eb
-
Filesize
176KB
MD5211a06e9ae68ced1234252a48696431b
SHA169950e2ee2fafd177d1a295836713bfd8d18df9c
SHA2560bdca9c84103454e329cfde4e69dc41a0ec0196c078c8fc195b0fa739d2f905d
SHA512b1643ba376075619335b4bdf0d7610aece13b7c9db60eecb508465f97ef3e6a9d5297f9ac8529886efa052cdd8814ac7d4eeab44812f797a1b2dc5fa967ee7eb
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
89KB
MD583fc14fb36516facb19e0e96286f7f48
SHA140082ca06de4c377585cd164fb521bacadb673da
SHA25608dabdd0b0fb13d5d748daf1173f392aa27eb9943eef78bd29e6a8fa61007a6e
SHA512ba60d28195b8ce60fd6f4cd57919a190c910af3e71e2858ed266a958314798ed51323d3c870c572d2fb873aae34387afa0dd8c7624e5f5cf51e586aafb76efcf
-
Filesize
89KB
MD583fc14fb36516facb19e0e96286f7f48
SHA140082ca06de4c377585cd164fb521bacadb673da
SHA25608dabdd0b0fb13d5d748daf1173f392aa27eb9943eef78bd29e6a8fa61007a6e
SHA512ba60d28195b8ce60fd6f4cd57919a190c910af3e71e2858ed266a958314798ed51323d3c870c572d2fb873aae34387afa0dd8c7624e5f5cf51e586aafb76efcf
-
Filesize
89KB
MD583fc14fb36516facb19e0e96286f7f48
SHA140082ca06de4c377585cd164fb521bacadb673da
SHA25608dabdd0b0fb13d5d748daf1173f392aa27eb9943eef78bd29e6a8fa61007a6e
SHA512ba60d28195b8ce60fd6f4cd57919a190c910af3e71e2858ed266a958314798ed51323d3c870c572d2fb873aae34387afa0dd8c7624e5f5cf51e586aafb76efcf
-
Filesize
89KB
MD583fc14fb36516facb19e0e96286f7f48
SHA140082ca06de4c377585cd164fb521bacadb673da
SHA25608dabdd0b0fb13d5d748daf1173f392aa27eb9943eef78bd29e6a8fa61007a6e
SHA512ba60d28195b8ce60fd6f4cd57919a190c910af3e71e2858ed266a958314798ed51323d3c870c572d2fb873aae34387afa0dd8c7624e5f5cf51e586aafb76efcf