Analysis
-
max time kernel
120s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
15/11/2023, 00:13
Static task
static1
Behavioral task
behavioral1
Sample
KerbalSpaceProgram Turkce Yama Kurulumu.exe
Resource
win7-20231020-en
General
-
Target
KerbalSpaceProgram Turkce Yama Kurulumu.exe
-
Size
67.1MB
-
MD5
93530a9714f6b721ba45fbf82fb36c4e
-
SHA1
7fa1dc079004c8acd6d3a2c53ac9fba4dbfb11d5
-
SHA256
4f1c64f9a718df8014428ebfa1222183700c91b1c7f3a431f66bbcbb357a8574
-
SHA512
011e81762215bea51bb6b4295d3a8a36bde93c8cc845bab66b3ce7e475eadc19d0de164b0289e0e5c17454cb4a7bb0884a07aa4252d1322679be36a11ef2f234
-
SSDEEP
1572864:eGlqhpZDckekSjofjyjsUSnSTt2mjN6LIFTtAmriZn0:ZlqzpakSjobmsUQC0mjN6Qbs0
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" Launcher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Launcher.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" Launcher.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" Launcher.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" Launcher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableAntiSpyware = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Launcher.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" Launcher.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" Launcher.exe -
Executes dropped EXE 4 IoCs
pid Process 1096 Launcher.exe 2396 rft64.exe 2920 Launcher.exe 1628 rft64.exe -
Loads dropped DLL 20 IoCs
pid Process 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe 2244 MsiExec.exe 2244 MsiExec.exe 2244 MsiExec.exe 2244 MsiExec.exe 2244 MsiExec.exe 2244 MsiExec.exe 2244 MsiExec.exe 1080 MsiExec.exe 1080 MsiExec.exe 1080 MsiExec.exe 1080 MsiExec.exe 1080 MsiExec.exe 2720 msiexec.exe 2228 MsiExec.exe 2228 MsiExec.exe 1240 Process not Found 1240 Process not Found 2244 MsiExec.exe 2244 MsiExec.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: KerbalSpaceProgram Turkce Yama Kurulumu.exe File opened (read-only) \??\E: KerbalSpaceProgram Turkce Yama Kurulumu.exe File opened (read-only) \??\H: KerbalSpaceProgram Turkce Yama Kurulumu.exe File opened (read-only) \??\V: KerbalSpaceProgram Turkce Yama Kurulumu.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: KerbalSpaceProgram Turkce Yama Kurulumu.exe File opened (read-only) \??\T: KerbalSpaceProgram Turkce Yama Kurulumu.exe File opened (read-only) \??\K: KerbalSpaceProgram Turkce Yama Kurulumu.exe File opened (read-only) \??\V: KerbalSpaceProgram Turkce Yama Kurulumu.exe File opened (read-only) \??\X: KerbalSpaceProgram Turkce Yama Kurulumu.exe File opened (read-only) \??\X: KerbalSpaceProgram Turkce Yama Kurulumu.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: KerbalSpaceProgram Turkce Yama Kurulumu.exe File opened (read-only) \??\H: KerbalSpaceProgram Turkce Yama Kurulumu.exe File opened (read-only) \??\U: KerbalSpaceProgram Turkce Yama Kurulumu.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Q: KerbalSpaceProgram Turkce Yama Kurulumu.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: KerbalSpaceProgram Turkce Yama Kurulumu.exe File opened (read-only) \??\Y: KerbalSpaceProgram Turkce Yama Kurulumu.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\U: KerbalSpaceProgram Turkce Yama Kurulumu.exe File opened (read-only) \??\M: KerbalSpaceProgram Turkce Yama Kurulumu.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: KerbalSpaceProgram Turkce Yama Kurulumu.exe File opened (read-only) \??\N: KerbalSpaceProgram Turkce Yama Kurulumu.exe File opened (read-only) \??\W: KerbalSpaceProgram Turkce Yama Kurulumu.exe File opened (read-only) \??\K: KerbalSpaceProgram Turkce Yama Kurulumu.exe File opened (read-only) \??\S: KerbalSpaceProgram Turkce Yama Kurulumu.exe File opened (read-only) \??\Z: KerbalSpaceProgram Turkce Yama Kurulumu.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Z: KerbalSpaceProgram Turkce Yama Kurulumu.exe File opened (read-only) \??\J: KerbalSpaceProgram Turkce Yama Kurulumu.exe File opened (read-only) \??\P: KerbalSpaceProgram Turkce Yama Kurulumu.exe File opened (read-only) \??\A: KerbalSpaceProgram Turkce Yama Kurulumu.exe File opened (read-only) \??\G: KerbalSpaceProgram Turkce Yama Kurulumu.exe File opened (read-only) \??\I: KerbalSpaceProgram Turkce Yama Kurulumu.exe File opened (read-only) \??\P: KerbalSpaceProgram Turkce Yama Kurulumu.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\G: KerbalSpaceProgram Turkce Yama Kurulumu.exe File opened (read-only) \??\R: KerbalSpaceProgram Turkce Yama Kurulumu.exe File opened (read-only) \??\L: KerbalSpaceProgram Turkce Yama Kurulumu.exe File opened (read-only) \??\T: KerbalSpaceProgram Turkce Yama Kurulumu.exe File opened (read-only) \??\S: KerbalSpaceProgram Turkce Yama Kurulumu.exe File opened (read-only) \??\Y: KerbalSpaceProgram Turkce Yama Kurulumu.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\L: KerbalSpaceProgram Turkce Yama Kurulumu.exe File opened (read-only) \??\R: KerbalSpaceProgram Turkce Yama Kurulumu.exe File opened (read-only) \??\O: KerbalSpaceProgram Turkce Yama Kurulumu.exe File opened (read-only) \??\W: KerbalSpaceProgram Turkce Yama Kurulumu.exe File opened (read-only) \??\M: KerbalSpaceProgram Turkce Yama Kurulumu.exe File opened (read-only) \??\Q: KerbalSpaceProgram Turkce Yama Kurulumu.exe File opened (read-only) \??\J: KerbalSpaceProgram Turkce Yama Kurulumu.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe -
AutoIT Executable 20 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/1096-164-0x000000013F180000-0x000000014104F000-memory.dmp autoit_exe behavioral1/memory/1096-163-0x000000013F180000-0x000000014104F000-memory.dmp autoit_exe behavioral1/memory/1096-165-0x000000013F180000-0x000000014104F000-memory.dmp autoit_exe behavioral1/memory/1096-166-0x000000013F180000-0x000000014104F000-memory.dmp autoit_exe behavioral1/memory/1096-174-0x000000013F180000-0x000000014104F000-memory.dmp autoit_exe behavioral1/memory/2396-179-0x000000013FE30000-0x0000000141807000-memory.dmp autoit_exe behavioral1/memory/2396-180-0x000000013FE30000-0x0000000141807000-memory.dmp autoit_exe behavioral1/memory/2396-181-0x000000013FE30000-0x0000000141807000-memory.dmp autoit_exe behavioral1/memory/2396-182-0x000000013FE30000-0x0000000141807000-memory.dmp autoit_exe behavioral1/memory/2396-183-0x000000013FE30000-0x0000000141807000-memory.dmp autoit_exe behavioral1/memory/2920-229-0x000000013F790000-0x000000014165F000-memory.dmp autoit_exe behavioral1/memory/2920-230-0x000000013F790000-0x000000014165F000-memory.dmp autoit_exe behavioral1/memory/2920-231-0x000000013F790000-0x000000014165F000-memory.dmp autoit_exe behavioral1/memory/2920-232-0x000000013F790000-0x000000014165F000-memory.dmp autoit_exe behavioral1/memory/2920-237-0x000000013F790000-0x000000014165F000-memory.dmp autoit_exe behavioral1/memory/1628-240-0x000000013FB70000-0x0000000141547000-memory.dmp autoit_exe behavioral1/memory/1628-243-0x000000013FB70000-0x0000000141547000-memory.dmp autoit_exe behavioral1/memory/1628-244-0x000000013FB70000-0x0000000141547000-memory.dmp autoit_exe behavioral1/memory/1628-245-0x000000013FB70000-0x0000000141547000-memory.dmp autoit_exe behavioral1/memory/1628-246-0x000000013FB70000-0x0000000141547000-memory.dmp autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
pid Process 1096 Launcher.exe 1096 Launcher.exe 2396 rft64.exe 2396 rft64.exe 2920 Launcher.exe 2920 Launcher.exe 1628 rft64.exe 1628 rft64.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\KSPCeviri\Kerbal Space Program Türkçe Yama\config_data.dll msiexec.exe File created C:\Program Files (x86)\KSPCeviri\Kerbal Space Program Türkçe Yama\Launcher.exe msiexec.exe -
Drops file in Windows directory 22 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File created C:\Windows\Installer\f7700bc.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI291.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3BA.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSID5C.tmp msiexec.exe File opened for modification C:\Windows\Installer\{3F9B5A3D-F4FB-4312-8194-E70CF3C54089}\Launcher.exe msiexec.exe File opened for modification C:\Windows\Installer\f7700bd.ipi msiexec.exe File created C:\Windows\rft64.exe Launcher.exe File created C:\Windows\rft64.exe Launcher.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\MSI1A6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF23.tmp msiexec.exe File created C:\Windows\DotNetZip.dll msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\Installer\MSIEA5.tmp msiexec.exe File created C:\Windows\Installer\{3F9B5A3D-F4FB-4312-8194-E70CF3C54089}\Launcher.exe msiexec.exe File opened for modification C:\Windows\Installer\f7700bc.msi msiexec.exe File created C:\Windows\Installer\f7700bd.ipi msiexec.exe File created C:\Windows\Task.dll msiexec.exe File opened for modification C:\Windows\Installer\MSI13E5.tmp msiexec.exe File created C:\Windows\Installer\f7700bf.msi msiexec.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2848 sc.exe 820 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 46 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D msiexec.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe -
Modifies registry class 24 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\777E3BC32C3A6BE48B424BDFC7E84E59 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D3A5B9F3BF4F213418497EC03F5C0498\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D3A5B9F3BF4F213418497EC03F5C0498 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D3A5B9F3BF4F213418497EC03F5C0498\MainFeature msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D3A5B9F3BF4F213418497EC03F5C0498\PackageCode = "2507A6272C50F66428136EFAA88D0578" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D3A5B9F3BF4F213418497EC03F5C0498\Language = "1055" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D3A5B9F3BF4F213418497EC03F5C0498\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D3A5B9F3BF4F213418497EC03F5C0498\Transforms = ":1033" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D3A5B9F3BF4F213418497EC03F5C0498\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D3A5B9F3BF4F213418497EC03F5C0498\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D3A5B9F3BF4F213418497EC03F5C0498\Version = "16777216" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D3A5B9F3BF4F213418497EC03F5C0498\AuthorizedLUAApp = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D3A5B9F3BF4F213418497EC03F5C0498\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D3A5B9F3BF4F213418497EC03F5C0498\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D3A5B9F3BF4F213418497EC03F5C0498\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\{61C2C8B7-51C7-423E-A9EE-F57CA8F5BF75}\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D3A5B9F3BF4F213418497EC03F5C0498\SourceList\PackageName = "deneme.back.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D3A5B9F3BF4F213418497EC03F5C0498\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\{61C2C8B7-51C7-423E-A9EE-F57CA8F5BF75}\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D3A5B9F3BF4F213418497EC03F5C0498\SourceList\Media\1 = "Disk1;Disk1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D3A5B9F3BF4F213418497EC03F5C0498 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D3A5B9F3BF4F213418497EC03F5C0498\ProductName = "Kerbal Space Program Türkçe Yama" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D3A5B9F3BF4F213418497EC03F5C0498\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D3A5B9F3BF4F213418497EC03F5C0498\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\777E3BC32C3A6BE48B424BDFC7E84E59\D3A5B9F3BF4F213418497EC03F5C0498 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D3A5B9F3BF4F213418497EC03F5C0498\Clients = 3a0000000000 msiexec.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 2720 msiexec.exe 2720 msiexec.exe 1096 Launcher.exe 1096 Launcher.exe 1096 Launcher.exe 1096 Launcher.exe 2396 rft64.exe 2920 Launcher.exe 2920 Launcher.exe 2920 Launcher.exe 2920 Launcher.exe 1628 rft64.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 2720 msiexec.exe Token: SeTakeOwnershipPrivilege 2720 msiexec.exe Token: SeSecurityPrivilege 2720 msiexec.exe Token: SeCreateTokenPrivilege 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe Token: SeAssignPrimaryTokenPrivilege 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe Token: SeLockMemoryPrivilege 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe Token: SeIncreaseQuotaPrivilege 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe Token: SeMachineAccountPrivilege 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe Token: SeTcbPrivilege 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe Token: SeSecurityPrivilege 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe Token: SeTakeOwnershipPrivilege 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe Token: SeLoadDriverPrivilege 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe Token: SeSystemProfilePrivilege 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe Token: SeSystemtimePrivilege 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe Token: SeProfSingleProcessPrivilege 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe Token: SeIncBasePriorityPrivilege 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe Token: SeCreatePagefilePrivilege 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe Token: SeCreatePermanentPrivilege 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe Token: SeBackupPrivilege 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe Token: SeRestorePrivilege 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe Token: SeShutdownPrivilege 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe Token: SeDebugPrivilege 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe Token: SeAuditPrivilege 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe Token: SeSystemEnvironmentPrivilege 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe Token: SeChangeNotifyPrivilege 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe Token: SeRemoteShutdownPrivilege 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe Token: SeUndockPrivilege 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe Token: SeSyncAgentPrivilege 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe Token: SeEnableDelegationPrivilege 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe Token: SeManageVolumePrivilege 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe Token: SeImpersonatePrivilege 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe Token: SeCreateGlobalPrivilege 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe Token: SeCreateTokenPrivilege 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe Token: SeAssignPrimaryTokenPrivilege 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe Token: SeLockMemoryPrivilege 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe Token: SeIncreaseQuotaPrivilege 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe Token: SeMachineAccountPrivilege 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe Token: SeTcbPrivilege 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe Token: SeSecurityPrivilege 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe Token: SeTakeOwnershipPrivilege 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe Token: SeLoadDriverPrivilege 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe Token: SeSystemProfilePrivilege 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe Token: SeSystemtimePrivilege 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe Token: SeProfSingleProcessPrivilege 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe Token: SeIncBasePriorityPrivilege 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe Token: SeCreatePagefilePrivilege 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe Token: SeCreatePermanentPrivilege 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe Token: SeBackupPrivilege 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe Token: SeRestorePrivilege 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe Token: SeShutdownPrivilege 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe Token: SeDebugPrivilege 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe Token: SeAuditPrivilege 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe Token: SeSystemEnvironmentPrivilege 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe Token: SeChangeNotifyPrivilege 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe Token: SeRemoteShutdownPrivilege 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe Token: SeUndockPrivilege 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe Token: SeSyncAgentPrivilege 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe Token: SeEnableDelegationPrivilege 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe Token: SeManageVolumePrivilege 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe Token: SeImpersonatePrivilege 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe Token: SeCreateGlobalPrivilege 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe Token: SeCreateTokenPrivilege 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe Token: SeAssignPrimaryTokenPrivilege 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe Token: SeLockMemoryPrivilege 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2720 wrote to memory of 2244 2720 msiexec.exe 29 PID 2720 wrote to memory of 2244 2720 msiexec.exe 29 PID 2720 wrote to memory of 2244 2720 msiexec.exe 29 PID 2720 wrote to memory of 2244 2720 msiexec.exe 29 PID 2720 wrote to memory of 2244 2720 msiexec.exe 29 PID 2720 wrote to memory of 2244 2720 msiexec.exe 29 PID 2720 wrote to memory of 2244 2720 msiexec.exe 29 PID 2516 wrote to memory of 2952 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe 30 PID 2516 wrote to memory of 2952 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe 30 PID 2516 wrote to memory of 2952 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe 30 PID 2516 wrote to memory of 2952 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe 30 PID 2516 wrote to memory of 2952 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe 30 PID 2516 wrote to memory of 2952 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe 30 PID 2516 wrote to memory of 2952 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe 30 PID 2720 wrote to memory of 1080 2720 msiexec.exe 36 PID 2720 wrote to memory of 1080 2720 msiexec.exe 36 PID 2720 wrote to memory of 1080 2720 msiexec.exe 36 PID 2720 wrote to memory of 1080 2720 msiexec.exe 36 PID 2720 wrote to memory of 1080 2720 msiexec.exe 36 PID 2720 wrote to memory of 1080 2720 msiexec.exe 36 PID 2720 wrote to memory of 1080 2720 msiexec.exe 36 PID 2720 wrote to memory of 2228 2720 msiexec.exe 37 PID 2720 wrote to memory of 2228 2720 msiexec.exe 37 PID 2720 wrote to memory of 2228 2720 msiexec.exe 37 PID 2720 wrote to memory of 2228 2720 msiexec.exe 37 PID 2720 wrote to memory of 2228 2720 msiexec.exe 37 PID 2720 wrote to memory of 2228 2720 msiexec.exe 37 PID 2720 wrote to memory of 2228 2720 msiexec.exe 37 PID 2244 wrote to memory of 1096 2244 MsiExec.exe 39 PID 2244 wrote to memory of 1096 2244 MsiExec.exe 39 PID 2244 wrote to memory of 1096 2244 MsiExec.exe 39 PID 2244 wrote to memory of 1096 2244 MsiExec.exe 39 PID 1096 wrote to memory of 1256 1096 Launcher.exe 40 PID 1096 wrote to memory of 1256 1096 Launcher.exe 40 PID 1096 wrote to memory of 1256 1096 Launcher.exe 40 PID 1256 wrote to memory of 2848 1256 cmd.exe 43 PID 1256 wrote to memory of 2848 1256 cmd.exe 43 PID 1256 wrote to memory of 2848 1256 cmd.exe 43 PID 2516 wrote to memory of 2580 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe 44 PID 2516 wrote to memory of 2580 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe 44 PID 2516 wrote to memory of 2580 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe 44 PID 2516 wrote to memory of 2580 2516 KerbalSpaceProgram Turkce Yama Kurulumu.exe 44 PID 2580 wrote to memory of 1968 2580 cmd.exe 46 PID 2580 wrote to memory of 1968 2580 cmd.exe 46 PID 2580 wrote to memory of 1968 2580 cmd.exe 46 PID 2580 wrote to memory of 1968 2580 cmd.exe 46 PID 2580 wrote to memory of 548 2580 cmd.exe 47 PID 2580 wrote to memory of 548 2580 cmd.exe 47 PID 2580 wrote to memory of 548 2580 cmd.exe 47 PID 2580 wrote to memory of 548 2580 cmd.exe 47 PID 2580 wrote to memory of 268 2580 cmd.exe 48 PID 2580 wrote to memory of 268 2580 cmd.exe 48 PID 2580 wrote to memory of 268 2580 cmd.exe 48 PID 2580 wrote to memory of 268 2580 cmd.exe 48 PID 2580 wrote to memory of 752 2580 cmd.exe 49 PID 2580 wrote to memory of 752 2580 cmd.exe 49 PID 2580 wrote to memory of 752 2580 cmd.exe 49 PID 2580 wrote to memory of 752 2580 cmd.exe 49 PID 2920 wrote to memory of 2984 2920 Launcher.exe 52 PID 2920 wrote to memory of 2984 2920 Launcher.exe 52 PID 2920 wrote to memory of 2984 2920 Launcher.exe 52 PID 2984 wrote to memory of 820 2984 cmd.exe 54 PID 2984 wrote to memory of 820 2984 cmd.exe 54 PID 2984 wrote to memory of 820 2984 cmd.exe 54 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 548 attrib.exe 1968 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\KerbalSpaceProgram Turkce Yama Kurulumu.exe"C:\Users\Admin\AppData\Local\Temp\KerbalSpaceProgram Turkce Yama Kurulumu.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\KerbalSpaceProgram Turkce Yama Kurulumu.exe"C:\Users\Admin\AppData\Local\Temp\KerbalSpaceProgram Turkce Yama Kurulumu.exe" /i C:\Users\Admin\AppData\Local\Temp\{61C2C8B7-51C7-423E-A9EE-F57CA8F5BF75}\deneme.back.msi AI_EUIMSI=1 APPDIR="C:\Program Files (x86)\KSPCeviri\Kerbal Space Program Türkçe Yama" SECONDSEQUENCE="1" CLIENTPROCESSID="2516" CHAINERUIPROCESSID="2516Chainer" ACTION="INSTALL" EXECUTEACTION="INSTALL" CLIENTUILEVEL="0" ADDLOCAL="MainFeature" PRIMARYFOLDER="APPDIR" ROOTDRIVE="C:\" TRANSFORMS=":1033" AI_FOUND_PREREQS=".NET Framework 4.5" AI_SETUPEXEPATH="C:\Users\Admin\AppData\Local\Temp\KerbalSpaceProgram Turkce Yama Kurulumu.exe" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1699747812 " AI_SETUPEXEPATH_ORIGINAL="C:\Users\Admin\AppData\Local\Temp\KerbalSpaceProgram Turkce Yama Kurulumu.exe" TARGETDIR="C:\" AI_INSTALL="1"2⤵
- Enumerates connected drives
PID:2952
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\EXE4489.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\SysWOW64\attrib.exeC:\Windows\System32\attrib.exe -r "C:\Users\Admin\AppData\Local\Temp\AIE840E.tmp"3⤵
- Views/modifies file attributes
PID:1968
-
-
C:\Windows\SysWOW64\attrib.exeC:\Windows\System32\attrib.exe -r "C:\Users\Admin\AppData\Local\Temp\EXE4489.bat"3⤵
- Views/modifies file attributes
PID:548
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" del "C:\Users\Admin\AppData\Local\Temp\EXE4489.bat" "3⤵PID:268
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" cls"3⤵PID:752
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Modifies Windows Defender Real-time Protection settings
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 995357B18EA7C186C931A5B6FC32DCBA C2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Program Files (x86)\KSPCeviri\Kerbal Space Program Türkçe Yama\Launcher.exe"C:\Program Files (x86)\KSPCeviri\Kerbal Space Program Türkçe Yama\Launcher.exe"3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Windows\system32\cmd.execmd.exe /c sc start trustedinstaller4⤵
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Windows\system32\sc.exesc start trustedinstaller5⤵
- Launches sc.exe
PID:2848
-
-
-
C:\Windows\rft64.exeC:\Windows\rft64.exe trustedinstaller.exe 1 powershell.exe4⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2396
-
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 1CDBE6182E5F0E0324AD8171965669FA2⤵
- Loads dropped DLL
PID:1080
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B9D0F42227E144AA90BEBB4703DE29F1 M Global\MSI00002⤵
- Loads dropped DLL
PID:2228
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:1720
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000004D0" "0000000000000594"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2000
-
C:\Program Files (x86)\KSPCeviri\Kerbal Space Program Türkçe Yama\Launcher.exe"C:\Program Files (x86)\KSPCeviri\Kerbal Space Program Türkçe Yama\Launcher.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\system32\cmd.execmd.exe /c sc start trustedinstaller2⤵
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\system32\sc.exesc start trustedinstaller3⤵
- Launches sc.exe
PID:820
-
-
-
C:\Windows\rft64.exeC:\Windows\rft64.exe trustedinstaller.exe 1 powershell.exe2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1628
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD53e56fa485f631fb044d773c4ae7a16ff
SHA158ae4afebac1a456cb8cbc1169e7290ffe5a1b1a
SHA256343ac5b5b6f15f03af7a372ef8840a83965e63af77103bb4bdbb235b813673b9
SHA5123c18cc09f98c1e3c52117b0929e81114d143a0d7475a93eeb24a36d9c9ab57db76dc9989e45d2811fd36ed381bb6a2a6e0572f955fd54a385e9e89cec43e33ba
-
Filesize
15.4MB
MD5cf29f092eb7d654a73236a8becbc36f6
SHA1e3cc40bfd4ec178a0285a9f8cd652f88c89eefcf
SHA25644ea5818829a2a9c69274cfdcde623466f0734dd907dd2e2273256c48d27e761
SHA512da36e9ff4b0c0db12c4747c6108aa46ad5c3ae49ac1dc6021824562bf6391dc77fd815e42a315b908a677507e9eece9c03bc09027e733d12457b56e5741a1ac8
-
Filesize
15.4MB
MD5cf29f092eb7d654a73236a8becbc36f6
SHA1e3cc40bfd4ec178a0285a9f8cd652f88c89eefcf
SHA25644ea5818829a2a9c69274cfdcde623466f0734dd907dd2e2273256c48d27e761
SHA512da36e9ff4b0c0db12c4747c6108aa46ad5c3ae49ac1dc6021824562bf6391dc77fd815e42a315b908a677507e9eece9c03bc09027e733d12457b56e5741a1ac8
-
Filesize
15.4MB
MD5cf29f092eb7d654a73236a8becbc36f6
SHA1e3cc40bfd4ec178a0285a9f8cd652f88c89eefcf
SHA25644ea5818829a2a9c69274cfdcde623466f0734dd907dd2e2273256c48d27e761
SHA512da36e9ff4b0c0db12c4747c6108aa46ad5c3ae49ac1dc6021824562bf6391dc77fd815e42a315b908a677507e9eece9c03bc09027e733d12457b56e5741a1ac8
-
Filesize
21B
MD5e3e38da1bfb9bc09b3516819cb856b5c
SHA105c16bc56e0ded751e2e65507068fd8884709785
SHA256145eeff89e9231058eec20405e9e17eac807fbac11fbff1158b5d92bdfe5d656
SHA512ac7255e30acae4c659f8d9f55f543aeb6b0e78dee17118b3d353ee58630e5c69b65c99f681b25bb48100c667ff33f96f317d9ee854086c2e7e9c83b6e6c504bf
-
Filesize
1.5MB
MD5f12a2f4402a956ae5e63f75cddab0c56
SHA191a6d37b8b97e05488267acdda33782bee99a6b7
SHA256932211ce9a58697ec93e2ba050546e733ad78674c07c78dd23b0ec33a1ded7f4
SHA512e4d3c8c75c49cc63b02375becc8c645c9e1b2619a7d9877a0be127cef7ee2cad022f9463be5126cf900125dc1e1ceef738b9ac087e81213a3cca6f9288728056
-
Filesize
1.5MB
MD5f12a2f4402a956ae5e63f75cddab0c56
SHA191a6d37b8b97e05488267acdda33782bee99a6b7
SHA256932211ce9a58697ec93e2ba050546e733ad78674c07c78dd23b0ec33a1ded7f4
SHA512e4d3c8c75c49cc63b02375becc8c645c9e1b2619a7d9877a0be127cef7ee2cad022f9463be5126cf900125dc1e1ceef738b9ac087e81213a3cca6f9288728056
-
Filesize
1.6MB
MD514640dd8ca6827ed133bcad2f5a90fe1
SHA16afe60863553585e6275bda065d593f76a1c0588
SHA2562cb27c951543c0a3a66bd1f5c0fbdf01fac36e4958c00ad013bb27ab97219ce9
SHA5128638771b35c561e830df5c3a913d6cfefd8dd90a99ee7ff3f9a1d073d4f808ae1b95728024048438dada7fe3e0baa0ff225603cb75b880939a7a7bfa48eb514f
-
Filesize
2KB
MD5ce1143e3563de4e200ba7f4953b3807b
SHA1d3d4522a4bdcb68672047eb7b830cde532ef34a6
SHA256a5eefaca044b04460a1ced5fec2229545edf85f01e1d6673e6e14d06b3108c2d
SHA512c2fd5457d1a0b67f62d6f6d789d906702fe943e11c6e05a9fe77c2d633c347229f90444dcc78104311f90cd9f868b867940c84f28952a92a7b3fd98e6fd9b166
-
Filesize
11KB
MD5553df955cb4b2e7be5cef99cb8ec9254
SHA1370c2f61e886e53d8faf9537040daaafed330137
SHA256f1fcb09df932aef09b24eea796286ceaedcbceccd4d8f4536345163c4d3d9ff7
SHA512d31d4fc9080c794901b9fa3d3aec998a1b274f4c11c02362b30d2fbaf013b877198b08bb6d96fda68c7e9e329740090609a7d65249bc7e6209ace24fcfe3c34b
-
Filesize
369B
MD58797303c17b8f9ff007cc9e86fb91ec7
SHA1a53351ddc969216a7be1bc0ee766d83e782e7c7d
SHA2569cb94756cad7e7acc99184d9a36fdcc003fe5d9de0887f279061ecfb62ac589d
SHA5126ff37adae9429721b811ce089de8d3e87f1b8be426369099c3b4ea633d79bb5085db1da9ec7b631c0d2f73b9cbc4cdbb7a572ba1e13f9500b9eb6fcaf447177c
-
Filesize
369B
MD58797303c17b8f9ff007cc9e86fb91ec7
SHA1a53351ddc969216a7be1bc0ee766d83e782e7c7d
SHA2569cb94756cad7e7acc99184d9a36fdcc003fe5d9de0887f279061ecfb62ac589d
SHA5126ff37adae9429721b811ce089de8d3e87f1b8be426369099c3b4ea633d79bb5085db1da9ec7b631c0d2f73b9cbc4cdbb7a572ba1e13f9500b9eb6fcaf447177c
-
Filesize
386KB
MD572b1c6699ddc2baab105d32761285df2
SHA1fc85e9fb190f205e6752624a5231515c4ee4e155
SHA256bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97
SHA512cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170
-
Filesize
386KB
MD572b1c6699ddc2baab105d32761285df2
SHA1fc85e9fb190f205e6752624a5231515c4ee4e155
SHA256bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97
SHA512cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170
-
Filesize
386KB
MD572b1c6699ddc2baab105d32761285df2
SHA1fc85e9fb190f205e6752624a5231515c4ee4e155
SHA256bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97
SHA512cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170
-
Filesize
544KB
MD540117f705bff008c3d96a73162dad044
SHA12735813836f36b5de83a745c47628053a0f61f66
SHA25632211c43bcfee2ea3ae54899af178d1fc0c2b1111b2a9e3cc3fd125e1ab7daad
SHA512eace1d55d479c4cf5692ec1dc98a6738e94874901bebe14a0a0a93eefd00fc4bd55a701e4629a1f7c47f72ac91fe3b698d590a8463119998852e05d6682f91a4
-
Filesize
386KB
MD572b1c6699ddc2baab105d32761285df2
SHA1fc85e9fb190f205e6752624a5231515c4ee4e155
SHA256bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97
SHA512cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170
-
Filesize
386KB
MD572b1c6699ddc2baab105d32761285df2
SHA1fc85e9fb190f205e6752624a5231515c4ee4e155
SHA256bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97
SHA512cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170
-
Filesize
386KB
MD572b1c6699ddc2baab105d32761285df2
SHA1fc85e9fb190f205e6752624a5231515c4ee4e155
SHA256bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97
SHA512cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170
-
Filesize
386KB
MD572b1c6699ddc2baab105d32761285df2
SHA1fc85e9fb190f205e6752624a5231515c4ee4e155
SHA256bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97
SHA512cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170
-
Filesize
544KB
MD540117f705bff008c3d96a73162dad044
SHA12735813836f36b5de83a745c47628053a0f61f66
SHA25632211c43bcfee2ea3ae54899af178d1fc0c2b1111b2a9e3cc3fd125e1ab7daad
SHA512eace1d55d479c4cf5692ec1dc98a6738e94874901bebe14a0a0a93eefd00fc4bd55a701e4629a1f7c47f72ac91fe3b698d590a8463119998852e05d6682f91a4
-
Filesize
386KB
MD572b1c6699ddc2baab105d32761285df2
SHA1fc85e9fb190f205e6752624a5231515c4ee4e155
SHA256bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97
SHA512cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170
-
Filesize
1.5MB
MD5500c824b3862d7caadaf7bf1ab51803a
SHA1dddaf7467c10ae206bd8b213ce2ca8216b3183cb
SHA2564ec1e2a5d24aa742761dd67660907ecb320dbf0db7f5d1b092322c5ee4d5dfb8
SHA512475b0ff7d157bf87ed509c6a3e968530779afb054155fd64c8351e2def021a8a12615e0cbd99cf7b0d2b8490cd8e8d1f9196af15124840da845c6411e4b8a16c
-
Filesize
15.3MB
MD5bc8f50573a55f12b2d364eeea316b445
SHA12924a75897819f965b9ebf3715f2c74ccb576cfb
SHA256786a97ab6626b952ec69e6b8276b533859dfffd38c2b376ddabfb76b4af4671b
SHA512421e81d74fa9cf142855f3bc6a7414fce7f2d9428b23536719f5a4f1f5d0f5071b2dec1d2ab0f754b54f75ce0629704d442fe661d718f194f518ef725e223221
-
Filesize
2KB
MD5b19e6d1c99a9beeb05bbadb33cbda283
SHA12df42c7b97d25970116b290b65c44d4338e70c76
SHA256a9d1dc719c1e9f957d38b77806b1b23ec491b237556009c75c2a93989231606d
SHA51257a611d4460d4ef65ea65e75e93690cde514115645402138b696e0894947f4a3ac99baf5d2436d1481301eac0e7261edc299b8fe82ab7ec852eafdc63323fe7e
-
Filesize
278KB
MD55d7495207fbb9e5bfb0037ba83e86214
SHA12f61780801d657424dd891e9d72463767fd5d5fb
SHA2560503e4d5de79d2fa7a55a25e8b43d8e2bac3759365314d9bf17ed231082a5ae1
SHA5122a7bdd1bac890580ab99b2509e45fc2f0b7fcbe699ffb24d3ecdbfd406a79d6d42409f968c54f70c5eec6bd85793a52aa786d7d5a5e87e5533d84f1f95a7a4e1
-
Filesize
386KB
MD572b1c6699ddc2baab105d32761285df2
SHA1fc85e9fb190f205e6752624a5231515c4ee4e155
SHA256bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97
SHA512cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170
-
Filesize
544KB
MD540117f705bff008c3d96a73162dad044
SHA12735813836f36b5de83a745c47628053a0f61f66
SHA25632211c43bcfee2ea3ae54899af178d1fc0c2b1111b2a9e3cc3fd125e1ab7daad
SHA512eace1d55d479c4cf5692ec1dc98a6738e94874901bebe14a0a0a93eefd00fc4bd55a701e4629a1f7c47f72ac91fe3b698d590a8463119998852e05d6682f91a4
-
Filesize
544KB
MD540117f705bff008c3d96a73162dad044
SHA12735813836f36b5de83a745c47628053a0f61f66
SHA25632211c43bcfee2ea3ae54899af178d1fc0c2b1111b2a9e3cc3fd125e1ab7daad
SHA512eace1d55d479c4cf5692ec1dc98a6738e94874901bebe14a0a0a93eefd00fc4bd55a701e4629a1f7c47f72ac91fe3b698d590a8463119998852e05d6682f91a4
-
Filesize
544KB
MD540117f705bff008c3d96a73162dad044
SHA12735813836f36b5de83a745c47628053a0f61f66
SHA25632211c43bcfee2ea3ae54899af178d1fc0c2b1111b2a9e3cc3fd125e1ab7daad
SHA512eace1d55d479c4cf5692ec1dc98a6738e94874901bebe14a0a0a93eefd00fc4bd55a701e4629a1f7c47f72ac91fe3b698d590a8463119998852e05d6682f91a4
-
Filesize
278KB
MD55d7495207fbb9e5bfb0037ba83e86214
SHA12f61780801d657424dd891e9d72463767fd5d5fb
SHA2560503e4d5de79d2fa7a55a25e8b43d8e2bac3759365314d9bf17ed231082a5ae1
SHA5122a7bdd1bac890580ab99b2509e45fc2f0b7fcbe699ffb24d3ecdbfd406a79d6d42409f968c54f70c5eec6bd85793a52aa786d7d5a5e87e5533d84f1f95a7a4e1
-
Filesize
278KB
MD55d7495207fbb9e5bfb0037ba83e86214
SHA12f61780801d657424dd891e9d72463767fd5d5fb
SHA2560503e4d5de79d2fa7a55a25e8b43d8e2bac3759365314d9bf17ed231082a5ae1
SHA5122a7bdd1bac890580ab99b2509e45fc2f0b7fcbe699ffb24d3ecdbfd406a79d6d42409f968c54f70c5eec6bd85793a52aa786d7d5a5e87e5533d84f1f95a7a4e1
-
Filesize
278KB
MD55d7495207fbb9e5bfb0037ba83e86214
SHA12f61780801d657424dd891e9d72463767fd5d5fb
SHA2560503e4d5de79d2fa7a55a25e8b43d8e2bac3759365314d9bf17ed231082a5ae1
SHA5122a7bdd1bac890580ab99b2509e45fc2f0b7fcbe699ffb24d3ecdbfd406a79d6d42409f968c54f70c5eec6bd85793a52aa786d7d5a5e87e5533d84f1f95a7a4e1
-
Filesize
10.4MB
MD527c3445f5d46964e15f8358a9589dbe4
SHA14d3b42f0d82428791eea8f2a0ebd463d30df70aa
SHA2563d71f4dd329a115945231bc5abf38a0171b2561181e92eb0bf465db4589e45ca
SHA5125b4f67d10fc15a54a3103183b8548353f47599e47e4e60e64b474bdc624c0e29af39215eeeac44e7aea7a2ff7ddbe3d3199a6b950a213b7cd8be03cd88e659ed
-
Filesize
10.4MB
MD527c3445f5d46964e15f8358a9589dbe4
SHA14d3b42f0d82428791eea8f2a0ebd463d30df70aa
SHA2563d71f4dd329a115945231bc5abf38a0171b2561181e92eb0bf465db4589e45ca
SHA5125b4f67d10fc15a54a3103183b8548353f47599e47e4e60e64b474bdc624c0e29af39215eeeac44e7aea7a2ff7ddbe3d3199a6b950a213b7cd8be03cd88e659ed
-
Filesize
10.4MB
MD527c3445f5d46964e15f8358a9589dbe4
SHA14d3b42f0d82428791eea8f2a0ebd463d30df70aa
SHA2563d71f4dd329a115945231bc5abf38a0171b2561181e92eb0bf465db4589e45ca
SHA5125b4f67d10fc15a54a3103183b8548353f47599e47e4e60e64b474bdc624c0e29af39215eeeac44e7aea7a2ff7ddbe3d3199a6b950a213b7cd8be03cd88e659ed
-
Filesize
10.4MB
MD527c3445f5d46964e15f8358a9589dbe4
SHA14d3b42f0d82428791eea8f2a0ebd463d30df70aa
SHA2563d71f4dd329a115945231bc5abf38a0171b2561181e92eb0bf465db4589e45ca
SHA5125b4f67d10fc15a54a3103183b8548353f47599e47e4e60e64b474bdc624c0e29af39215eeeac44e7aea7a2ff7ddbe3d3199a6b950a213b7cd8be03cd88e659ed
-
Filesize
15.4MB
MD5cf29f092eb7d654a73236a8becbc36f6
SHA1e3cc40bfd4ec178a0285a9f8cd652f88c89eefcf
SHA25644ea5818829a2a9c69274cfdcde623466f0734dd907dd2e2273256c48d27e761
SHA512da36e9ff4b0c0db12c4747c6108aa46ad5c3ae49ac1dc6021824562bf6391dc77fd815e42a315b908a677507e9eece9c03bc09027e733d12457b56e5741a1ac8
-
Filesize
15.4MB
MD5cf29f092eb7d654a73236a8becbc36f6
SHA1e3cc40bfd4ec178a0285a9f8cd652f88c89eefcf
SHA25644ea5818829a2a9c69274cfdcde623466f0734dd907dd2e2273256c48d27e761
SHA512da36e9ff4b0c0db12c4747c6108aa46ad5c3ae49ac1dc6021824562bf6391dc77fd815e42a315b908a677507e9eece9c03bc09027e733d12457b56e5741a1ac8
-
Filesize
15.4MB
MD5cf29f092eb7d654a73236a8becbc36f6
SHA1e3cc40bfd4ec178a0285a9f8cd652f88c89eefcf
SHA25644ea5818829a2a9c69274cfdcde623466f0734dd907dd2e2273256c48d27e761
SHA512da36e9ff4b0c0db12c4747c6108aa46ad5c3ae49ac1dc6021824562bf6391dc77fd815e42a315b908a677507e9eece9c03bc09027e733d12457b56e5741a1ac8
-
Filesize
15.4MB
MD5cf29f092eb7d654a73236a8becbc36f6
SHA1e3cc40bfd4ec178a0285a9f8cd652f88c89eefcf
SHA25644ea5818829a2a9c69274cfdcde623466f0734dd907dd2e2273256c48d27e761
SHA512da36e9ff4b0c0db12c4747c6108aa46ad5c3ae49ac1dc6021824562bf6391dc77fd815e42a315b908a677507e9eece9c03bc09027e733d12457b56e5741a1ac8
-
Filesize
386KB
MD572b1c6699ddc2baab105d32761285df2
SHA1fc85e9fb190f205e6752624a5231515c4ee4e155
SHA256bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97
SHA512cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170
-
Filesize
386KB
MD572b1c6699ddc2baab105d32761285df2
SHA1fc85e9fb190f205e6752624a5231515c4ee4e155
SHA256bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97
SHA512cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170
-
Filesize
386KB
MD572b1c6699ddc2baab105d32761285df2
SHA1fc85e9fb190f205e6752624a5231515c4ee4e155
SHA256bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97
SHA512cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170
-
Filesize
544KB
MD540117f705bff008c3d96a73162dad044
SHA12735813836f36b5de83a745c47628053a0f61f66
SHA25632211c43bcfee2ea3ae54899af178d1fc0c2b1111b2a9e3cc3fd125e1ab7daad
SHA512eace1d55d479c4cf5692ec1dc98a6738e94874901bebe14a0a0a93eefd00fc4bd55a701e4629a1f7c47f72ac91fe3b698d590a8463119998852e05d6682f91a4
-
Filesize
386KB
MD572b1c6699ddc2baab105d32761285df2
SHA1fc85e9fb190f205e6752624a5231515c4ee4e155
SHA256bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97
SHA512cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170
-
Filesize
386KB
MD572b1c6699ddc2baab105d32761285df2
SHA1fc85e9fb190f205e6752624a5231515c4ee4e155
SHA256bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97
SHA512cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170
-
Filesize
386KB
MD572b1c6699ddc2baab105d32761285df2
SHA1fc85e9fb190f205e6752624a5231515c4ee4e155
SHA256bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97
SHA512cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170
-
Filesize
544KB
MD540117f705bff008c3d96a73162dad044
SHA12735813836f36b5de83a745c47628053a0f61f66
SHA25632211c43bcfee2ea3ae54899af178d1fc0c2b1111b2a9e3cc3fd125e1ab7daad
SHA512eace1d55d479c4cf5692ec1dc98a6738e94874901bebe14a0a0a93eefd00fc4bd55a701e4629a1f7c47f72ac91fe3b698d590a8463119998852e05d6682f91a4
-
Filesize
386KB
MD572b1c6699ddc2baab105d32761285df2
SHA1fc85e9fb190f205e6752624a5231515c4ee4e155
SHA256bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97
SHA512cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170
-
Filesize
162KB
MD5b4f850a62de085524b026549acbe5571
SHA1e81b3c4050e888e5556be64bbf2f53eeb75b2982
SHA256fd1fb22420abf616082c3606d76b2d7b3c500ca73ec2f893ebd7ce5f98499e18
SHA512d5c4f0d5fdddc9c7631a90237f3bb84348e5b9e201824d0c65cf9881f95fee70768f2f4c55b262cba44c20eba3e120105d513d7a838619344fddb763c96486b3
-
Filesize
278KB
MD55d7495207fbb9e5bfb0037ba83e86214
SHA12f61780801d657424dd891e9d72463767fd5d5fb
SHA2560503e4d5de79d2fa7a55a25e8b43d8e2bac3759365314d9bf17ed231082a5ae1
SHA5122a7bdd1bac890580ab99b2509e45fc2f0b7fcbe699ffb24d3ecdbfd406a79d6d42409f968c54f70c5eec6bd85793a52aa786d7d5a5e87e5533d84f1f95a7a4e1
-
Filesize
386KB
MD572b1c6699ddc2baab105d32761285df2
SHA1fc85e9fb190f205e6752624a5231515c4ee4e155
SHA256bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97
SHA512cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170
-
Filesize
544KB
MD540117f705bff008c3d96a73162dad044
SHA12735813836f36b5de83a745c47628053a0f61f66
SHA25632211c43bcfee2ea3ae54899af178d1fc0c2b1111b2a9e3cc3fd125e1ab7daad
SHA512eace1d55d479c4cf5692ec1dc98a6738e94874901bebe14a0a0a93eefd00fc4bd55a701e4629a1f7c47f72ac91fe3b698d590a8463119998852e05d6682f91a4
-
Filesize
544KB
MD540117f705bff008c3d96a73162dad044
SHA12735813836f36b5de83a745c47628053a0f61f66
SHA25632211c43bcfee2ea3ae54899af178d1fc0c2b1111b2a9e3cc3fd125e1ab7daad
SHA512eace1d55d479c4cf5692ec1dc98a6738e94874901bebe14a0a0a93eefd00fc4bd55a701e4629a1f7c47f72ac91fe3b698d590a8463119998852e05d6682f91a4
-
Filesize
278KB
MD55d7495207fbb9e5bfb0037ba83e86214
SHA12f61780801d657424dd891e9d72463767fd5d5fb
SHA2560503e4d5de79d2fa7a55a25e8b43d8e2bac3759365314d9bf17ed231082a5ae1
SHA5122a7bdd1bac890580ab99b2509e45fc2f0b7fcbe699ffb24d3ecdbfd406a79d6d42409f968c54f70c5eec6bd85793a52aa786d7d5a5e87e5533d84f1f95a7a4e1
-
Filesize
278KB
MD55d7495207fbb9e5bfb0037ba83e86214
SHA12f61780801d657424dd891e9d72463767fd5d5fb
SHA2560503e4d5de79d2fa7a55a25e8b43d8e2bac3759365314d9bf17ed231082a5ae1
SHA5122a7bdd1bac890580ab99b2509e45fc2f0b7fcbe699ffb24d3ecdbfd406a79d6d42409f968c54f70c5eec6bd85793a52aa786d7d5a5e87e5533d84f1f95a7a4e1