Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
21/09/2023, 00:18
Static task
static1
Behavioral task
behavioral1
Sample
ac134aaa6addd0f9c720e06eff4c29af60cb8940b65a45e3a2f2c1c2f6f5471f.exe
Resource
win10v2004-20230915-en
General
-
Target
ac134aaa6addd0f9c720e06eff4c29af60cb8940b65a45e3a2f2c1c2f6f5471f.exe
-
Size
1.3MB
-
MD5
3ee943c5ff105ad2d869dda5f2a77210
-
SHA1
ca090d7fefaacbdd2b463ae7ae1073e03338c817
-
SHA256
ac134aaa6addd0f9c720e06eff4c29af60cb8940b65a45e3a2f2c1c2f6f5471f
-
SHA512
18397da3c393c8d836634b3355de72dcabd81deb000175597a03d9e30c9d39249e2cf527388e5e8166d0d351a37405161b95c20ee9ba3fbfff2dc95957a4d155
-
SSDEEP
24576:fyDDMMFFXzQ9fhmZMTNP1lgWoKmXC58avOr0qRcgifrTTyhcTfN8UjqXV:qDDMJ4M2WoKF5q0qRcgMTW2TfC7
Malware Config
Extracted
redline
trush
77.91.124.82:19071
-
auth_value
c13814867cde8193679cd0cad2d774be
Extracted
amadey
3.89
http://77.91.68.52/mac/index.php
http://77.91.68.78/help/index.php
-
install_dir
fefffe8cea
-
install_file
explonde.exe
-
strings_key
916aae73606d7a9e02a1d3b47c199688
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
resource yara_rule behavioral1/files/0x00080000000230ab-34.dat healer behavioral1/files/0x00080000000230ab-33.dat healer behavioral1/memory/1228-35-0x0000000000100000-0x000000000010A000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" q3033992.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" q3033992.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" q3033992.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" q3033992.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection q3033992.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" q3033992.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation t7644167.exe Key value queried \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation explonde.exe Key value queried \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation u8947107.exe Key value queried \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation legota.exe -
Executes dropped EXE 16 IoCs
pid Process 4208 z8881830.exe 1616 z4988357.exe 1184 z5838366.exe 2268 z8552603.exe 1228 q3033992.exe 3956 r6726391.exe 2840 s6031001.exe 2424 t7644167.exe 1172 explonde.exe 1192 u8947107.exe 504 legota.exe 1212 w6512684.exe 4704 explonde.exe 2384 legota.exe 416 explonde.exe 4120 legota.exe -
Loads dropped DLL 2 IoCs
pid Process 2484 rundll32.exe 3808 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" q3033992.exe -
Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" ac134aaa6addd0f9c720e06eff4c29af60cb8940b65a45e3a2f2c1c2f6f5471f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z8881830.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z4988357.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z5838366.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" z8552603.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3956 set thread context of 4500 3956 r6726391.exe 91 PID 2840 set thread context of 3856 2840 s6031001.exe 99 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
pid pid_target Process procid_target 3572 3956 WerFault.exe 89 2744 4500 WerFault.exe 91 2740 2840 WerFault.exe 97 -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4452 schtasks.exe 3272 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1228 q3033992.exe 1228 q3033992.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1228 q3033992.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4584 wrote to memory of 4208 4584 ac134aaa6addd0f9c720e06eff4c29af60cb8940b65a45e3a2f2c1c2f6f5471f.exe 84 PID 4584 wrote to memory of 4208 4584 ac134aaa6addd0f9c720e06eff4c29af60cb8940b65a45e3a2f2c1c2f6f5471f.exe 84 PID 4584 wrote to memory of 4208 4584 ac134aaa6addd0f9c720e06eff4c29af60cb8940b65a45e3a2f2c1c2f6f5471f.exe 84 PID 4208 wrote to memory of 1616 4208 z8881830.exe 85 PID 4208 wrote to memory of 1616 4208 z8881830.exe 85 PID 4208 wrote to memory of 1616 4208 z8881830.exe 85 PID 1616 wrote to memory of 1184 1616 z4988357.exe 86 PID 1616 wrote to memory of 1184 1616 z4988357.exe 86 PID 1616 wrote to memory of 1184 1616 z4988357.exe 86 PID 1184 wrote to memory of 2268 1184 z5838366.exe 87 PID 1184 wrote to memory of 2268 1184 z5838366.exe 87 PID 1184 wrote to memory of 2268 1184 z5838366.exe 87 PID 2268 wrote to memory of 1228 2268 z8552603.exe 88 PID 2268 wrote to memory of 1228 2268 z8552603.exe 88 PID 2268 wrote to memory of 3956 2268 z8552603.exe 89 PID 2268 wrote to memory of 3956 2268 z8552603.exe 89 PID 2268 wrote to memory of 3956 2268 z8552603.exe 89 PID 3956 wrote to memory of 4500 3956 r6726391.exe 91 PID 3956 wrote to memory of 4500 3956 r6726391.exe 91 PID 3956 wrote to memory of 4500 3956 r6726391.exe 91 PID 3956 wrote to memory of 4500 3956 r6726391.exe 91 PID 3956 wrote to memory of 4500 3956 r6726391.exe 91 PID 3956 wrote to memory of 4500 3956 r6726391.exe 91 PID 3956 wrote to memory of 4500 3956 r6726391.exe 91 PID 3956 wrote to memory of 4500 3956 r6726391.exe 91 PID 3956 wrote to memory of 4500 3956 r6726391.exe 91 PID 3956 wrote to memory of 4500 3956 r6726391.exe 91 PID 1184 wrote to memory of 2840 1184 z5838366.exe 97 PID 1184 wrote to memory of 2840 1184 z5838366.exe 97 PID 1184 wrote to memory of 2840 1184 z5838366.exe 97 PID 2840 wrote to memory of 3856 2840 s6031001.exe 99 PID 2840 wrote to memory of 3856 2840 s6031001.exe 99 PID 2840 wrote to memory of 3856 2840 s6031001.exe 99 PID 2840 wrote to memory of 3856 2840 s6031001.exe 99 PID 2840 wrote to memory of 3856 2840 s6031001.exe 99 PID 2840 wrote to memory of 3856 2840 s6031001.exe 99 PID 2840 wrote to memory of 3856 2840 s6031001.exe 99 PID 2840 wrote to memory of 3856 2840 s6031001.exe 99 PID 1616 wrote to memory of 2424 1616 z4988357.exe 102 PID 1616 wrote to memory of 2424 1616 z4988357.exe 102 PID 1616 wrote to memory of 2424 1616 z4988357.exe 102 PID 2424 wrote to memory of 1172 2424 t7644167.exe 103 PID 2424 wrote to memory of 1172 2424 t7644167.exe 103 PID 2424 wrote to memory of 1172 2424 t7644167.exe 103 PID 4208 wrote to memory of 1192 4208 z8881830.exe 104 PID 4208 wrote to memory of 1192 4208 z8881830.exe 104 PID 4208 wrote to memory of 1192 4208 z8881830.exe 104 PID 1172 wrote to memory of 4452 1172 explonde.exe 105 PID 1172 wrote to memory of 4452 1172 explonde.exe 105 PID 1172 wrote to memory of 4452 1172 explonde.exe 105 PID 1192 wrote to memory of 504 1192 u8947107.exe 107 PID 1192 wrote to memory of 504 1192 u8947107.exe 107 PID 1192 wrote to memory of 504 1192 u8947107.exe 107 PID 1172 wrote to memory of 2292 1172 explonde.exe 108 PID 1172 wrote to memory of 2292 1172 explonde.exe 108 PID 1172 wrote to memory of 2292 1172 explonde.exe 108 PID 4584 wrote to memory of 1212 4584 ac134aaa6addd0f9c720e06eff4c29af60cb8940b65a45e3a2f2c1c2f6f5471f.exe 111 PID 4584 wrote to memory of 1212 4584 ac134aaa6addd0f9c720e06eff4c29af60cb8940b65a45e3a2f2c1c2f6f5471f.exe 111 PID 4584 wrote to memory of 1212 4584 ac134aaa6addd0f9c720e06eff4c29af60cb8940b65a45e3a2f2c1c2f6f5471f.exe 111 PID 2292 wrote to memory of 2104 2292 cmd.exe 112 PID 2292 wrote to memory of 2104 2292 cmd.exe 112 PID 2292 wrote to memory of 2104 2292 cmd.exe 112 PID 2292 wrote to memory of 4140 2292 cmd.exe 113 PID 2292 wrote to memory of 4140 2292 cmd.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac134aaa6addd0f9c720e06eff4c29af60cb8940b65a45e3a2f2c1c2f6f5471f.exe"C:\Users\Admin\AppData\Local\Temp\ac134aaa6addd0f9c720e06eff4c29af60cb8940b65a45e3a2f2c1c2f6f5471f.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8881830.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8881830.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4988357.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4988357.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z5838366.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z5838366.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8552603.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8552603.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3033992.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3033992.exe6⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1228
-
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6726391.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6726391.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵PID:4500
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4500 -s 5408⤵
- Program crash
PID:2744
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3956 -s 5567⤵
- Program crash
PID:3572
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s6031001.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s6031001.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵PID:3856
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 1366⤵
- Program crash
PID:2740
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t7644167.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t7644167.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explonde.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe" /F6⤵
- Creates scheduled task(s)
PID:4452
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explonde.exe" /P "Admin:N"&&CACLS "explonde.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit6⤵
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:2104
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "explonde.exe" /P "Admin:N"7⤵PID:4140
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "explonde.exe" /P "Admin:R" /E7⤵PID:3404
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:2912
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:N"7⤵PID:2464
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:R" /E7⤵PID:2208
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main6⤵
- Loads dropped DLL
PID:2484
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u8947107.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u8947107.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
PID:504 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F5⤵
- Creates scheduled task(s)
PID:3272
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit5⤵PID:1720
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:1368
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:N"6⤵PID:4116
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:R" /E6⤵PID:564
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:2264
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:N"6⤵PID:2400
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:R" /E6⤵PID:2724
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main5⤵
- Loads dropped DLL
PID:3808
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w6512684.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w6512684.exe2⤵
- Executes dropped EXE
PID:1212
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3956 -ip 39561⤵PID:556
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4500 -ip 45001⤵PID:4156
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2840 -ip 28401⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe1⤵
- Executes dropped EXE
PID:4704
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
PID:2384
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe1⤵
- Executes dropped EXE
PID:416
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
PID:4120
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17KB
MD512b6b50028d8211d67db032414cd0bcb
SHA1df4a8e587e474902c53f39e2d482e76f631b7de4
SHA256e0040b643b7b005523fe2927b6006458938e1652c6deb376e09a65f48d8b3bf1
SHA512fcdcbb44578b2f5b09eeb812e32371f64acd846d9e8f2917d54013ae3fd417ef382784870060b78a5d50f61b3e8ba0fe277f7425804b53898efc2da78960da78
-
Filesize
17KB
MD512b6b50028d8211d67db032414cd0bcb
SHA1df4a8e587e474902c53f39e2d482e76f631b7de4
SHA256e0040b643b7b005523fe2927b6006458938e1652c6deb376e09a65f48d8b3bf1
SHA512fcdcbb44578b2f5b09eeb812e32371f64acd846d9e8f2917d54013ae3fd417ef382784870060b78a5d50f61b3e8ba0fe277f7425804b53898efc2da78960da78
-
Filesize
1.2MB
MD5ed5e61f26e1f40ad0b98985f7e8b93c3
SHA1ad60a39016e49ac1493a9cc15e927a90c90c7b0c
SHA25689341252f68e30a87b04d069e8d0428294de459bb37f35adabc4ef93941f4945
SHA51284f4b1980b44a8f3aeeeec2756446a0b7aaccaf25e7529f94af4b4a9639ca3af2198898c119f73e89312b9b5dc598d372ac749b97bc63695b3a15d480b7eb049
-
Filesize
1.2MB
MD5ed5e61f26e1f40ad0b98985f7e8b93c3
SHA1ad60a39016e49ac1493a9cc15e927a90c90c7b0c
SHA25689341252f68e30a87b04d069e8d0428294de459bb37f35adabc4ef93941f4945
SHA51284f4b1980b44a8f3aeeeec2756446a0b7aaccaf25e7529f94af4b4a9639ca3af2198898c119f73e89312b9b5dc598d372ac749b97bc63695b3a15d480b7eb049
-
Filesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
Filesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
Filesize
1.0MB
MD5fb64bc5305433a73af7de8831fe51597
SHA1823e493c1335545c505ae71fdc33c22422a76515
SHA2560ed1827e35701c23997d7cf3ac486c7e77ef806afa62431f826ec51ae85ac88c
SHA51298bc538f99d76b02e339749d40399cd42a37fdd2825d1a2573b12bf5bde352e8b4899ae826decd5f94f4902657eaf2b225559a0dcaf2648259fcd2661f45a62f
-
Filesize
1.0MB
MD5fb64bc5305433a73af7de8831fe51597
SHA1823e493c1335545c505ae71fdc33c22422a76515
SHA2560ed1827e35701c23997d7cf3ac486c7e77ef806afa62431f826ec51ae85ac88c
SHA51298bc538f99d76b02e339749d40399cd42a37fdd2825d1a2573b12bf5bde352e8b4899ae826decd5f94f4902657eaf2b225559a0dcaf2648259fcd2661f45a62f
-
Filesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
Filesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
Filesize
866KB
MD5de9e081feefda6d65557e6bd7e2207b1
SHA183057ba56ccbc2e049580b2ff68b6ff2a44f0723
SHA256bc461864533d5fc54a3dac473703137c38e366e4b6d1c48ebc6be5f35be741c1
SHA51279393b4321c0007a6a474da577f6cc72ec25d6fe1dbe0722907b4f59cafef25907c90fd0b10b0e8068dccd04775549f7648d5f1d73872ead9a2bbdf79cdf3f39
-
Filesize
866KB
MD5de9e081feefda6d65557e6bd7e2207b1
SHA183057ba56ccbc2e049580b2ff68b6ff2a44f0723
SHA256bc461864533d5fc54a3dac473703137c38e366e4b6d1c48ebc6be5f35be741c1
SHA51279393b4321c0007a6a474da577f6cc72ec25d6fe1dbe0722907b4f59cafef25907c90fd0b10b0e8068dccd04775549f7648d5f1d73872ead9a2bbdf79cdf3f39
-
Filesize
1.0MB
MD5fdc8bf5bf1e80745ac054977cf4e13d3
SHA16bc9912460be5efd2147ecef1ff37889eb3bbea6
SHA256cea1073d7cddaed17782dc1a8e2ecfa933e1fa93c6a8378bc8221f434c543d58
SHA512be0cc534d64ee5416ebd6866d8769479bdf209c492c885672c14899e436ac3d9835c79bae6cfb8dcdf68fb417f6d0a988f36f44d6e3e8d5d2024008f484c1140
-
Filesize
1.0MB
MD5fdc8bf5bf1e80745ac054977cf4e13d3
SHA16bc9912460be5efd2147ecef1ff37889eb3bbea6
SHA256cea1073d7cddaed17782dc1a8e2ecfa933e1fa93c6a8378bc8221f434c543d58
SHA512be0cc534d64ee5416ebd6866d8769479bdf209c492c885672c14899e436ac3d9835c79bae6cfb8dcdf68fb417f6d0a988f36f44d6e3e8d5d2024008f484c1140
-
Filesize
475KB
MD53abb863cb2986ffd4cd4a87c262a16da
SHA1b56b50ea30be56a3656a5fe53512e804176401d6
SHA256cedd54d5c9c78f8b62581ade674a883b9ab4ef0597994f009f3224fc2a8b75b1
SHA512a36b0da7a93dbe0486971d6b605eeb7ead3016e9abd3c24f0a394442cd5dc219e4e79334d593aa4a1bca99c3896cc6d51ddd6ad7eecaff0d37414465ad4ac014
-
Filesize
475KB
MD53abb863cb2986ffd4cd4a87c262a16da
SHA1b56b50ea30be56a3656a5fe53512e804176401d6
SHA256cedd54d5c9c78f8b62581ade674a883b9ab4ef0597994f009f3224fc2a8b75b1
SHA512a36b0da7a93dbe0486971d6b605eeb7ead3016e9abd3c24f0a394442cd5dc219e4e79334d593aa4a1bca99c3896cc6d51ddd6ad7eecaff0d37414465ad4ac014
-
Filesize
11KB
MD57d930396c8d87bb9703b2ca5dcc2da62
SHA145b1940793cee3c012e3038aafaf0329f936ac1e
SHA256188f8b58b951ae8c96948e944327316a81715da76b33dce088e43dc4fefc84bf
SHA5122e037c90090caea442c5069e80705cae2d0f4c1ae469e7d91475cf9a01876cd9e6dc74953a7f79fd3e2cf40375bbd1c3124b0ae2e85f70aff2486f52e5bb527f
-
Filesize
11KB
MD57d930396c8d87bb9703b2ca5dcc2da62
SHA145b1940793cee3c012e3038aafaf0329f936ac1e
SHA256188f8b58b951ae8c96948e944327316a81715da76b33dce088e43dc4fefc84bf
SHA5122e037c90090caea442c5069e80705cae2d0f4c1ae469e7d91475cf9a01876cd9e6dc74953a7f79fd3e2cf40375bbd1c3124b0ae2e85f70aff2486f52e5bb527f
-
Filesize
1.0MB
MD5b80a6141e213eb59426033330c320b5f
SHA132797740df35e679271431e76a21bb1cdcbe26f6
SHA2567234147251998443d0d869a305c8d1e2193970f1687be6a3c56fbf9bdc477dfa
SHA512a1d2a1ae4e4dfe043b091d0aa8e5efc498585246c67b1c71e0a1b5cf905d46bd86df40fec629810a3a328f78132b4b27c3895a70c2fd7eb8ad2d4ab5daddb3fc
-
Filesize
1.0MB
MD5b80a6141e213eb59426033330c320b5f
SHA132797740df35e679271431e76a21bb1cdcbe26f6
SHA2567234147251998443d0d869a305c8d1e2193970f1687be6a3c56fbf9bdc477dfa
SHA512a1d2a1ae4e4dfe043b091d0aa8e5efc498585246c67b1c71e0a1b5cf905d46bd86df40fec629810a3a328f78132b4b27c3895a70c2fd7eb8ad2d4ab5daddb3fc
-
Filesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
Filesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
Filesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
Filesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
Filesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
Filesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
Filesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
Filesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
Filesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
Filesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
Filesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
Filesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
Filesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
Filesize
273B
MD50c459e65bcc6d38574f0c0d63a87088a
SHA141e53d5f2b3e7ca859b842a1c7b677e0847e6d65
SHA256871c61d5f7051d6ddcf787e92e92d9c7e36747e64ea17b8cffccac549196abc4
SHA512be1ca1fa525dfea57bc14ba41d25fb904c8e4c1d5cb4a5981d3173143620fb8e08277c0dfc2287b792e365871cc6805034377060a84cfef81969cd3d3ba8f90d
-
Filesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
Filesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
Filesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
Filesize
273B
MD56d5040418450624fef735b49ec6bffe9
SHA15fff6a1a620a5c4522aead8dbd0a5a52570e8773
SHA256dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3
SHA512bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0