Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
05/08/2023, 20:20
Static task
static1
Behavioral task
behavioral1
Sample
79d86b272c2a98c7d4266d85f6df0184cf201921ae1bc94005926d63b604ae6cexe_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
79d86b272c2a98c7d4266d85f6df0184cf201921ae1bc94005926d63b604ae6cexe_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
79d86b272c2a98c7d4266d85f6df0184cf201921ae1bc94005926d63b604ae6cexe_JC.exe
-
Size
559KB
-
MD5
547982741d54b65e813f3c41700f1ce0
-
SHA1
28613a9e0cc8e9d727a4a576b044c208d6f9452b
-
SHA256
79d86b272c2a98c7d4266d85f6df0184cf201921ae1bc94005926d63b604ae6c
-
SHA512
ab8786ec47349f5dad0146633a9e626e09593dd6ffbf0cbc8129a965d3b1c22099af936d1c3dd8a325bb4c192e70885f12c7993502129c0c9bdae326721179fd
-
SSDEEP
12288:EMryy9038y4wtvqYUTIiifyKPsijjBw0Y7:myk8y4OmTIiify8s4jBwj7
Malware Config
Extracted
amadey
3.87
193.233.255.9/nasa/index.php
Extracted
redline
maxik
77.91.124.156:19071
-
auth_value
a7714e1bc167c67e3fc8f9e368352269
Signatures
-
Detects Healer an antivirus disabler dropper 4 IoCs
resource yara_rule behavioral1/files/0x0008000000016060-78.dat healer behavioral1/files/0x0008000000016060-80.dat healer behavioral1/files/0x0008000000016060-81.dat healer behavioral1/memory/2252-82-0x00000000011E0000-0x00000000011EA000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" p9717853.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection p9717853.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" p9717853.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" p9717853.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" p9717853.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" p9717853.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Downloads MZ/PE file
-
Executes dropped EXE 10 IoCs
pid Process 2528 z5523519.exe 2972 z1210951.exe 2252 p9717853.exe 2864 r3157420.exe 1768 legosa.exe 2736 s1927839.exe 2284 effortdiscussionpro.exe 1160 effortdiscussion.exe 2332 legosa.exe 396 legosa.exe -
Loads dropped DLL 19 IoCs
pid Process 2892 79d86b272c2a98c7d4266d85f6df0184cf201921ae1bc94005926d63b604ae6cexe_JC.exe 2528 z5523519.exe 2528 z5523519.exe 2972 z1210951.exe 2972 z1210951.exe 2972 z1210951.exe 2864 r3157420.exe 2864 r3157420.exe 1768 legosa.exe 2528 z5523519.exe 2736 s1927839.exe 1768 legosa.exe 2284 effortdiscussionpro.exe 2284 effortdiscussionpro.exe 1160 effortdiscussion.exe 532 rundll32.exe 532 rundll32.exe 532 rundll32.exe 532 rundll32.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features p9717853.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" p9717853.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 79d86b272c2a98c7d4266d85f6df0184cf201921ae1bc94005926d63b604ae6cexe_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z5523519.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z1210951.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" effortdiscussionpro.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2436 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2252 p9717853.exe 2252 p9717853.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2252 p9717853.exe Token: SeDebugPrivilege 1160 effortdiscussion.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2892 wrote to memory of 2528 2892 79d86b272c2a98c7d4266d85f6df0184cf201921ae1bc94005926d63b604ae6cexe_JC.exe 28 PID 2892 wrote to memory of 2528 2892 79d86b272c2a98c7d4266d85f6df0184cf201921ae1bc94005926d63b604ae6cexe_JC.exe 28 PID 2892 wrote to memory of 2528 2892 79d86b272c2a98c7d4266d85f6df0184cf201921ae1bc94005926d63b604ae6cexe_JC.exe 28 PID 2892 wrote to memory of 2528 2892 79d86b272c2a98c7d4266d85f6df0184cf201921ae1bc94005926d63b604ae6cexe_JC.exe 28 PID 2892 wrote to memory of 2528 2892 79d86b272c2a98c7d4266d85f6df0184cf201921ae1bc94005926d63b604ae6cexe_JC.exe 28 PID 2892 wrote to memory of 2528 2892 79d86b272c2a98c7d4266d85f6df0184cf201921ae1bc94005926d63b604ae6cexe_JC.exe 28 PID 2892 wrote to memory of 2528 2892 79d86b272c2a98c7d4266d85f6df0184cf201921ae1bc94005926d63b604ae6cexe_JC.exe 28 PID 2528 wrote to memory of 2972 2528 z5523519.exe 29 PID 2528 wrote to memory of 2972 2528 z5523519.exe 29 PID 2528 wrote to memory of 2972 2528 z5523519.exe 29 PID 2528 wrote to memory of 2972 2528 z5523519.exe 29 PID 2528 wrote to memory of 2972 2528 z5523519.exe 29 PID 2528 wrote to memory of 2972 2528 z5523519.exe 29 PID 2528 wrote to memory of 2972 2528 z5523519.exe 29 PID 2972 wrote to memory of 2252 2972 z1210951.exe 30 PID 2972 wrote to memory of 2252 2972 z1210951.exe 30 PID 2972 wrote to memory of 2252 2972 z1210951.exe 30 PID 2972 wrote to memory of 2252 2972 z1210951.exe 30 PID 2972 wrote to memory of 2252 2972 z1210951.exe 30 PID 2972 wrote to memory of 2252 2972 z1210951.exe 30 PID 2972 wrote to memory of 2252 2972 z1210951.exe 30 PID 2972 wrote to memory of 2864 2972 z1210951.exe 31 PID 2972 wrote to memory of 2864 2972 z1210951.exe 31 PID 2972 wrote to memory of 2864 2972 z1210951.exe 31 PID 2972 wrote to memory of 2864 2972 z1210951.exe 31 PID 2972 wrote to memory of 2864 2972 z1210951.exe 31 PID 2972 wrote to memory of 2864 2972 z1210951.exe 31 PID 2972 wrote to memory of 2864 2972 z1210951.exe 31 PID 2864 wrote to memory of 1768 2864 r3157420.exe 32 PID 2864 wrote to memory of 1768 2864 r3157420.exe 32 PID 2864 wrote to memory of 1768 2864 r3157420.exe 32 PID 2864 wrote to memory of 1768 2864 r3157420.exe 32 PID 2864 wrote to memory of 1768 2864 r3157420.exe 32 PID 2864 wrote to memory of 1768 2864 r3157420.exe 32 PID 2864 wrote to memory of 1768 2864 r3157420.exe 32 PID 2528 wrote to memory of 2736 2528 z5523519.exe 33 PID 2528 wrote to memory of 2736 2528 z5523519.exe 33 PID 2528 wrote to memory of 2736 2528 z5523519.exe 33 PID 2528 wrote to memory of 2736 2528 z5523519.exe 33 PID 2528 wrote to memory of 2736 2528 z5523519.exe 33 PID 2528 wrote to memory of 2736 2528 z5523519.exe 33 PID 2528 wrote to memory of 2736 2528 z5523519.exe 33 PID 1768 wrote to memory of 2436 1768 legosa.exe 34 PID 1768 wrote to memory of 2436 1768 legosa.exe 34 PID 1768 wrote to memory of 2436 1768 legosa.exe 34 PID 1768 wrote to memory of 2436 1768 legosa.exe 34 PID 1768 wrote to memory of 2436 1768 legosa.exe 34 PID 1768 wrote to memory of 2436 1768 legosa.exe 34 PID 1768 wrote to memory of 2436 1768 legosa.exe 34 PID 1768 wrote to memory of 1900 1768 legosa.exe 36 PID 1768 wrote to memory of 1900 1768 legosa.exe 36 PID 1768 wrote to memory of 1900 1768 legosa.exe 36 PID 1768 wrote to memory of 1900 1768 legosa.exe 36 PID 1768 wrote to memory of 1900 1768 legosa.exe 36 PID 1768 wrote to memory of 1900 1768 legosa.exe 36 PID 1768 wrote to memory of 1900 1768 legosa.exe 36 PID 1900 wrote to memory of 472 1900 cmd.exe 38 PID 1900 wrote to memory of 472 1900 cmd.exe 38 PID 1900 wrote to memory of 472 1900 cmd.exe 38 PID 1900 wrote to memory of 472 1900 cmd.exe 38 PID 1900 wrote to memory of 472 1900 cmd.exe 38 PID 1900 wrote to memory of 472 1900 cmd.exe 38 PID 1900 wrote to memory of 472 1900 cmd.exe 38 PID 1900 wrote to memory of 972 1900 cmd.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\79d86b272c2a98c7d4266d85f6df0184cf201921ae1bc94005926d63b604ae6cexe_JC.exe"C:\Users\Admin\AppData\Local\Temp\79d86b272c2a98c7d4266d85f6df0184cf201921ae1bc94005926d63b604ae6cexe_JC.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5523519.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5523519.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1210951.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1210951.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p9717853.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p9717853.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2252
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r3157420.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r3157420.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe"C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legosa.exe /TR "C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe" /F6⤵
- Creates scheduled task(s)
PID:2436
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legosa.exe" /P "Admin:N"&&CACLS "legosa.exe" /P "Admin:R" /E&&echo Y|CACLS "..\ebb444342c" /P "Admin:N"&&CACLS "..\ebb444342c" /P "Admin:R" /E&&Exit6⤵
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:472
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "legosa.exe" /P "Admin:N"7⤵PID:972
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "legosa.exe" /P "Admin:R" /E7⤵PID:1496
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:2396
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\ebb444342c" /P "Admin:N"7⤵PID:1952
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\ebb444342c" /P "Admin:R" /E7⤵PID:3060
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000022001\effortdiscussionpro.exe"C:\Users\Admin\AppData\Local\Temp\1000022001\effortdiscussionpro.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\effortdiscussion.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\effortdiscussion.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1160
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main6⤵
- Loads dropped DLL
PID:532
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s1927839.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s1927839.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2736
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {A511BAEA-3235-44FA-B195-F1107BDAF17E} S-1-5-21-3408354897-1169622894-3874090110-1000:WGWIREOE\Admin:Interactive:[1]1⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exeC:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe2⤵
- Executes dropped EXE
PID:2332
-
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exeC:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe2⤵
- Executes dropped EXE
PID:396
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
607KB
MD583d43f888f585443d52487a696e6de4c
SHA12ed66bf5c8b1dab4bdde95ea412f2b9fb663a243
SHA256ee80038271164361a38cc49e3b1c1ee446eda1c80181ffe161307d414c55fcdf
SHA5122f931fcba55e1a0a4ba8cdca9c70a62caa1f47a3c09d30dc14dbb39d6e148a493813f5adb75d7e7939b6c1056c96f489e14e4258fe83266884302f38ef9fcb01
-
Filesize
607KB
MD583d43f888f585443d52487a696e6de4c
SHA12ed66bf5c8b1dab4bdde95ea412f2b9fb663a243
SHA256ee80038271164361a38cc49e3b1c1ee446eda1c80181ffe161307d414c55fcdf
SHA5122f931fcba55e1a0a4ba8cdca9c70a62caa1f47a3c09d30dc14dbb39d6e148a493813f5adb75d7e7939b6c1056c96f489e14e4258fe83266884302f38ef9fcb01
-
Filesize
607KB
MD583d43f888f585443d52487a696e6de4c
SHA12ed66bf5c8b1dab4bdde95ea412f2b9fb663a243
SHA256ee80038271164361a38cc49e3b1c1ee446eda1c80181ffe161307d414c55fcdf
SHA5122f931fcba55e1a0a4ba8cdca9c70a62caa1f47a3c09d30dc14dbb39d6e148a493813f5adb75d7e7939b6c1056c96f489e14e4258fe83266884302f38ef9fcb01
-
Filesize
433KB
MD58af84ef8ba764762331fd5c5c1b6c546
SHA12ebc5b1ef1d96983dafb7eace68bc18aa9c9dbb5
SHA2564641e5e15e4ea9b79824f92fc5f0e15f7a8c58aff54075d71b2c6590d7c7657e
SHA512733ffc47d00cefea94819c29ccba879b85462a633570986bdb0228177685f9d1dc4620b9682be694778ec85281a83240eccc5f17e5a27f37d5e7abfba62301bc
-
Filesize
433KB
MD58af84ef8ba764762331fd5c5c1b6c546
SHA12ebc5b1ef1d96983dafb7eace68bc18aa9c9dbb5
SHA2564641e5e15e4ea9b79824f92fc5f0e15f7a8c58aff54075d71b2c6590d7c7657e
SHA512733ffc47d00cefea94819c29ccba879b85462a633570986bdb0228177685f9d1dc4620b9682be694778ec85281a83240eccc5f17e5a27f37d5e7abfba62301bc
-
Filesize
176KB
MD5e2c53106ad8ca3095424e9614aaaa1d7
SHA1310df27e36490ca54c6a660efea2f70eccd4f046
SHA256fd0a50f16de22de4ef00938e643ea781dd8d4c1eef61d4487183bc1655239523
SHA51244513740186ebe75dad8b924a14047ded8958a2573020d1160bc2bad367fc89e787a13d08f51b65374093f44782d86d65da35101002ca80459f88982e2645c9c
-
Filesize
176KB
MD5e2c53106ad8ca3095424e9614aaaa1d7
SHA1310df27e36490ca54c6a660efea2f70eccd4f046
SHA256fd0a50f16de22de4ef00938e643ea781dd8d4c1eef61d4487183bc1655239523
SHA51244513740186ebe75dad8b924a14047ded8958a2573020d1160bc2bad367fc89e787a13d08f51b65374093f44782d86d65da35101002ca80459f88982e2645c9c
-
Filesize
277KB
MD5c841fb593c037fb55c1fb128b1bd4753
SHA1bfe7db9ea8c2bf3bf2e6d646e8681351b7f2c585
SHA2561f94e5537d6af62f70747e10cb8f6171b5abcc87792b0ada814358015c476a2f
SHA51262a9b305f55dbd875ae49f0802c4f8398cc4a7d24060029ba642570ef2aa2365d922dad17221343b005aeb884c625f1dd5dba2688bce9175af72c531636cde1e
-
Filesize
277KB
MD5c841fb593c037fb55c1fb128b1bd4753
SHA1bfe7db9ea8c2bf3bf2e6d646e8681351b7f2c585
SHA2561f94e5537d6af62f70747e10cb8f6171b5abcc87792b0ada814358015c476a2f
SHA51262a9b305f55dbd875ae49f0802c4f8398cc4a7d24060029ba642570ef2aa2365d922dad17221343b005aeb884c625f1dd5dba2688bce9175af72c531636cde1e
-
Filesize
631KB
MD5a6cd3e45a9eb3f0c052c8c0e23e5d3d1
SHA15bebb38541f201160313f28797dc9f47fa013198
SHA256e33b429d00f53d6ae5fcccc2b288bc9f45bd36380e558eda9d85f34e1bd288c0
SHA512288a71b2876a9a4e5814a149100ec54b36f4c085612cb0e3172d5477939b376691920b04a883b90a20c824ba711ad7e403aed751ca0b8cae7b3d1b6c8abe058b
-
Filesize
631KB
MD5a6cd3e45a9eb3f0c052c8c0e23e5d3d1
SHA15bebb38541f201160313f28797dc9f47fa013198
SHA256e33b429d00f53d6ae5fcccc2b288bc9f45bd36380e558eda9d85f34e1bd288c0
SHA512288a71b2876a9a4e5814a149100ec54b36f4c085612cb0e3172d5477939b376691920b04a883b90a20c824ba711ad7e403aed751ca0b8cae7b3d1b6c8abe058b
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
89KB
MD543762ddccb9db44ea9914e448ba3e43e
SHA187e5766061740cf4a570133af6108399a11dbd1b
SHA256459b0a16d82e7150ad3fa2cbc740a2b6a33606894669f5febe5d15c20b4cc0ef
SHA512ea0ef8d32c3776baf2e1bd2456797d64ff8214810af41b3a59ee649ecd67e1fffeebe2f4b21c4e2671909a2d1ab8071d8eac261c4233662a686a575c1145d651
-
Filesize
89KB
MD543762ddccb9db44ea9914e448ba3e43e
SHA187e5766061740cf4a570133af6108399a11dbd1b
SHA256459b0a16d82e7150ad3fa2cbc740a2b6a33606894669f5febe5d15c20b4cc0ef
SHA512ea0ef8d32c3776baf2e1bd2456797d64ff8214810af41b3a59ee649ecd67e1fffeebe2f4b21c4e2671909a2d1ab8071d8eac261c4233662a686a575c1145d651
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
Filesize
607KB
MD583d43f888f585443d52487a696e6de4c
SHA12ed66bf5c8b1dab4bdde95ea412f2b9fb663a243
SHA256ee80038271164361a38cc49e3b1c1ee446eda1c80181ffe161307d414c55fcdf
SHA5122f931fcba55e1a0a4ba8cdca9c70a62caa1f47a3c09d30dc14dbb39d6e148a493813f5adb75d7e7939b6c1056c96f489e14e4258fe83266884302f38ef9fcb01
-
Filesize
607KB
MD583d43f888f585443d52487a696e6de4c
SHA12ed66bf5c8b1dab4bdde95ea412f2b9fb663a243
SHA256ee80038271164361a38cc49e3b1c1ee446eda1c80181ffe161307d414c55fcdf
SHA5122f931fcba55e1a0a4ba8cdca9c70a62caa1f47a3c09d30dc14dbb39d6e148a493813f5adb75d7e7939b6c1056c96f489e14e4258fe83266884302f38ef9fcb01
-
Filesize
433KB
MD58af84ef8ba764762331fd5c5c1b6c546
SHA12ebc5b1ef1d96983dafb7eace68bc18aa9c9dbb5
SHA2564641e5e15e4ea9b79824f92fc5f0e15f7a8c58aff54075d71b2c6590d7c7657e
SHA512733ffc47d00cefea94819c29ccba879b85462a633570986bdb0228177685f9d1dc4620b9682be694778ec85281a83240eccc5f17e5a27f37d5e7abfba62301bc
-
Filesize
433KB
MD58af84ef8ba764762331fd5c5c1b6c546
SHA12ebc5b1ef1d96983dafb7eace68bc18aa9c9dbb5
SHA2564641e5e15e4ea9b79824f92fc5f0e15f7a8c58aff54075d71b2c6590d7c7657e
SHA512733ffc47d00cefea94819c29ccba879b85462a633570986bdb0228177685f9d1dc4620b9682be694778ec85281a83240eccc5f17e5a27f37d5e7abfba62301bc
-
Filesize
176KB
MD5e2c53106ad8ca3095424e9614aaaa1d7
SHA1310df27e36490ca54c6a660efea2f70eccd4f046
SHA256fd0a50f16de22de4ef00938e643ea781dd8d4c1eef61d4487183bc1655239523
SHA51244513740186ebe75dad8b924a14047ded8958a2573020d1160bc2bad367fc89e787a13d08f51b65374093f44782d86d65da35101002ca80459f88982e2645c9c
-
Filesize
176KB
MD5e2c53106ad8ca3095424e9614aaaa1d7
SHA1310df27e36490ca54c6a660efea2f70eccd4f046
SHA256fd0a50f16de22de4ef00938e643ea781dd8d4c1eef61d4487183bc1655239523
SHA51244513740186ebe75dad8b924a14047ded8958a2573020d1160bc2bad367fc89e787a13d08f51b65374093f44782d86d65da35101002ca80459f88982e2645c9c
-
Filesize
277KB
MD5c841fb593c037fb55c1fb128b1bd4753
SHA1bfe7db9ea8c2bf3bf2e6d646e8681351b7f2c585
SHA2561f94e5537d6af62f70747e10cb8f6171b5abcc87792b0ada814358015c476a2f
SHA51262a9b305f55dbd875ae49f0802c4f8398cc4a7d24060029ba642570ef2aa2365d922dad17221343b005aeb884c625f1dd5dba2688bce9175af72c531636cde1e
-
Filesize
277KB
MD5c841fb593c037fb55c1fb128b1bd4753
SHA1bfe7db9ea8c2bf3bf2e6d646e8681351b7f2c585
SHA2561f94e5537d6af62f70747e10cb8f6171b5abcc87792b0ada814358015c476a2f
SHA51262a9b305f55dbd875ae49f0802c4f8398cc4a7d24060029ba642570ef2aa2365d922dad17221343b005aeb884c625f1dd5dba2688bce9175af72c531636cde1e
-
Filesize
631KB
MD5a6cd3e45a9eb3f0c052c8c0e23e5d3d1
SHA15bebb38541f201160313f28797dc9f47fa013198
SHA256e33b429d00f53d6ae5fcccc2b288bc9f45bd36380e558eda9d85f34e1bd288c0
SHA512288a71b2876a9a4e5814a149100ec54b36f4c085612cb0e3172d5477939b376691920b04a883b90a20c824ba711ad7e403aed751ca0b8cae7b3d1b6c8abe058b
-
Filesize
631KB
MD5a6cd3e45a9eb3f0c052c8c0e23e5d3d1
SHA15bebb38541f201160313f28797dc9f47fa013198
SHA256e33b429d00f53d6ae5fcccc2b288bc9f45bd36380e558eda9d85f34e1bd288c0
SHA512288a71b2876a9a4e5814a149100ec54b36f4c085612cb0e3172d5477939b376691920b04a883b90a20c824ba711ad7e403aed751ca0b8cae7b3d1b6c8abe058b
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
89KB
MD543762ddccb9db44ea9914e448ba3e43e
SHA187e5766061740cf4a570133af6108399a11dbd1b
SHA256459b0a16d82e7150ad3fa2cbc740a2b6a33606894669f5febe5d15c20b4cc0ef
SHA512ea0ef8d32c3776baf2e1bd2456797d64ff8214810af41b3a59ee649ecd67e1fffeebe2f4b21c4e2671909a2d1ab8071d8eac261c4233662a686a575c1145d651
-
Filesize
89KB
MD543762ddccb9db44ea9914e448ba3e43e
SHA187e5766061740cf4a570133af6108399a11dbd1b
SHA256459b0a16d82e7150ad3fa2cbc740a2b6a33606894669f5febe5d15c20b4cc0ef
SHA512ea0ef8d32c3776baf2e1bd2456797d64ff8214810af41b3a59ee649ecd67e1fffeebe2f4b21c4e2671909a2d1ab8071d8eac261c4233662a686a575c1145d651
-
Filesize
89KB
MD543762ddccb9db44ea9914e448ba3e43e
SHA187e5766061740cf4a570133af6108399a11dbd1b
SHA256459b0a16d82e7150ad3fa2cbc740a2b6a33606894669f5febe5d15c20b4cc0ef
SHA512ea0ef8d32c3776baf2e1bd2456797d64ff8214810af41b3a59ee649ecd67e1fffeebe2f4b21c4e2671909a2d1ab8071d8eac261c4233662a686a575c1145d651
-
Filesize
89KB
MD543762ddccb9db44ea9914e448ba3e43e
SHA187e5766061740cf4a570133af6108399a11dbd1b
SHA256459b0a16d82e7150ad3fa2cbc740a2b6a33606894669f5febe5d15c20b4cc0ef
SHA512ea0ef8d32c3776baf2e1bd2456797d64ff8214810af41b3a59ee649ecd67e1fffeebe2f4b21c4e2671909a2d1ab8071d8eac261c4233662a686a575c1145d651