Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
23s -
max time network
88s -
platform
windows10-2004_x64 -
resource
win10v2004-20231025-en -
resource tags
arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system -
submitted
31/10/2023, 12:08
Static task
static1
Behavioral task
behavioral1
Sample
24399faba0dd69e177f5e340774c34ddec6cb8a9d4a13926cddeaceaa76eaa1d.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
24399faba0dd69e177f5e340774c34ddec6cb8a9d4a13926cddeaceaa76eaa1d.exe
Resource
win10v2004-20231025-en
General
-
Target
24399faba0dd69e177f5e340774c34ddec6cb8a9d4a13926cddeaceaa76eaa1d.exe
-
Size
896KB
-
MD5
38ae2593e76e7486fa01d8df8a9451cd
-
SHA1
c2ffdf1dee5519eeb90f4937fa700b087d65a63f
-
SHA256
24399faba0dd69e177f5e340774c34ddec6cb8a9d4a13926cddeaceaa76eaa1d
-
SHA512
3a63f544fbdc67d47ff82ac2a588858a37e167c2e244af56acc88abb21bae55468861bc123db29070249269d9a07642ba562c9452f3a5a0ae9ccff825000858b
-
SSDEEP
12288:LOsSmtwUJo7a0d0Fry0+8/GSEYIZHcJfxWqg1u+CHOqZsq:LO7mtwUJo7a0dAP5/GxZ8qr
Malware Config
Extracted
smokeloader
2022
http://77.91.68.29/fks/
Extracted
redline
grome
77.91.124.86:19084
Extracted
amadey
3.89
http://77.91.124.1/theme/index.php
-
install_dir
fefffe8cea
-
install_file
explothe.exe
-
strings_key
36a96139c1118a354edf72b1080d4b2f
Extracted
redline
kinza
77.91.124.86:19084
Extracted
redline
pixelnew
194.49.94.11:80
Extracted
smokeloader
up3
Extracted
smokeloader
2020
http://host-file-host6.com/
http://host-host-file8.com/
Signatures
-
Detect ZGRat V1 3 IoCs
resource yara_rule behavioral2/files/0x0007000000022e39-241.dat family_zgrat_v1 behavioral2/files/0x0007000000022e39-242.dat family_zgrat_v1 behavioral2/memory/5988-243-0x0000000000600000-0x00000000009E0000-memory.dmp family_zgrat_v1 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 10 IoCs
resource yara_rule behavioral2/files/0x0007000000022e00-42.dat family_redline behavioral2/files/0x0007000000022e00-44.dat family_redline behavioral2/memory/5088-68-0x0000000000B80000-0x0000000000BBE000-memory.dmp family_redline behavioral2/memory/4392-111-0x0000000000720000-0x000000000075E000-memory.dmp family_redline behavioral2/files/0x0006000000022e07-109.dat family_redline behavioral2/memory/1552-112-0x0000000000480000-0x00000000004DA000-memory.dmp family_redline behavioral2/files/0x0006000000022e07-108.dat family_redline behavioral2/memory/1552-154-0x0000000000400000-0x0000000000480000-memory.dmp family_redline behavioral2/files/0x0007000000022e56-315.dat family_redline behavioral2/memory/5684-345-0x0000000000410000-0x000000000042E000-memory.dmp family_redline -
SectopRAT payload 2 IoCs
resource yara_rule behavioral2/files/0x0007000000022e56-315.dat family_sectoprat behavioral2/memory/5684-345-0x0000000000410000-0x000000000042E000-memory.dmp family_sectoprat -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
pid Process 4348 BBED.exe 4928 BCAA.exe 4724 jM8cF0QO.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" BBED.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 130 api.ipify.org 129 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4440 set thread context of 4224 4440 24399faba0dd69e177f5e340774c34ddec6cb8a9d4a13926cddeaceaa76eaa1d.exe 88 -
Program crash 2 IoCs
pid pid_target Process procid_target 2956 3752 WerFault.exe 112 4448 1552 WerFault.exe 105 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4636 schtasks.exe 6296 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4224 AppLaunch.exe 4224 AppLaunch.exe 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4224 AppLaunch.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 4440 wrote to memory of 4224 4440 24399faba0dd69e177f5e340774c34ddec6cb8a9d4a13926cddeaceaa76eaa1d.exe 88 PID 4440 wrote to memory of 4224 4440 24399faba0dd69e177f5e340774c34ddec6cb8a9d4a13926cddeaceaa76eaa1d.exe 88 PID 4440 wrote to memory of 4224 4440 24399faba0dd69e177f5e340774c34ddec6cb8a9d4a13926cddeaceaa76eaa1d.exe 88 PID 4440 wrote to memory of 4224 4440 24399faba0dd69e177f5e340774c34ddec6cb8a9d4a13926cddeaceaa76eaa1d.exe 88 PID 4440 wrote to memory of 4224 4440 24399faba0dd69e177f5e340774c34ddec6cb8a9d4a13926cddeaceaa76eaa1d.exe 88 PID 4440 wrote to memory of 4224 4440 24399faba0dd69e177f5e340774c34ddec6cb8a9d4a13926cddeaceaa76eaa1d.exe 88 PID 3304 wrote to memory of 4348 3304 Process not Found 91 PID 3304 wrote to memory of 4348 3304 Process not Found 91 PID 3304 wrote to memory of 4348 3304 Process not Found 91 PID 3304 wrote to memory of 4928 3304 Process not Found 92 PID 3304 wrote to memory of 4928 3304 Process not Found 92 PID 3304 wrote to memory of 4928 3304 Process not Found 92 PID 4348 wrote to memory of 4724 4348 BBED.exe 93 PID 4348 wrote to memory of 4724 4348 BBED.exe 93 PID 4348 wrote to memory of 4724 4348 BBED.exe 93 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\24399faba0dd69e177f5e340774c34ddec6cb8a9d4a13926cddeaceaa76eaa1d.exe"C:\Users\Admin\AppData\Local\Temp\24399faba0dd69e177f5e340774c34ddec6cb8a9d4a13926cddeaceaa76eaa1d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4224
-
-
C:\Users\Admin\AppData\Local\Temp\BBED.exeC:\Users\Admin\AppData\Local\Temp\BBED.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jM8cF0QO.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jM8cF0QO.exe2⤵
- Executes dropped EXE
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\YE7Np1Mg.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\YE7Np1Mg.exe3⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cj1QV2TK.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cj1QV2TK.exe4⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\NM8Ud4XG.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\NM8Ud4XG.exe5⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Xn92su8.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Xn92su8.exe6⤵PID:1832
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵PID:3752
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3752 -s 5408⤵
- Program crash
PID:2956
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2Na583BY.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2Na583BY.exe6⤵PID:4392
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\BCAA.exeC:\Users\Admin\AppData\Local\Temp\BCAA.exe1⤵
- Executes dropped EXE
PID:4928
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BE41.bat" "1⤵PID:812
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login2⤵PID:2840
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fff1ae846f8,0x7fff1ae84708,0x7fff1ae847183⤵PID:4984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,4149724948789388470,7555935875417173840,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:33⤵PID:1080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,4149724948789388470,7555935875417173840,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2976 /prefetch:83⤵PID:4140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,4149724948789388470,7555935875417173840,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:23⤵PID:4476
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4149724948789388470,7555935875417173840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:13⤵PID:2112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4149724948789388470,7555935875417173840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:13⤵PID:5116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4149724948789388470,7555935875417173840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4524 /prefetch:13⤵PID:2892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4149724948789388470,7555935875417173840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:13⤵PID:3712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4149724948789388470,7555935875417173840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:13⤵PID:1864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4149724948789388470,7555935875417173840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:13⤵PID:5332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4149724948789388470,7555935875417173840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:13⤵PID:5508
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4149724948789388470,7555935875417173840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:13⤵PID:5752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4149724948789388470,7555935875417173840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:13⤵PID:6072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4149724948789388470,7555935875417173840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6464 /prefetch:13⤵PID:4168
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4149724948789388470,7555935875417173840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6668 /prefetch:13⤵PID:6280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4149724948789388470,7555935875417173840,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6728 /prefetch:13⤵PID:848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4149724948789388470,7555935875417173840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6708 /prefetch:13⤵PID:4576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4149724948789388470,7555935875417173840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7720 /prefetch:13⤵PID:6408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4149724948789388470,7555935875417173840,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7732 /prefetch:13⤵PID:6576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4149724948789388470,7555935875417173840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7888 /prefetch:13⤵PID:6568
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/2⤵PID:4396
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff1ae846f8,0x7fff1ae84708,0x7fff1ae847183⤵PID:5084
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/login/2⤵PID:4300
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff1ae846f8,0x7fff1ae84708,0x7fff1ae847183⤵PID:3932
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/openid/loginform/2⤵PID:5340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/i/flow/login2⤵PID:5220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/login2⤵PID:4632
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff1ae846f8,0x7fff1ae84708,0x7fff1ae847183⤵PID:5152
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/signin2⤵PID:5984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/2⤵PID:6172
-
-
C:\Users\Admin\AppData\Local\Temp\BF2C.exeC:\Users\Admin\AppData\Local\Temp\BF2C.exe1⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\BFF8.exeC:\Users\Admin\AppData\Local\Temp\BFF8.exe1⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\C132.exeC:\Users\Admin\AppData\Local\Temp\C132.exe1⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"2⤵PID:4424
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F3⤵
- Creates scheduled task(s)
PID:4636
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit3⤵PID:3836
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵PID:216
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:N"4⤵PID:4292
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:R" /E4⤵PID:5284
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵PID:5712
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:N"4⤵PID:5944
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:R" /E4⤵PID:5944
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\C51B.exeC:\Users\Admin\AppData\Local\Temp\C51B.exe1⤵PID:1552
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1552 -s 7842⤵
- Program crash
PID:4448
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3752 -ip 37521⤵PID:2044
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1552 -ip 15521⤵PID:4224
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\DE03.exeC:\Users\Admin\AppData\Local\Temp\DE03.exe1⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"2⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"3⤵PID:5484
-
-
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"2⤵PID:5304
-
-
C:\Users\Admin\AppData\Local\Temp\kos4.exe"C:\Users\Admin\AppData\Local\Temp\kos4.exe"2⤵PID:5612
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"3⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\is-CQSM8.tmp\LzmwAqmV.tmp"C:\Users\Admin\AppData\Local\Temp\is-CQSM8.tmp\LzmwAqmV.tmp" /SL5="$3024C,2998240,68096,C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"4⤵PID:5912
-
C:\Program Files (x86)\LAudioConverter\LAudioConverter.exe"C:\Program Files (x86)\LAudioConverter\LAudioConverter.exe" -i5⤵PID:5828
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Delete /F /TN "LAC1031-1"5⤵PID:5156
-
-
C:\Program Files (x86)\LAudioConverter\LAudioConverter.exe"C:\Program Files (x86)\LAudioConverter\LAudioConverter.exe" -s5⤵PID:5744
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\latestX.exe"C:\Users\Admin\AppData\Local\Temp\latestX.exe"2⤵PID:5760
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\E17F.exeC:\Users\Admin\AppData\Local\Temp\E17F.exe1⤵PID:5112
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff1ae846f8,0x7fff1ae84708,0x7fff1ae847181⤵PID:5244
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff1ae846f8,0x7fff1ae84708,0x7fff1ae847181⤵PID:5356
-
C:\Users\Admin\AppData\Local\Temp\F297.exeC:\Users\Admin\AppData\Local\Temp\F297.exe1⤵PID:5988
-
C:\Users\Admin\AppData\Local\Temp\FF0C.exeC:\Users\Admin\AppData\Local\Temp\FF0C.exe1⤵PID:5684
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff1ae846f8,0x7fff1ae84708,0x7fff1ae847181⤵PID:5652
-
C:\Users\Admin\AppData\Local\Temp\4F9.exeC:\Users\Admin\AppData\Local\Temp\4F9.exe1⤵PID:6096
-
C:\Users\Admin\AppData\Local\Temp\ea7c8244c8\Utsysc.exe"C:\Users\Admin\AppData\Local\Temp\ea7c8244c8\Utsysc.exe"2⤵PID:3836
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\Admin\AppData\Local\Temp\ea7c8244c8\Utsysc.exe" /F3⤵
- Creates scheduled task(s)
PID:6296
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "Utsysc.exe" /P "Admin:N"&&CACLS "Utsysc.exe" /P "Admin:R" /E&&echo Y|CACLS "..\ea7c8244c8" /P "Admin:N"&&CACLS "..\ea7c8244c8" /P "Admin:R" /E&&Exit3⤵PID:6384
-
-
-
C:\Users\Admin\AppData\Local\Temp\F96E.exeC:\Users\Admin\AppData\Local\Temp\F96E.exe1⤵PID:5216
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff1ae846f8,0x7fff1ae84708,0x7fff1ae847181⤵PID:6188
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5aed593b08b94f34dd8f68fd369652ac2
SHA13ce2a17e426e09c2fd9a8d2ab191fe29248f2d95
SHA2565c0cdd5dc1bccf7e3ffa8568fdd2fe35f3edc85832f3d11331aced965aaeeba7
SHA51216b34c29d8ea3793f7d4491847d2fecae2c6c9d7b7b1ec16d1367828d0a4da4cdbf912c2040bc0ca98ac32cd701355ddd16b4865629d51bae2527e1a05411137
-
Filesize
152B
MD5aed593b08b94f34dd8f68fd369652ac2
SHA13ce2a17e426e09c2fd9a8d2ab191fe29248f2d95
SHA2565c0cdd5dc1bccf7e3ffa8568fdd2fe35f3edc85832f3d11331aced965aaeeba7
SHA51216b34c29d8ea3793f7d4491847d2fecae2c6c9d7b7b1ec16d1367828d0a4da4cdbf912c2040bc0ca98ac32cd701355ddd16b4865629d51bae2527e1a05411137
-
Filesize
152B
MD5aed593b08b94f34dd8f68fd369652ac2
SHA13ce2a17e426e09c2fd9a8d2ab191fe29248f2d95
SHA2565c0cdd5dc1bccf7e3ffa8568fdd2fe35f3edc85832f3d11331aced965aaeeba7
SHA51216b34c29d8ea3793f7d4491847d2fecae2c6c9d7b7b1ec16d1367828d0a4da4cdbf912c2040bc0ca98ac32cd701355ddd16b4865629d51bae2527e1a05411137
-
Filesize
152B
MD5aed593b08b94f34dd8f68fd369652ac2
SHA13ce2a17e426e09c2fd9a8d2ab191fe29248f2d95
SHA2565c0cdd5dc1bccf7e3ffa8568fdd2fe35f3edc85832f3d11331aced965aaeeba7
SHA51216b34c29d8ea3793f7d4491847d2fecae2c6c9d7b7b1ec16d1367828d0a4da4cdbf912c2040bc0ca98ac32cd701355ddd16b4865629d51bae2527e1a05411137
-
Filesize
152B
MD5aed593b08b94f34dd8f68fd369652ac2
SHA13ce2a17e426e09c2fd9a8d2ab191fe29248f2d95
SHA2565c0cdd5dc1bccf7e3ffa8568fdd2fe35f3edc85832f3d11331aced965aaeeba7
SHA51216b34c29d8ea3793f7d4491847d2fecae2c6c9d7b7b1ec16d1367828d0a4da4cdbf912c2040bc0ca98ac32cd701355ddd16b4865629d51bae2527e1a05411137
-
Filesize
152B
MD5aed593b08b94f34dd8f68fd369652ac2
SHA13ce2a17e426e09c2fd9a8d2ab191fe29248f2d95
SHA2565c0cdd5dc1bccf7e3ffa8568fdd2fe35f3edc85832f3d11331aced965aaeeba7
SHA51216b34c29d8ea3793f7d4491847d2fecae2c6c9d7b7b1ec16d1367828d0a4da4cdbf912c2040bc0ca98ac32cd701355ddd16b4865629d51bae2527e1a05411137
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
7KB
MD5046dd5fa2db6bdfece968a75702aa6b1
SHA1f29135778424199997cca1865b57ee9a62d0d370
SHA25635fde640ac796deca213e202a1b291b8981dfbdd88fe50bebd95d00c4c897bee
SHA51298410c6e31e41b9867743d3219d4c172d252ee75d25eeaf2689904a7cb735b633216de2d847b2ed057fbdf81d51947457f8b1af88d721be4c2a85108ad2c6241
-
Filesize
5KB
MD5c1cb56bbf51f65a23c1fcbe4cba3af46
SHA127b7969ab1f5f5c55765e3036b018cb60968e454
SHA256910698a2c169fa81334822a65be9ace44b0fac54ae67cac2704da13799945de6
SHA512e95b229c1968a6cec5f76a1bafbfd8d9d92e63d4008331e99d423df1513ce24b85ffe94ebef43483411a235e6f27794a8e9840ce965aecc1d15e9da5e18038f9
-
Filesize
24KB
MD5e2565e589c9c038c551766400aefc665
SHA177893bb0d295c2737e31a3f539572367c946ab27
SHA256172017da29bce2bfe0c8b4577a9b8e7a97a0585fd85697f51261f39b28877e80
SHA5125a33ce3d048f2443c5d1aee3922693decc19c4d172aff0b059b31af3b56aa5e413902f9a9634e5ee874b046ae63a0531985b0361467b62e977dcff7fc9913c4d
-
Filesize
10KB
MD5ebe164b1a85a8682b23d655f18c8b7cc
SHA1d1dd32fc5c0c07974117bbe44109b3a27732983d
SHA2564ce849ae0af80a48598e799e28e58a4cfb695e942b753b23e472e071506537a6
SHA51225fb9e47857ff2b195a614fe0bc8a2ce0a86f6d5cf695b921b35b84b862c56c1d9f0d5f80ef8b87fe4edbab70c2196a93ef23dcc6007b46fb90e40e9b272e6b4
-
Filesize
10KB
MD504e5769cce23e381e98718b6af4e8096
SHA17f9b352cd274470a501de2d550731bb896c66c98
SHA2567764fb794ec23a0c256914607edaba339ba7c767aa7336a84195909c0922d2f8
SHA51248609f10a1124a1960de7fb865e25a9e1632a407b44fb11d86885b38452492c2293df6fb40cdae0420f663fa73f77a30c8a4d1af367572ad0aca7aa432b81069
-
Filesize
4.1MB
MD589c82822be2e2bf37b5d80d575ef2ec8
SHA19fe2fad2faff04ad5e8d035b98676dedd5817eca
SHA2566fea30b9d17eacffde43b727058b5b2c422a7b70407534549042ba7b20d5f8c9
SHA512142ca76bc32cc60c11f640bd9e050df6000b6824a192595416f661d22d6e52704dfd369974d7f2f73d01eaa356237c50778737d72d5588c5a2ff8a8010ee8101
-
Filesize
4.1MB
MD589c82822be2e2bf37b5d80d575ef2ec8
SHA19fe2fad2faff04ad5e8d035b98676dedd5817eca
SHA2566fea30b9d17eacffde43b727058b5b2c422a7b70407534549042ba7b20d5f8c9
SHA512142ca76bc32cc60c11f640bd9e050df6000b6824a192595416f661d22d6e52704dfd369974d7f2f73d01eaa356237c50778737d72d5588c5a2ff8a8010ee8101
-
Filesize
4.1MB
MD589c82822be2e2bf37b5d80d575ef2ec8
SHA19fe2fad2faff04ad5e8d035b98676dedd5817eca
SHA2566fea30b9d17eacffde43b727058b5b2c422a7b70407534549042ba7b20d5f8c9
SHA512142ca76bc32cc60c11f640bd9e050df6000b6824a192595416f661d22d6e52704dfd369974d7f2f73d01eaa356237c50778737d72d5588c5a2ff8a8010ee8101
-
Filesize
1.5MB
MD5c744b772cfec349a9cd69c1cc14ac6f9
SHA18cb0630c4e150c0456bd15ba2e50c28cd117cc4d
SHA256bbbed3793f6b70e2009cd2e6a92b34f729bae863162cb5c3bc41bad8ed0bd536
SHA512c35f7f3e5866dd33da8c506b5c88ea2aacd557f87679a57d81e0584b384a9c652746fdc18ce4d624aadb6bb5021873a00187e9a0b9b7bd338e3164d70624a28a
-
Filesize
1.5MB
MD5c744b772cfec349a9cd69c1cc14ac6f9
SHA18cb0630c4e150c0456bd15ba2e50c28cd117cc4d
SHA256bbbed3793f6b70e2009cd2e6a92b34f729bae863162cb5c3bc41bad8ed0bd536
SHA512c35f7f3e5866dd33da8c506b5c88ea2aacd557f87679a57d81e0584b384a9c652746fdc18ce4d624aadb6bb5021873a00187e9a0b9b7bd338e3164d70624a28a
-
Filesize
182KB
MD5e561df80d8920ae9b152ddddefd13c7c
SHA10d020453f62d2188f7a0e55442af5d75e16e7caf
SHA2565484ca53027230772ae149e3d7684b7e322432ceb013b6bc2440bd3c269192ea
SHA512a7afed5a6434f296f0e0186de8ce87245bbd0f264498e327188a93551dd45e0e67409e62f3477b526ab5b0927e4349ad66107cbea7f7554b4be53c18227741a5
-
Filesize
182KB
MD5e561df80d8920ae9b152ddddefd13c7c
SHA10d020453f62d2188f7a0e55442af5d75e16e7caf
SHA2565484ca53027230772ae149e3d7684b7e322432ceb013b6bc2440bd3c269192ea
SHA512a7afed5a6434f296f0e0186de8ce87245bbd0f264498e327188a93551dd45e0e67409e62f3477b526ab5b0927e4349ad66107cbea7f7554b4be53c18227741a5
-
Filesize
342B
MD5e79bae3b03e1bff746f952a0366e73ba
SHA15f547786c869ce7abc049869182283fa09f38b1d
SHA256900e53f17f7c9a2753107b69c30869343612c1be7281115f3f78d17404af5f63
SHA512c67a9a5a366be8383ad5b746c54697c71dbda712397029bc8346b7c52dd71a7d41be3d35159de35c44a3b8755d9ce94acda08d12ff105263559adb6a6d0baf50
-
Filesize
221KB
MD573089952a99d24a37d9219c4e30decde
SHA18dfa37723afc72f1728ec83f676ffeac9102f8bd
SHA2569aa54a5b73fe93d789ec1707ebd41ff824fcf6ba34b18d97ebc566cee8cbce60
SHA5127088b995c0f6425ad4460b1f286d36e5b7ca3d79308febfac7f212e630b00569239e0b22455198739d20b1fbae1b70c24c22f41a34bab19a793aaa31164aa2d2
-
Filesize
221KB
MD573089952a99d24a37d9219c4e30decde
SHA18dfa37723afc72f1728ec83f676ffeac9102f8bd
SHA2569aa54a5b73fe93d789ec1707ebd41ff824fcf6ba34b18d97ebc566cee8cbce60
SHA5127088b995c0f6425ad4460b1f286d36e5b7ca3d79308febfac7f212e630b00569239e0b22455198739d20b1fbae1b70c24c22f41a34bab19a793aaa31164aa2d2
-
Filesize
11KB
MD5d2ed05fd71460e6d4c505ce87495b859
SHA1a970dfe775c4e3f157b5b2e26b1f77da7ae6d884
SHA2563a119008fd025a394f6fb93a0c941e1dc0fa1f9c7606a674388f21d99dfe116f
SHA512a15efc7c5ddd82ea612444b5df530d11da43bbaaf7f7ae4801c8063c8cffe4538cd47e27639e380b9d1c7e342575169e06af4b298a8faf635865dc4f9dc11b8e
-
Filesize
11KB
MD5d2ed05fd71460e6d4c505ce87495b859
SHA1a970dfe775c4e3f157b5b2e26b1f77da7ae6d884
SHA2563a119008fd025a394f6fb93a0c941e1dc0fa1f9c7606a674388f21d99dfe116f
SHA512a15efc7c5ddd82ea612444b5df530d11da43bbaaf7f7ae4801c8063c8cffe4538cd47e27639e380b9d1c7e342575169e06af4b298a8faf635865dc4f9dc11b8e
-
Filesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
Filesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
Filesize
500KB
MD599267c8824d4b28161a2ecec030ec588
SHA1e478b1ab1733c6116edd204a3cf2c2ee7db49b4a
SHA2566f12232e159de661dadd56f6f17a36a0d4e6ae24eba5c06f54fd2f7a8763feb0
SHA5127be5fa7fdc2ffc9c753ce7a75fddf1ae54dd6eca79c6140eb0ce3cdcf663af7f4846d6ae051283a36ab4e47a96d9b7905e1b55a2d236c5234ecf850caed09df1
-
Filesize
500KB
MD599267c8824d4b28161a2ecec030ec588
SHA1e478b1ab1733c6116edd204a3cf2c2ee7db49b4a
SHA2566f12232e159de661dadd56f6f17a36a0d4e6ae24eba5c06f54fd2f7a8763feb0
SHA5127be5fa7fdc2ffc9c753ce7a75fddf1ae54dd6eca79c6140eb0ce3cdcf663af7f4846d6ae051283a36ab4e47a96d9b7905e1b55a2d236c5234ecf850caed09df1
-
Filesize
500KB
MD599267c8824d4b28161a2ecec030ec588
SHA1e478b1ab1733c6116edd204a3cf2c2ee7db49b4a
SHA2566f12232e159de661dadd56f6f17a36a0d4e6ae24eba5c06f54fd2f7a8763feb0
SHA5127be5fa7fdc2ffc9c753ce7a75fddf1ae54dd6eca79c6140eb0ce3cdcf663af7f4846d6ae051283a36ab4e47a96d9b7905e1b55a2d236c5234ecf850caed09df1
-
Filesize
500KB
MD599267c8824d4b28161a2ecec030ec588
SHA1e478b1ab1733c6116edd204a3cf2c2ee7db49b4a
SHA2566f12232e159de661dadd56f6f17a36a0d4e6ae24eba5c06f54fd2f7a8763feb0
SHA5127be5fa7fdc2ffc9c753ce7a75fddf1ae54dd6eca79c6140eb0ce3cdcf663af7f4846d6ae051283a36ab4e47a96d9b7905e1b55a2d236c5234ecf850caed09df1
-
Filesize
9.9MB
MD5f99fa1c0d1313b7a5dc32cd58564671d
SHA10e3ada17305b7478bb456f5ad5eb73a400a78683
SHA2568a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee
SHA512bbee03761f2ffe4ab99d3e2dd02f49460b1100583ceb0e06f2765eff776d3167880a8dbbb8079c659d39fc3cc8e24dfdd8395ced3eeb6a13ef598ba8b9269a25
-
Filesize
9.9MB
MD5f99fa1c0d1313b7a5dc32cd58564671d
SHA10e3ada17305b7478bb456f5ad5eb73a400a78683
SHA2568a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee
SHA512bbee03761f2ffe4ab99d3e2dd02f49460b1100583ceb0e06f2765eff776d3167880a8dbbb8079c659d39fc3cc8e24dfdd8395ced3eeb6a13ef598ba8b9269a25
-
Filesize
10KB
MD5395e28e36c665acf5f85f7c4c6363296
SHA1cd96607e18326979de9de8d6f5bab2d4b176f9fb
SHA25646af9af74a5525e6315bf690c664a1ad46452fef15b7f3aecb6216ad448befaa
SHA5123d22e98b356986af498ea2937aa388aeb1ac6edfeca784aae7f6628a029287c3daebcc6ab5f8e0ef7f9d546397c8fd406a8cdaf0b46dcc4f8716a69d6fb873de
-
Filesize
10KB
MD5395e28e36c665acf5f85f7c4c6363296
SHA1cd96607e18326979de9de8d6f5bab2d4b176f9fb
SHA25646af9af74a5525e6315bf690c664a1ad46452fef15b7f3aecb6216ad448befaa
SHA5123d22e98b356986af498ea2937aa388aeb1ac6edfeca784aae7f6628a029287c3daebcc6ab5f8e0ef7f9d546397c8fd406a8cdaf0b46dcc4f8716a69d6fb873de
-
Filesize
3.9MB
MD5e2ff8a34d2fcc417c41c822e4f3ea271
SHA1926eaf9dd645e164e9f06ddcba567568b3b8bb1b
SHA2564f26511d40ad3d781ff1bd4c643f9418b3fd0c4da6b769a1ff9ae4d07d8892d0
SHA512823d99704b761218b3de8f6b107378b529e7f718557b9e2b57ffb497310c4eccfc35c402bad28cdc2758ef254e55a936949c24468f07fc21e7e3efc0671beec2
-
Filesize
3.9MB
MD5e2ff8a34d2fcc417c41c822e4f3ea271
SHA1926eaf9dd645e164e9f06ddcba567568b3b8bb1b
SHA2564f26511d40ad3d781ff1bd4c643f9418b3fd0c4da6b769a1ff9ae4d07d8892d0
SHA512823d99704b761218b3de8f6b107378b529e7f718557b9e2b57ffb497310c4eccfc35c402bad28cdc2758ef254e55a936949c24468f07fc21e7e3efc0671beec2
-
Filesize
1.1MB
MD5993c85b5b1c94bfa3b7f45117f567d09
SHA1cb704e8d65621437f15a21be41c1169987b913de
SHA256cb6c640fbc6289b261bca0ee881bfcc8c4df2e89baaab7a4fed4e0e3b0dc9d37
SHA512182d6cb6f3e6618375e8e793c6ce5d3c73da8183d4acad8bad60f35242c264260423e22a68ea64022c9c0c61b226edc4dd3791e6947e42c418355baa623e1f24
-
Filesize
1.1MB
MD5993c85b5b1c94bfa3b7f45117f567d09
SHA1cb704e8d65621437f15a21be41c1169987b913de
SHA256cb6c640fbc6289b261bca0ee881bfcc8c4df2e89baaab7a4fed4e0e3b0dc9d37
SHA512182d6cb6f3e6618375e8e793c6ce5d3c73da8183d4acad8bad60f35242c264260423e22a68ea64022c9c0c61b226edc4dd3791e6947e42c418355baa623e1f24
-
Filesize
95KB
MD5463d1200107d98891f04dbbeece19716
SHA103a4071c18909714676b4c85e2b960782a0e7d29
SHA256e38d2e806efa284c129eca4aff2e81c6cc43f969c5603c2d48efda1a333746e6
SHA5127b257d1f9bc8bef6879f70786eb5580241c1c0e77a458a6d28eaf8ab1571a054ffaf60f9e485ee9890e14abbc7fb9e9e84627dd9c9a224b24c5cd6041a9d4922
-
Filesize
1.3MB
MD559fdc522ffb2ad77f556ee14eab2bb74
SHA1fa92caaf7f7a02c557d12b923458c52a53926cb3
SHA25636d2477192e1075d85a6e4953ef11fecc54352aeac4e1d979868fddcdbd822f4
SHA5123a2c512cc948e34643026cd62c3c3ffd59c38c370dbb15de13c8dc471b8ce4de5dd03b7aeb6dff36389d20ce92cf8cfeb126fa087d0feecbf316029119fbbc07
-
Filesize
1.3MB
MD559fdc522ffb2ad77f556ee14eab2bb74
SHA1fa92caaf7f7a02c557d12b923458c52a53926cb3
SHA25636d2477192e1075d85a6e4953ef11fecc54352aeac4e1d979868fddcdbd822f4
SHA5123a2c512cc948e34643026cd62c3c3ffd59c38c370dbb15de13c8dc471b8ce4de5dd03b7aeb6dff36389d20ce92cf8cfeb126fa087d0feecbf316029119fbbc07
-
Filesize
1.1MB
MD501de5eea6f76005163ad30050ee0ce7f
SHA1ed44b3f285ed587fa2e7e7235cb2b0c0f5b970d5
SHA25622456c68e76c3b40898a5a43e8055b9dd79f6feb2d2f3f7e5d74ed7244084af8
SHA512082024e1c25cef1e6d0e3d136d2d14d5396433088727707eb96a41fc330b3a70cf99c2fdb4ac9311bdef039deec283226e95a22f09381c7e386e4a58b840bb74
-
Filesize
1.1MB
MD501de5eea6f76005163ad30050ee0ce7f
SHA1ed44b3f285ed587fa2e7e7235cb2b0c0f5b970d5
SHA25622456c68e76c3b40898a5a43e8055b9dd79f6feb2d2f3f7e5d74ed7244084af8
SHA512082024e1c25cef1e6d0e3d136d2d14d5396433088727707eb96a41fc330b3a70cf99c2fdb4ac9311bdef039deec283226e95a22f09381c7e386e4a58b840bb74
-
Filesize
755KB
MD540b86718151272c1f0b98ff7758ee542
SHA1a23e2fd88c8a09c4647037c7f322eec51d9234eb
SHA256abbe061bacb67edb5298c4f3e3986a4c6d82eece4b00b6fb59e192008850deb0
SHA512c4c9f1858988cdf266f4c71dad0fc2724e5e203ea31707704dfeb245543b00917b5c67e69e24d596e8a96468e4f27630ab3ebc638fa14d195694e1693b5f0b54
-
Filesize
755KB
MD540b86718151272c1f0b98ff7758ee542
SHA1a23e2fd88c8a09c4647037c7f322eec51d9234eb
SHA256abbe061bacb67edb5298c4f3e3986a4c6d82eece4b00b6fb59e192008850deb0
SHA512c4c9f1858988cdf266f4c71dad0fc2724e5e203ea31707704dfeb245543b00917b5c67e69e24d596e8a96468e4f27630ab3ebc638fa14d195694e1693b5f0b54
-
Filesize
559KB
MD56aa93ede5bfcbe81adba6102d65015dc
SHA1d748914da43dd1cf8d16bdf6eef40b73ebfd65e9
SHA256780e1aadf71d2469d6b4123fd9cd60d90ea74cd2a35b58e9fb36cbb46b6f103e
SHA5126025c1bf9c7124267653f5b27ca7dac400dbf72045d0faef4cb0625b3a0512d006d77f9c03b0038f8856b7c88117a60500ef3c43735610049179b80ad62b26fa
-
Filesize
559KB
MD56aa93ede5bfcbe81adba6102d65015dc
SHA1d748914da43dd1cf8d16bdf6eef40b73ebfd65e9
SHA256780e1aadf71d2469d6b4123fd9cd60d90ea74cd2a35b58e9fb36cbb46b6f103e
SHA5126025c1bf9c7124267653f5b27ca7dac400dbf72045d0faef4cb0625b3a0512d006d77f9c03b0038f8856b7c88117a60500ef3c43735610049179b80ad62b26fa
-
Filesize
1.0MB
MD51d83a8b3eb42ba0746f4db716be0f4a4
SHA1ac3e86eb82b43469d3845501ec5f0bc425f10398
SHA256dcddb0793d24ce8855b6a14035c216ff3dafba74cd3d9e115cc4b7f0fffe8e5d
SHA51242dafcd981b85e4a56af91a46e5fa7dba7f98e0181f07a99de8167608b0024132c1f77cc76f77cacd9a63ba656a9ee43e17181fa4c8a2ee72fd76e350e1dba6f
-
Filesize
1.0MB
MD51d83a8b3eb42ba0746f4db716be0f4a4
SHA1ac3e86eb82b43469d3845501ec5f0bc425f10398
SHA256dcddb0793d24ce8855b6a14035c216ff3dafba74cd3d9e115cc4b7f0fffe8e5d
SHA51242dafcd981b85e4a56af91a46e5fa7dba7f98e0181f07a99de8167608b0024132c1f77cc76f77cacd9a63ba656a9ee43e17181fa4c8a2ee72fd76e350e1dba6f
-
Filesize
222KB
MD546cad35c904d52288a79d5ef78e68c8a
SHA1e25edd1d6e336588fa6caf6f29ed765d39dfc283
SHA256def3a2ab738312926648790775f8bd32230edc1b691c0aa6d8f32c4efb6d0a69
SHA5128cbb4bb192b640e4284061127d7f2fc58aff41dfb726904e3edda924a32c6b1edf11f0b026ee17436666e81e622001f90699d60cdd2585272b16bfa82bba3832
-
Filesize
222KB
MD546cad35c904d52288a79d5ef78e68c8a
SHA1e25edd1d6e336588fa6caf6f29ed765d39dfc283
SHA256def3a2ab738312926648790775f8bd32230edc1b691c0aa6d8f32c4efb6d0a69
SHA5128cbb4bb192b640e4284061127d7f2fc58aff41dfb726904e3edda924a32c6b1edf11f0b026ee17436666e81e622001f90699d60cdd2585272b16bfa82bba3832
-
Filesize
3.1MB
MD5ec413925583e2a91f00f371442afda9c
SHA1e4c3794509e2664e33f67a1e0158decbd206840c
SHA25641cbbacf495bc7466ae42c6cef507bfed1019fe700422be47a50079f0694eae9
SHA5128dcc28118763639e3cab70143cbe74a9f41492e416ca2496034f71d5eb40d34079854ee452a71316a9e1528b869a52f9dd4d06a0bf6cdf6f4f3166368ecc0417
-
Filesize
3.1MB
MD5ec413925583e2a91f00f371442afda9c
SHA1e4c3794509e2664e33f67a1e0158decbd206840c
SHA25641cbbacf495bc7466ae42c6cef507bfed1019fe700422be47a50079f0694eae9
SHA5128dcc28118763639e3cab70143cbe74a9f41492e416ca2496034f71d5eb40d34079854ee452a71316a9e1528b869a52f9dd4d06a0bf6cdf6f4f3166368ecc0417
-
Filesize
3.1MB
MD5ec413925583e2a91f00f371442afda9c
SHA1e4c3794509e2664e33f67a1e0158decbd206840c
SHA25641cbbacf495bc7466ae42c6cef507bfed1019fe700422be47a50079f0694eae9
SHA5128dcc28118763639e3cab70143cbe74a9f41492e416ca2496034f71d5eb40d34079854ee452a71316a9e1528b869a52f9dd4d06a0bf6cdf6f4f3166368ecc0417
-
Filesize
307KB
MD5b6d627dcf04d04889b1f01a14ec12405
SHA1f7292c3d6f2003947cc5455b41df5f8fbd14df14
SHA2569da10d7b75c589f06f1758ed8e3c0335b9a738d0ad1317c48e380bca768bdddf
SHA5121eef46fcb568049edad6a6dac0ce6532185f15d2b4f9939853226a4f24e0732f637951c98f580efdb98ef396d3f4d9846bccffa22c0309b455432c98292af937
-
Filesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
Filesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
Filesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
Filesize
694KB
MD576a0e9b1e8b487085d3eedf0ba8d1062
SHA1d353c3c584127c0db9d7d0b04d776be5920dd0bb
SHA25625a8b697629d47fdf66c7815130fb119c9f2b6aabaf17a4851f059a565b71258
SHA5123c7e0ce15f515c87a7b228831fc01c578d69070abef88af526aeefe5493561e4ab94372e2bffff5016407f13185f733078f6893a7ed9117369e179ba140ea020
-
Filesize
694KB
MD576a0e9b1e8b487085d3eedf0ba8d1062
SHA1d353c3c584127c0db9d7d0b04d776be5920dd0bb
SHA25625a8b697629d47fdf66c7815130fb119c9f2b6aabaf17a4851f059a565b71258
SHA5123c7e0ce15f515c87a7b228831fc01c578d69070abef88af526aeefe5493561e4ab94372e2bffff5016407f13185f733078f6893a7ed9117369e179ba140ea020
-
Filesize
8KB
MD501707599b37b1216e43e84ae1f0d8c03
SHA1521fe10ac55a1f89eba7b8e82e49407b02b0dcb2
SHA256cc0dbc1d31ccd9488695b690bd7e7aa4a90ba4b2a5d23ef48b296465f5aa44dd
SHA5129f9ff29a12d26a7d42656e0faf970c908f1ef428b14e5a5fe7acd06371b96b16eb984e8fbee4e2b906c6db7fb39c9d4a221e79fc3d5e9ca9b59e377875bc5642
-
Filesize
8KB
MD501707599b37b1216e43e84ae1f0d8c03
SHA1521fe10ac55a1f89eba7b8e82e49407b02b0dcb2
SHA256cc0dbc1d31ccd9488695b690bd7e7aa4a90ba4b2a5d23ef48b296465f5aa44dd
SHA5129f9ff29a12d26a7d42656e0faf970c908f1ef428b14e5a5fe7acd06371b96b16eb984e8fbee4e2b906c6db7fb39c9d4a221e79fc3d5e9ca9b59e377875bc5642
-
Filesize
8KB
MD501707599b37b1216e43e84ae1f0d8c03
SHA1521fe10ac55a1f89eba7b8e82e49407b02b0dcb2
SHA256cc0dbc1d31ccd9488695b690bd7e7aa4a90ba4b2a5d23ef48b296465f5aa44dd
SHA5129f9ff29a12d26a7d42656e0faf970c908f1ef428b14e5a5fe7acd06371b96b16eb984e8fbee4e2b906c6db7fb39c9d4a221e79fc3d5e9ca9b59e377875bc5642
-
Filesize
5.6MB
MD5bae29e49e8190bfbbf0d77ffab8de59d
SHA14a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA5129e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2
-
Filesize
5.6MB
MD5bae29e49e8190bfbbf0d77ffab8de59d
SHA14a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA5129e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2
-
Filesize
177KB
MD56e68805f0661dbeb776db896761d469f
SHA195e550b2f54e9167ae02f67e963703c593833845
SHA256095e2b0ed70525cf5a7a5c31241aad5c27964fd69d68569c646a158c0ff50b47
SHA5125cf25502b2fc8ab34b777b490493c8974af15135e8ff81f43ff254b910f74ee5cece6848ca4a5adae54b8cbf895362f268fd1665705f39bee27f395ea5c04efc
-
Filesize
177KB
MD56e68805f0661dbeb776db896761d469f
SHA195e550b2f54e9167ae02f67e963703c593833845
SHA256095e2b0ed70525cf5a7a5c31241aad5c27964fd69d68569c646a158c0ff50b47
SHA5125cf25502b2fc8ab34b777b490493c8974af15135e8ff81f43ff254b910f74ee5cece6848ca4a5adae54b8cbf895362f268fd1665705f39bee27f395ea5c04efc
-
Filesize
177KB
MD56e68805f0661dbeb776db896761d469f
SHA195e550b2f54e9167ae02f67e963703c593833845
SHA256095e2b0ed70525cf5a7a5c31241aad5c27964fd69d68569c646a158c0ff50b47
SHA5125cf25502b2fc8ab34b777b490493c8974af15135e8ff81f43ff254b910f74ee5cece6848ca4a5adae54b8cbf895362f268fd1665705f39bee27f395ea5c04efc