Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
18/11/2023, 05:24
Behavioral task
behavioral1
Sample
NEAS.0860c3278fa13e6dbbaafdb34fb63650.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.0860c3278fa13e6dbbaafdb34fb63650.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.0860c3278fa13e6dbbaafdb34fb63650.exe
-
Size
96KB
-
MD5
0860c3278fa13e6dbbaafdb34fb63650
-
SHA1
7750c3c694f0734cac592a74751361197e06daf8
-
SHA256
08f2f17b0528a1e93b1ccd51320cec7a5400a7fc854beb1f9c72545b1ae6f574
-
SHA512
2d1d88c4f87030e1dce0f2057cb72f5648e206ce03fee1bea67972165262b83ddc0f87026bb38428014e017e4ddfd3ad9031e772b5a3f585ae54bc61b4caff82
-
SSDEEP
1536:+E4k52g409tv5gaEsqtmwNM73cv0S2nriDcm/WnufuEeTVHzg5ZMAPgnDNBrcN4v:+Ex2gJDR+tH2nuIm/PfiiMAPgxed6BYY
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nmnace32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kegqdqbl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Legmbd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mieeibkn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ikfmfi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ngdifkpi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ndhipoob.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Igchlf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jofbag32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jnmlhchd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kkjcplpa.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Npagjpcd.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Inifnq32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jofbag32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lclnemgd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Moanaiie.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ipjoplgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ioolqh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jcjdpj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lcagpl32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Linphc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mkhofjoj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Npagjpcd.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad NEAS.0860c3278fa13e6dbbaafdb34fb63650.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jocflgga.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kbfhbeek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lclnemgd.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Inkccpgk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kconkibf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mencccop.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ngdifkpi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kegqdqbl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nekbmgcn.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jchhkjhn.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jcjdpj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lcfqkl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mooaljkh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Inifnq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jjpcbe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mffimglk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jdpndnei.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lcagpl32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lcfqkl32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mooaljkh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mmihhelk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Niebhf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kbfhbeek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Knmhgf32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lfmffhde.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mdacop32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ncmfqkdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jnmlhchd.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kkjcplpa.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Knmhgf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ncmfqkdj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mffimglk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mkhofjoj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mmldme32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jchhkjhn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lfmffhde.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mieeibkn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ipjoplgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jdbkjn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Linphc32.exe -
Malware Backdoor - Berbew 64 IoCs
Berbew is a malware infection classified as a 'backdoor' Trojan. This malicious program's primary function is to cause chain infections - it can download/install additional malware such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral1/files/0x00060000000120bd-5.dat family_berbew behavioral1/memory/1244-0-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral1/memory/1244-6-0x0000000000220000-0x0000000000264000-memory.dmp family_berbew behavioral1/files/0x00060000000120bd-8.dat family_berbew behavioral1/files/0x00060000000120bd-13.dat family_berbew behavioral1/files/0x00060000000120bd-12.dat family_berbew behavioral1/files/0x00060000000120bd-9.dat family_berbew behavioral1/files/0x002700000001659d-26.dat family_berbew behavioral1/memory/2664-38-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral1/files/0x0007000000016ca2-39.dat family_berbew behavioral1/files/0x0007000000016ca2-37.dat family_berbew behavioral1/files/0x0007000000016ca2-34.dat family_berbew behavioral1/files/0x0007000000016ca2-33.dat family_berbew behavioral1/files/0x0009000000016cde-50.dat family_berbew behavioral1/files/0x0009000000016cde-47.dat family_berbew behavioral1/files/0x0009000000016cde-46.dat family_berbew behavioral1/files/0x0009000000016cde-44.dat family_berbew behavioral1/files/0x0007000000016ca2-31.dat family_berbew behavioral1/files/0x002700000001659d-24.dat family_berbew behavioral1/files/0x002700000001659d-21.dat family_berbew behavioral1/files/0x002700000001659d-20.dat family_berbew behavioral1/files/0x002700000001659d-18.dat family_berbew behavioral1/memory/2776-51-0x0000000000220000-0x0000000000264000-memory.dmp family_berbew behavioral1/files/0x0009000000016cde-52.dat family_berbew behavioral1/memory/2776-58-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral1/memory/2832-57-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral1/files/0x0006000000016d2e-59.dat family_berbew behavioral1/files/0x0006000000016d2e-61.dat family_berbew behavioral1/files/0x0006000000016d2e-62.dat family_berbew behavioral1/files/0x0006000000016d2e-65.dat family_berbew behavioral1/files/0x0006000000016d2e-67.dat family_berbew behavioral1/memory/2596-66-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral1/files/0x0006000000016d4c-72.dat family_berbew behavioral1/memory/2596-74-0x00000000002A0000-0x00000000002E4000-memory.dmp family_berbew behavioral1/files/0x0006000000016d4c-76.dat family_berbew behavioral1/files/0x0006000000016d4c-79.dat family_berbew behavioral1/files/0x0006000000016d4c-75.dat family_berbew behavioral1/files/0x0006000000016d4c-80.dat family_berbew behavioral1/files/0x0006000000016d6c-85.dat family_berbew behavioral1/files/0x0006000000016d6c-88.dat family_berbew behavioral1/memory/2792-87-0x0000000000230000-0x0000000000274000-memory.dmp family_berbew behavioral1/files/0x0006000000016d6c-92.dat family_berbew behavioral1/files/0x0006000000016d6c-93.dat family_berbew behavioral1/files/0x0006000000016d6c-90.dat family_berbew behavioral1/files/0x0006000000016d7d-98.dat family_berbew behavioral1/files/0x0006000000016d7d-100.dat family_berbew behavioral1/files/0x0006000000016d7d-101.dat family_berbew behavioral1/files/0x0006000000016d7d-104.dat family_berbew behavioral1/memory/2552-105-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral1/files/0x0006000000016d7d-106.dat family_berbew behavioral1/files/0x0006000000016fde-111.dat family_berbew behavioral1/files/0x0006000000016fde-119.dat family_berbew behavioral1/memory/2552-118-0x0000000000220000-0x0000000000264000-memory.dmp family_berbew behavioral1/files/0x0006000000016fde-116.dat family_berbew behavioral1/files/0x0006000000016fde-114.dat family_berbew behavioral1/files/0x00060000000170ff-128.dat family_berbew behavioral1/files/0x0006000000017581-144.dat family_berbew behavioral1/files/0x00050000000186c5-154.dat family_berbew behavioral1/memory/2916-158-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral1/files/0x0006000000018b10-170.dat family_berbew behavioral1/files/0x0006000000018b39-180.dat family_berbew behavioral1/memory/1568-184-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral1/files/0x0027000000016619-196.dat family_berbew behavioral1/files/0x0006000000018b70-203.dat family_berbew -
Executes dropped EXE 50 IoCs
pid Process 2332 Inifnq32.exe 2664 Inkccpgk.exe 2776 Ipjoplgo.exe 2832 Igchlf32.exe 2596 Ioolqh32.exe 2792 Ikfmfi32.exe 2648 Jocflgga.exe 2552 Jdpndnei.exe 464 Jofbag32.exe 1340 Jdbkjn32.exe 3020 Jjpcbe32.exe 2916 Jchhkjhn.exe 2872 Jnmlhchd.exe 1568 Jcjdpj32.exe 1760 Jqnejn32.exe 988 Kjfjbdle.exe 1520 Kconkibf.exe 640 Kkjcplpa.exe 1800 Kbfhbeek.exe 832 Kgcpjmcb.exe 1560 Knmhgf32.exe 1300 Kegqdqbl.exe 1224 Kgemplap.exe 2372 Lclnemgd.exe 2460 Lfmffhde.exe 692 Lcagpl32.exe 884 Linphc32.exe 2160 Lcfqkl32.exe 2340 Legmbd32.exe 1712 Mooaljkh.exe 2356 Mffimglk.exe 2780 Mieeibkn.exe 2840 Mlcbenjb.exe 3012 Moanaiie.exe 2568 Mkhofjoj.exe 2280 Mencccop.exe 524 Mdacop32.exe 2856 Mmihhelk.exe 1112 Mmldme32.exe 2968 Ngdifkpi.exe 2904 Nmnace32.exe 2948 Ndhipoob.exe 1580 Niebhf32.exe 1136 Npojdpef.exe 1220 Ncmfqkdj.exe 1640 Nekbmgcn.exe 2024 Nlekia32.exe 996 Npagjpcd.exe 1160 Ngkogj32.exe 1780 Nlhgoqhh.exe -
Loads dropped DLL 64 IoCs
pid Process 1244 NEAS.0860c3278fa13e6dbbaafdb34fb63650.exe 1244 NEAS.0860c3278fa13e6dbbaafdb34fb63650.exe 2332 Inifnq32.exe 2332 Inifnq32.exe 2664 Inkccpgk.exe 2664 Inkccpgk.exe 2776 Ipjoplgo.exe 2776 Ipjoplgo.exe 2832 Igchlf32.exe 2832 Igchlf32.exe 2596 Ioolqh32.exe 2596 Ioolqh32.exe 2792 Ikfmfi32.exe 2792 Ikfmfi32.exe 2648 Jocflgga.exe 2648 Jocflgga.exe 2552 Jdpndnei.exe 2552 Jdpndnei.exe 464 Jofbag32.exe 464 Jofbag32.exe 1340 Jdbkjn32.exe 1340 Jdbkjn32.exe 3020 Jjpcbe32.exe 3020 Jjpcbe32.exe 2916 Jchhkjhn.exe 2916 Jchhkjhn.exe 2872 Jnmlhchd.exe 2872 Jnmlhchd.exe 1568 Jcjdpj32.exe 1568 Jcjdpj32.exe 1760 Jqnejn32.exe 1760 Jqnejn32.exe 988 Kjfjbdle.exe 988 Kjfjbdle.exe 1520 Kconkibf.exe 1520 Kconkibf.exe 640 Kkjcplpa.exe 640 Kkjcplpa.exe 1800 Kbfhbeek.exe 1800 Kbfhbeek.exe 832 Kgcpjmcb.exe 832 Kgcpjmcb.exe 1560 Knmhgf32.exe 1560 Knmhgf32.exe 1300 Kegqdqbl.exe 1300 Kegqdqbl.exe 1224 Kgemplap.exe 1224 Kgemplap.exe 2372 Lclnemgd.exe 2372 Lclnemgd.exe 2460 Lfmffhde.exe 2460 Lfmffhde.exe 692 Lcagpl32.exe 692 Lcagpl32.exe 884 Linphc32.exe 884 Linphc32.exe 2160 Lcfqkl32.exe 2160 Lcfqkl32.exe 2340 Legmbd32.exe 2340 Legmbd32.exe 1712 Mooaljkh.exe 1712 Mooaljkh.exe 2356 Mffimglk.exe 2356 Mffimglk.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Cogbjdmj.dll Ikfmfi32.exe File created C:\Windows\SysWOW64\Kjfjbdle.exe Jqnejn32.exe File opened for modification C:\Windows\SysWOW64\Kkjcplpa.exe Kconkibf.exe File created C:\Windows\SysWOW64\Allepo32.dll Kegqdqbl.exe File created C:\Windows\SysWOW64\Nqdgapkm.dll Jjpcbe32.exe File created C:\Windows\SysWOW64\Jqnejn32.exe Jcjdpj32.exe File created C:\Windows\SysWOW64\Knmhgf32.exe Kgcpjmcb.exe File opened for modification C:\Windows\SysWOW64\Nmnace32.exe Ngdifkpi.exe File opened for modification C:\Windows\SysWOW64\Moanaiie.exe Mlcbenjb.exe File created C:\Windows\SysWOW64\Hendhe32.dll Mkhofjoj.exe File created C:\Windows\SysWOW64\Pdlbongd.dll Mencccop.exe File opened for modification C:\Windows\SysWOW64\Igchlf32.exe Ipjoplgo.exe File created C:\Windows\SysWOW64\Kkjcplpa.exe Kconkibf.exe File created C:\Windows\SysWOW64\Negoebdd.dll Linphc32.exe File created C:\Windows\SysWOW64\Ibddljof.dll Lcfqkl32.exe File created C:\Windows\SysWOW64\Mieeibkn.exe Mffimglk.exe File created C:\Windows\SysWOW64\Mmihhelk.exe Mdacop32.exe File created C:\Windows\SysWOW64\Cgmgbeon.dll Mmihhelk.exe File created C:\Windows\SysWOW64\Nlhgoqhh.exe Ngkogj32.exe File created C:\Windows\SysWOW64\Inkccpgk.exe Inifnq32.exe File opened for modification C:\Windows\SysWOW64\Mlcbenjb.exe Mieeibkn.exe File created C:\Windows\SysWOW64\Ncmfqkdj.exe Npojdpef.exe File created C:\Windows\SysWOW64\Pjclpeak.dll Ncmfqkdj.exe File created C:\Windows\SysWOW64\Nmgpon32.dll Inkccpgk.exe File opened for modification C:\Windows\SysWOW64\Ioolqh32.exe Igchlf32.exe File opened for modification C:\Windows\SysWOW64\Kegqdqbl.exe Knmhgf32.exe File created C:\Windows\SysWOW64\Gpbgnedh.dll Mlcbenjb.exe File created C:\Windows\SysWOW64\Ngdifkpi.exe Mmldme32.exe File opened for modification C:\Windows\SysWOW64\Jocflgga.exe Ikfmfi32.exe File created C:\Windows\SysWOW64\Ibcidp32.dll Kjfjbdle.exe File created C:\Windows\SysWOW64\Ihlfca32.dll Knmhgf32.exe File created C:\Windows\SysWOW64\Aaebnq32.dll Lcagpl32.exe File created C:\Windows\SysWOW64\Mkhofjoj.exe Moanaiie.exe File created C:\Windows\SysWOW64\Afcklihm.dll Ipjoplgo.exe File created C:\Windows\SysWOW64\Hnepch32.dll Jofbag32.exe File created C:\Windows\SysWOW64\Pbefefec.dll Kconkibf.exe File created C:\Windows\SysWOW64\Bjdmohgl.dll Lclnemgd.exe File created C:\Windows\SysWOW64\Kgdjgo32.dll Npojdpef.exe File created C:\Windows\SysWOW64\Jdpndnei.exe Jocflgga.exe File created C:\Windows\SysWOW64\Mjbkcgmo.dll Jdbkjn32.exe File created C:\Windows\SysWOW64\Ombhbhel.dll Mieeibkn.exe File opened for modification C:\Windows\SysWOW64\Mdacop32.exe Mencccop.exe File opened for modification C:\Windows\SysWOW64\Lcagpl32.exe Lfmffhde.exe File created C:\Windows\SysWOW64\Npagjpcd.exe Nlekia32.exe File created C:\Windows\SysWOW64\Mbbcbk32.dll NEAS.0860c3278fa13e6dbbaafdb34fb63650.exe File created C:\Windows\SysWOW64\Ioolqh32.exe Igchlf32.exe File created C:\Windows\SysWOW64\Jchhkjhn.exe Jjpcbe32.exe File opened for modification C:\Windows\SysWOW64\Jqnejn32.exe Jcjdpj32.exe File created C:\Windows\SysWOW64\Akbipbbd.dll Jcjdpj32.exe File created C:\Windows\SysWOW64\Mooaljkh.exe Legmbd32.exe File created C:\Windows\SysWOW64\Nkeghkck.dll Mdacop32.exe File opened for modification C:\Windows\SysWOW64\Npagjpcd.exe Nlekia32.exe File opened for modification C:\Windows\SysWOW64\Kconkibf.exe Kjfjbdle.exe File opened for modification C:\Windows\SysWOW64\Mmihhelk.exe Mdacop32.exe File opened for modification C:\Windows\SysWOW64\Ndhipoob.exe Nmnace32.exe File opened for modification C:\Windows\SysWOW64\Jcjdpj32.exe Jnmlhchd.exe File created C:\Windows\SysWOW64\Hloopaak.dll Kbfhbeek.exe File created C:\Windows\SysWOW64\Lnlmhpjh.dll Moanaiie.exe File created C:\Windows\SysWOW64\Nmnace32.exe Ngdifkpi.exe File created C:\Windows\SysWOW64\Kklcab32.dll Npagjpcd.exe File opened for modification C:\Windows\SysWOW64\Lfmffhde.exe Lclnemgd.exe File opened for modification C:\Windows\SysWOW64\Ngdifkpi.exe Mmldme32.exe File created C:\Windows\SysWOW64\Nlekia32.exe Nekbmgcn.exe File created C:\Windows\SysWOW64\Lamajm32.dll Ngkogj32.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1544 1780 WerFault.exe 77 -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mkhofjoj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mmldme32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jdpndnei.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kkjcplpa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kjfjbdle.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nmnace32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kklcab32.dll" Npagjpcd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738} NEAS.0860c3278fa13e6dbbaafdb34fb63650.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jqnejn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fibkpd32.dll" Ngdifkpi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kconkibf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Legmbd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Knmhgf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mmihhelk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Enlejpga.dll" Jqnejn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hkeapk32.dll" Kgcpjmcb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hloopaak.dll" Kbfhbeek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lcfqkl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nmnace32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eqnolc32.dll" Niebhf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ipjoplgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ikfmfi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pghhkllb.dll" Kgemplap.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Linphc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akbipbbd.dll" Jcjdpj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kjfjbdle.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mmihhelk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ngdifkpi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pbefefec.dll" Kconkibf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lclnemgd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ndhipoob.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nekbmgcn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ipjoplgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cogbjdmj.dll" Ikfmfi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibddljof.dll" Lcfqkl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ngdifkpi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ioolqh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bjdmohgl.dll" Lclnemgd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lonjma32.dll" Igchlf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ikfmfi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Negoebdd.dll" Linphc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mmldme32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egnhob32.dll" Nmnace32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjclpeak.dll" Ncmfqkdj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 NEAS.0860c3278fa13e6dbbaafdb34fb63650.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Inkccpgk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jocflgga.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fcihoc32.dll" Ndhipoob.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jjpcbe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kconkibf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kkjcplpa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lfmffhde.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mieeibkn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdlbongd.dll" Mencccop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnepch32.dll" Jofbag32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nqdgapkm.dll" Jjpcbe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gpbgnedh.dll" Mlcbenjb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Npagjpcd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mbbcbk32.dll" NEAS.0860c3278fa13e6dbbaafdb34fb63650.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Inkccpgk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jqnejn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Linphc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jocflgga.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjbkcgmo.dll" Jdbkjn32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1244 wrote to memory of 2332 1244 NEAS.0860c3278fa13e6dbbaafdb34fb63650.exe 28 PID 1244 wrote to memory of 2332 1244 NEAS.0860c3278fa13e6dbbaafdb34fb63650.exe 28 PID 1244 wrote to memory of 2332 1244 NEAS.0860c3278fa13e6dbbaafdb34fb63650.exe 28 PID 1244 wrote to memory of 2332 1244 NEAS.0860c3278fa13e6dbbaafdb34fb63650.exe 28 PID 2332 wrote to memory of 2664 2332 Inifnq32.exe 31 PID 2332 wrote to memory of 2664 2332 Inifnq32.exe 31 PID 2332 wrote to memory of 2664 2332 Inifnq32.exe 31 PID 2332 wrote to memory of 2664 2332 Inifnq32.exe 31 PID 2664 wrote to memory of 2776 2664 Inkccpgk.exe 30 PID 2664 wrote to memory of 2776 2664 Inkccpgk.exe 30 PID 2664 wrote to memory of 2776 2664 Inkccpgk.exe 30 PID 2664 wrote to memory of 2776 2664 Inkccpgk.exe 30 PID 2776 wrote to memory of 2832 2776 Ipjoplgo.exe 29 PID 2776 wrote to memory of 2832 2776 Ipjoplgo.exe 29 PID 2776 wrote to memory of 2832 2776 Ipjoplgo.exe 29 PID 2776 wrote to memory of 2832 2776 Ipjoplgo.exe 29 PID 2832 wrote to memory of 2596 2832 Igchlf32.exe 32 PID 2832 wrote to memory of 2596 2832 Igchlf32.exe 32 PID 2832 wrote to memory of 2596 2832 Igchlf32.exe 32 PID 2832 wrote to memory of 2596 2832 Igchlf32.exe 32 PID 2596 wrote to memory of 2792 2596 Ioolqh32.exe 33 PID 2596 wrote to memory of 2792 2596 Ioolqh32.exe 33 PID 2596 wrote to memory of 2792 2596 Ioolqh32.exe 33 PID 2596 wrote to memory of 2792 2596 Ioolqh32.exe 33 PID 2792 wrote to memory of 2648 2792 Ikfmfi32.exe 34 PID 2792 wrote to memory of 2648 2792 Ikfmfi32.exe 34 PID 2792 wrote to memory of 2648 2792 Ikfmfi32.exe 34 PID 2792 wrote to memory of 2648 2792 Ikfmfi32.exe 34 PID 2648 wrote to memory of 2552 2648 Jocflgga.exe 35 PID 2648 wrote to memory of 2552 2648 Jocflgga.exe 35 PID 2648 wrote to memory of 2552 2648 Jocflgga.exe 35 PID 2648 wrote to memory of 2552 2648 Jocflgga.exe 35 PID 2552 wrote to memory of 464 2552 Jdpndnei.exe 36 PID 2552 wrote to memory of 464 2552 Jdpndnei.exe 36 PID 2552 wrote to memory of 464 2552 Jdpndnei.exe 36 PID 2552 wrote to memory of 464 2552 Jdpndnei.exe 36 PID 464 wrote to memory of 1340 464 Jofbag32.exe 37 PID 464 wrote to memory of 1340 464 Jofbag32.exe 37 PID 464 wrote to memory of 1340 464 Jofbag32.exe 37 PID 464 wrote to memory of 1340 464 Jofbag32.exe 37 PID 1340 wrote to memory of 3020 1340 Jdbkjn32.exe 38 PID 1340 wrote to memory of 3020 1340 Jdbkjn32.exe 38 PID 1340 wrote to memory of 3020 1340 Jdbkjn32.exe 38 PID 1340 wrote to memory of 3020 1340 Jdbkjn32.exe 38 PID 3020 wrote to memory of 2916 3020 Jjpcbe32.exe 39 PID 3020 wrote to memory of 2916 3020 Jjpcbe32.exe 39 PID 3020 wrote to memory of 2916 3020 Jjpcbe32.exe 39 PID 3020 wrote to memory of 2916 3020 Jjpcbe32.exe 39 PID 2916 wrote to memory of 2872 2916 Jchhkjhn.exe 51 PID 2916 wrote to memory of 2872 2916 Jchhkjhn.exe 51 PID 2916 wrote to memory of 2872 2916 Jchhkjhn.exe 51 PID 2916 wrote to memory of 2872 2916 Jchhkjhn.exe 51 PID 2872 wrote to memory of 1568 2872 Jnmlhchd.exe 48 PID 2872 wrote to memory of 1568 2872 Jnmlhchd.exe 48 PID 2872 wrote to memory of 1568 2872 Jnmlhchd.exe 48 PID 2872 wrote to memory of 1568 2872 Jnmlhchd.exe 48 PID 1568 wrote to memory of 1760 1568 Jcjdpj32.exe 47 PID 1568 wrote to memory of 1760 1568 Jcjdpj32.exe 47 PID 1568 wrote to memory of 1760 1568 Jcjdpj32.exe 47 PID 1568 wrote to memory of 1760 1568 Jcjdpj32.exe 47 PID 1760 wrote to memory of 988 1760 Jqnejn32.exe 46 PID 1760 wrote to memory of 988 1760 Jqnejn32.exe 46 PID 1760 wrote to memory of 988 1760 Jqnejn32.exe 46 PID 1760 wrote to memory of 988 1760 Jqnejn32.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.0860c3278fa13e6dbbaafdb34fb63650.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.0860c3278fa13e6dbbaafdb34fb63650.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Windows\SysWOW64\Inifnq32.exeC:\Windows\system32\Inifnq32.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Windows\SysWOW64\Inkccpgk.exeC:\Windows\system32\Inkccpgk.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2664
-
-
-
C:\Windows\SysWOW64\Igchlf32.exeC:\Windows\system32\Igchlf32.exe1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Windows\SysWOW64\Ioolqh32.exeC:\Windows\system32\Ioolqh32.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\SysWOW64\Ikfmfi32.exeC:\Windows\system32\Ikfmfi32.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\SysWOW64\Jocflgga.exeC:\Windows\system32\Jocflgga.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\SysWOW64\Jdpndnei.exeC:\Windows\system32\Jdpndnei.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\SysWOW64\Jofbag32.exeC:\Windows\system32\Jofbag32.exe6⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Windows\SysWOW64\Jdbkjn32.exeC:\Windows\system32\Jdbkjn32.exe7⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Windows\SysWOW64\Jjpcbe32.exeC:\Windows\system32\Jjpcbe32.exe8⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\SysWOW64\Jchhkjhn.exeC:\Windows\system32\Jchhkjhn.exe9⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\SysWOW64\Jnmlhchd.exeC:\Windows\system32\Jnmlhchd.exe10⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2872
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\Ipjoplgo.exeC:\Windows\system32\Ipjoplgo.exe1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2776
-
C:\Windows\SysWOW64\Kconkibf.exeC:\Windows\system32\Kconkibf.exe1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:1520 -
C:\Windows\SysWOW64\Kkjcplpa.exeC:\Windows\system32\Kkjcplpa.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:640
-
-
C:\Windows\SysWOW64\Kbfhbeek.exeC:\Windows\system32\Kbfhbeek.exe1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:1800 -
C:\Windows\SysWOW64\Kgcpjmcb.exeC:\Windows\system32\Kgcpjmcb.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:832 -
C:\Windows\SysWOW64\Knmhgf32.exeC:\Windows\system32\Knmhgf32.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:1560 -
C:\Windows\SysWOW64\Kegqdqbl.exeC:\Windows\system32\Kegqdqbl.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1300 -
C:\Windows\SysWOW64\Kgemplap.exeC:\Windows\system32\Kgemplap.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:1224
-
-
-
-
-
C:\Windows\SysWOW64\Kjfjbdle.exeC:\Windows\system32\Kjfjbdle.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:988
-
C:\Windows\SysWOW64\Jqnejn32.exeC:\Windows\system32\Jqnejn32.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1760
-
C:\Windows\SysWOW64\Jcjdpj32.exeC:\Windows\system32\Jcjdpj32.exe1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1568
-
C:\Windows\SysWOW64\Lclnemgd.exeC:\Windows\system32\Lclnemgd.exe1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:2372 -
C:\Windows\SysWOW64\Lfmffhde.exeC:\Windows\system32\Lfmffhde.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:2460 -
C:\Windows\SysWOW64\Lcagpl32.exeC:\Windows\system32\Lcagpl32.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:692 -
C:\Windows\SysWOW64\Linphc32.exeC:\Windows\system32\Linphc32.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:884 -
C:\Windows\SysWOW64\Lcfqkl32.exeC:\Windows\system32\Lcfqkl32.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:2160 -
C:\Windows\SysWOW64\Legmbd32.exeC:\Windows\system32\Legmbd32.exe6⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:2340 -
C:\Windows\SysWOW64\Mooaljkh.exeC:\Windows\system32\Mooaljkh.exe7⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:1712 -
C:\Windows\SysWOW64\Mffimglk.exeC:\Windows\system32\Mffimglk.exe8⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2356 -
C:\Windows\SysWOW64\Mieeibkn.exeC:\Windows\system32\Mieeibkn.exe9⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2780 -
C:\Windows\SysWOW64\Mlcbenjb.exeC:\Windows\system32\Mlcbenjb.exe10⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2840
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\Moanaiie.exeC:\Windows\system32\Moanaiie.exe1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:3012 -
C:\Windows\SysWOW64\Mkhofjoj.exeC:\Windows\system32\Mkhofjoj.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2568 -
C:\Windows\SysWOW64\Mencccop.exeC:\Windows\system32\Mencccop.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2280
-
-
-
C:\Windows\SysWOW64\Mdacop32.exeC:\Windows\system32\Mdacop32.exe1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:524 -
C:\Windows\SysWOW64\Mmihhelk.exeC:\Windows\system32\Mmihhelk.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2856 -
C:\Windows\SysWOW64\Mmldme32.exeC:\Windows\system32\Mmldme32.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1112 -
C:\Windows\SysWOW64\Ngdifkpi.exeC:\Windows\system32\Ngdifkpi.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2968 -
C:\Windows\SysWOW64\Nmnace32.exeC:\Windows\system32\Nmnace32.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2904 -
C:\Windows\SysWOW64\Ndhipoob.exeC:\Windows\system32\Ndhipoob.exe6⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:2948 -
C:\Windows\SysWOW64\Niebhf32.exeC:\Windows\system32\Niebhf32.exe7⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:1580 -
C:\Windows\SysWOW64\Npojdpef.exeC:\Windows\system32\Npojdpef.exe8⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1136 -
C:\Windows\SysWOW64\Ncmfqkdj.exeC:\Windows\system32\Ncmfqkdj.exe9⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1220 -
C:\Windows\SysWOW64\Nekbmgcn.exeC:\Windows\system32\Nekbmgcn.exe10⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1640 -
C:\Windows\SysWOW64\Nlekia32.exeC:\Windows\system32\Nlekia32.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2024 -
C:\Windows\SysWOW64\Npagjpcd.exeC:\Windows\system32\Npagjpcd.exe12⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:996 -
C:\Windows\SysWOW64\Ngkogj32.exeC:\Windows\system32\Ngkogj32.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1160 -
C:\Windows\SysWOW64\Nlhgoqhh.exeC:\Windows\system32\Nlhgoqhh.exe14⤵
- Executes dropped EXE
PID:1780 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 14015⤵
- Program crash
PID:1544
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB
MD544037ec284729093f86956717db7144a
SHA1a2c94f004577febfc0964f33e7b32e3ed004d577
SHA2565aa81b5453712bcaff68923b1a6aed5e29daedfd030b6d560fa9d829f7d6b465
SHA512ccfd933ad2e062e1261192ec754d27a3741c0050c8a057f1525d26f099ae17af397f1b4aa98a4929460ac235e82d4271d0b948dc6031a14389f5f8dad57ab459
-
Filesize
96KB
MD544037ec284729093f86956717db7144a
SHA1a2c94f004577febfc0964f33e7b32e3ed004d577
SHA2565aa81b5453712bcaff68923b1a6aed5e29daedfd030b6d560fa9d829f7d6b465
SHA512ccfd933ad2e062e1261192ec754d27a3741c0050c8a057f1525d26f099ae17af397f1b4aa98a4929460ac235e82d4271d0b948dc6031a14389f5f8dad57ab459
-
Filesize
96KB
MD544037ec284729093f86956717db7144a
SHA1a2c94f004577febfc0964f33e7b32e3ed004d577
SHA2565aa81b5453712bcaff68923b1a6aed5e29daedfd030b6d560fa9d829f7d6b465
SHA512ccfd933ad2e062e1261192ec754d27a3741c0050c8a057f1525d26f099ae17af397f1b4aa98a4929460ac235e82d4271d0b948dc6031a14389f5f8dad57ab459
-
Filesize
96KB
MD543ae028f7333cdad609f005242a4c96a
SHA1c3eaf7c81319ce6f121fe8e4a4bd04434d7264c5
SHA256809c0d23898a5dab5ec5794ed62d4badc88bcb09e25c4ee4f2601e4df3d078be
SHA512597bb56477ecde62db86b4ad65bbe1fa9e71f0b47fa627280a068eb43a675c6f569c029665963a334938c84e0ada6b31b4e6536f5bbf7e827e27dd14ee3ce95d
-
Filesize
96KB
MD543ae028f7333cdad609f005242a4c96a
SHA1c3eaf7c81319ce6f121fe8e4a4bd04434d7264c5
SHA256809c0d23898a5dab5ec5794ed62d4badc88bcb09e25c4ee4f2601e4df3d078be
SHA512597bb56477ecde62db86b4ad65bbe1fa9e71f0b47fa627280a068eb43a675c6f569c029665963a334938c84e0ada6b31b4e6536f5bbf7e827e27dd14ee3ce95d
-
Filesize
96KB
MD543ae028f7333cdad609f005242a4c96a
SHA1c3eaf7c81319ce6f121fe8e4a4bd04434d7264c5
SHA256809c0d23898a5dab5ec5794ed62d4badc88bcb09e25c4ee4f2601e4df3d078be
SHA512597bb56477ecde62db86b4ad65bbe1fa9e71f0b47fa627280a068eb43a675c6f569c029665963a334938c84e0ada6b31b4e6536f5bbf7e827e27dd14ee3ce95d
-
Filesize
96KB
MD5b49a081d2cc64f63a685687bcec311f1
SHA10a2527361b24d73c5486929ac8a3a684b3c7793e
SHA2565c8c4255ed37e847b4729794a7568ed8620275049ca080576ae429b6b6622dd5
SHA512a86318edb91ea156910f5fbc9fe1715961022449a6e435bd5f52feec47cfdc37948901ada342a4d23ef5e67c74aab76863efd71622c297f265bcd5f94f4e4b43
-
Filesize
96KB
MD5b49a081d2cc64f63a685687bcec311f1
SHA10a2527361b24d73c5486929ac8a3a684b3c7793e
SHA2565c8c4255ed37e847b4729794a7568ed8620275049ca080576ae429b6b6622dd5
SHA512a86318edb91ea156910f5fbc9fe1715961022449a6e435bd5f52feec47cfdc37948901ada342a4d23ef5e67c74aab76863efd71622c297f265bcd5f94f4e4b43
-
Filesize
96KB
MD5b49a081d2cc64f63a685687bcec311f1
SHA10a2527361b24d73c5486929ac8a3a684b3c7793e
SHA2565c8c4255ed37e847b4729794a7568ed8620275049ca080576ae429b6b6622dd5
SHA512a86318edb91ea156910f5fbc9fe1715961022449a6e435bd5f52feec47cfdc37948901ada342a4d23ef5e67c74aab76863efd71622c297f265bcd5f94f4e4b43
-
Filesize
96KB
MD5701059b3ee419bef3df3520a2c694cae
SHA102a0374003a35e7c58015eee170eb45b269011de
SHA2568478d4a2335174bfcbc37d49c3b7892d9ab9a9fd5e318c1164f801cbe0affa9e
SHA5129b6019ace4f803da988d97beeabefdf02a1cd2a47917ab6d91d6466eb7d6cad145c35d6ee87e151acb7a107c8cb9fc0009cef9e40e88d7b6a47fd5bd2fec35ce
-
Filesize
96KB
MD5701059b3ee419bef3df3520a2c694cae
SHA102a0374003a35e7c58015eee170eb45b269011de
SHA2568478d4a2335174bfcbc37d49c3b7892d9ab9a9fd5e318c1164f801cbe0affa9e
SHA5129b6019ace4f803da988d97beeabefdf02a1cd2a47917ab6d91d6466eb7d6cad145c35d6ee87e151acb7a107c8cb9fc0009cef9e40e88d7b6a47fd5bd2fec35ce
-
Filesize
96KB
MD5701059b3ee419bef3df3520a2c694cae
SHA102a0374003a35e7c58015eee170eb45b269011de
SHA2568478d4a2335174bfcbc37d49c3b7892d9ab9a9fd5e318c1164f801cbe0affa9e
SHA5129b6019ace4f803da988d97beeabefdf02a1cd2a47917ab6d91d6466eb7d6cad145c35d6ee87e151acb7a107c8cb9fc0009cef9e40e88d7b6a47fd5bd2fec35ce
-
Filesize
96KB
MD56fbce06dab273c9566234d663abb6b64
SHA1c9f5577ba734ade0f4f670f3aad50cdcb3bc9082
SHA25699830befa97fd15d4b7035afc98eef0ccaf8e1f0ea0e27a257fc0a745500cf79
SHA512f897e840254547da2c7057f05b4c81c2d538ad6f32d9af94bf3edd5bea54b4cfcba2f6c9ce2c84e0c5d4192a922bfada44311a169b335021e0ade425c5195645
-
Filesize
96KB
MD56fbce06dab273c9566234d663abb6b64
SHA1c9f5577ba734ade0f4f670f3aad50cdcb3bc9082
SHA25699830befa97fd15d4b7035afc98eef0ccaf8e1f0ea0e27a257fc0a745500cf79
SHA512f897e840254547da2c7057f05b4c81c2d538ad6f32d9af94bf3edd5bea54b4cfcba2f6c9ce2c84e0c5d4192a922bfada44311a169b335021e0ade425c5195645
-
Filesize
96KB
MD56fbce06dab273c9566234d663abb6b64
SHA1c9f5577ba734ade0f4f670f3aad50cdcb3bc9082
SHA25699830befa97fd15d4b7035afc98eef0ccaf8e1f0ea0e27a257fc0a745500cf79
SHA512f897e840254547da2c7057f05b4c81c2d538ad6f32d9af94bf3edd5bea54b4cfcba2f6c9ce2c84e0c5d4192a922bfada44311a169b335021e0ade425c5195645
-
Filesize
96KB
MD5508c41fa9cd74f489c0c40f6d1254115
SHA14f01665f0e6fed9690aca9b55c5d7eceee58f21e
SHA2563160830ffd61f0d5d3912881ad7c0927aec378e2ff680c29e0937eb5d4cfa5dd
SHA512c61e7e3391df5fc04c966ac8ea71385ffa664f8ffe743c26c06ef9d5597d0ce5858192a4d68caa6e010ab2d534c288e2a16e84ea2c46a785a7106fa008ef6f01
-
Filesize
96KB
MD5508c41fa9cd74f489c0c40f6d1254115
SHA14f01665f0e6fed9690aca9b55c5d7eceee58f21e
SHA2563160830ffd61f0d5d3912881ad7c0927aec378e2ff680c29e0937eb5d4cfa5dd
SHA512c61e7e3391df5fc04c966ac8ea71385ffa664f8ffe743c26c06ef9d5597d0ce5858192a4d68caa6e010ab2d534c288e2a16e84ea2c46a785a7106fa008ef6f01
-
Filesize
96KB
MD5508c41fa9cd74f489c0c40f6d1254115
SHA14f01665f0e6fed9690aca9b55c5d7eceee58f21e
SHA2563160830ffd61f0d5d3912881ad7c0927aec378e2ff680c29e0937eb5d4cfa5dd
SHA512c61e7e3391df5fc04c966ac8ea71385ffa664f8ffe743c26c06ef9d5597d0ce5858192a4d68caa6e010ab2d534c288e2a16e84ea2c46a785a7106fa008ef6f01
-
Filesize
96KB
MD57f0a1e68fa226a885c8bc4ee1da5d8d4
SHA12e769f7f7ce5b657c14b47297172cfa996365b94
SHA2569195e1049daf69544c63b3db66d568308895bc5c21bb3b3bacc7f7dca67857fd
SHA51279b048cd5819fc6901fadac940b00e25781db78c6690fee8027dc4611507eb1b674a870ac2e6e2612238e3bc4e4f215f74de3d5f591648c20f92ad04260b747d
-
Filesize
96KB
MD57f0a1e68fa226a885c8bc4ee1da5d8d4
SHA12e769f7f7ce5b657c14b47297172cfa996365b94
SHA2569195e1049daf69544c63b3db66d568308895bc5c21bb3b3bacc7f7dca67857fd
SHA51279b048cd5819fc6901fadac940b00e25781db78c6690fee8027dc4611507eb1b674a870ac2e6e2612238e3bc4e4f215f74de3d5f591648c20f92ad04260b747d
-
Filesize
96KB
MD57f0a1e68fa226a885c8bc4ee1da5d8d4
SHA12e769f7f7ce5b657c14b47297172cfa996365b94
SHA2569195e1049daf69544c63b3db66d568308895bc5c21bb3b3bacc7f7dca67857fd
SHA51279b048cd5819fc6901fadac940b00e25781db78c6690fee8027dc4611507eb1b674a870ac2e6e2612238e3bc4e4f215f74de3d5f591648c20f92ad04260b747d
-
Filesize
96KB
MD5ea3a31ffa8462c8652456968d42f7f8e
SHA15ddd62b10468e2aaf1e6f37efe33fa8777d48bdf
SHA25663d05bf6490a6abbdb2ff6430752fda4003797efc16e20586aababbbc5fdc31e
SHA512e226403472ac9e64cc36602e59e1c1cb8d0bbde001c789cb3f8b282e0ddf9aad60596f73cd6465affbfcab19eb574115ee375b5908ea906b222a86e43af08e4b
-
Filesize
96KB
MD5ea3a31ffa8462c8652456968d42f7f8e
SHA15ddd62b10468e2aaf1e6f37efe33fa8777d48bdf
SHA25663d05bf6490a6abbdb2ff6430752fda4003797efc16e20586aababbbc5fdc31e
SHA512e226403472ac9e64cc36602e59e1c1cb8d0bbde001c789cb3f8b282e0ddf9aad60596f73cd6465affbfcab19eb574115ee375b5908ea906b222a86e43af08e4b
-
Filesize
96KB
MD5ea3a31ffa8462c8652456968d42f7f8e
SHA15ddd62b10468e2aaf1e6f37efe33fa8777d48bdf
SHA25663d05bf6490a6abbdb2ff6430752fda4003797efc16e20586aababbbc5fdc31e
SHA512e226403472ac9e64cc36602e59e1c1cb8d0bbde001c789cb3f8b282e0ddf9aad60596f73cd6465affbfcab19eb574115ee375b5908ea906b222a86e43af08e4b
-
Filesize
96KB
MD50843d5ebdc20a9288183c400e57fe9a4
SHA158bed9135284c2e1449e3941641cf44a22d0401a
SHA2560673db0212296cc83b84d97fee40d8c19d6825eb418bc3eec055990c1887ff34
SHA512ee685f28f329d16ee1983dda015351c6f51f523e4053ab87541caba1bdf7a3fde03eed070a25475ed3b383cfc567a7fe31688ddaebd9c66369722e529e104f15
-
Filesize
96KB
MD50843d5ebdc20a9288183c400e57fe9a4
SHA158bed9135284c2e1449e3941641cf44a22d0401a
SHA2560673db0212296cc83b84d97fee40d8c19d6825eb418bc3eec055990c1887ff34
SHA512ee685f28f329d16ee1983dda015351c6f51f523e4053ab87541caba1bdf7a3fde03eed070a25475ed3b383cfc567a7fe31688ddaebd9c66369722e529e104f15
-
Filesize
96KB
MD50843d5ebdc20a9288183c400e57fe9a4
SHA158bed9135284c2e1449e3941641cf44a22d0401a
SHA2560673db0212296cc83b84d97fee40d8c19d6825eb418bc3eec055990c1887ff34
SHA512ee685f28f329d16ee1983dda015351c6f51f523e4053ab87541caba1bdf7a3fde03eed070a25475ed3b383cfc567a7fe31688ddaebd9c66369722e529e104f15
-
Filesize
96KB
MD52f104c27223458a9e7dc53a94ab17c16
SHA1528e1b304bbd17a8c432ff0f5d5c1f544802fdf7
SHA256e8a5eb91c871968bb01a012f29b9e1d12d781410b98158a4cc1087f7efb7d7b0
SHA51214e895f52dbb091fba631ae9cb08ab6fdcf5d3700b8ee6807f334dd2f091850ae3bcc86901dc947d6ba50a6b678d0e1d104deb5af52d92ba976fe899f7b52358
-
Filesize
96KB
MD52f104c27223458a9e7dc53a94ab17c16
SHA1528e1b304bbd17a8c432ff0f5d5c1f544802fdf7
SHA256e8a5eb91c871968bb01a012f29b9e1d12d781410b98158a4cc1087f7efb7d7b0
SHA51214e895f52dbb091fba631ae9cb08ab6fdcf5d3700b8ee6807f334dd2f091850ae3bcc86901dc947d6ba50a6b678d0e1d104deb5af52d92ba976fe899f7b52358
-
Filesize
96KB
MD52f104c27223458a9e7dc53a94ab17c16
SHA1528e1b304bbd17a8c432ff0f5d5c1f544802fdf7
SHA256e8a5eb91c871968bb01a012f29b9e1d12d781410b98158a4cc1087f7efb7d7b0
SHA51214e895f52dbb091fba631ae9cb08ab6fdcf5d3700b8ee6807f334dd2f091850ae3bcc86901dc947d6ba50a6b678d0e1d104deb5af52d92ba976fe899f7b52358
-
Filesize
96KB
MD5dfd9416bef58793876b036c49f11a231
SHA126898f10d9b2aa6786f03d85e7e68fd7a9bf26b9
SHA256137afea861a510a274fa59859516f510dffe1dcc67db176784a033241a74349a
SHA5127b637d1c446a0b40331671034c55ce8650f843fdb183a775ba8442350f99a12ae788a7be707b188422e1895dc147d41c0f5e0525512375b3d5cc2faf27b5035a
-
Filesize
96KB
MD5dfd9416bef58793876b036c49f11a231
SHA126898f10d9b2aa6786f03d85e7e68fd7a9bf26b9
SHA256137afea861a510a274fa59859516f510dffe1dcc67db176784a033241a74349a
SHA5127b637d1c446a0b40331671034c55ce8650f843fdb183a775ba8442350f99a12ae788a7be707b188422e1895dc147d41c0f5e0525512375b3d5cc2faf27b5035a
-
Filesize
96KB
MD5dfd9416bef58793876b036c49f11a231
SHA126898f10d9b2aa6786f03d85e7e68fd7a9bf26b9
SHA256137afea861a510a274fa59859516f510dffe1dcc67db176784a033241a74349a
SHA5127b637d1c446a0b40331671034c55ce8650f843fdb183a775ba8442350f99a12ae788a7be707b188422e1895dc147d41c0f5e0525512375b3d5cc2faf27b5035a
-
Filesize
96KB
MD5c07c556cc95d51139523c1d2f5621750
SHA13d79127fc67f7a352866ff8be470b8bda3d0cc39
SHA25689995483683bff8cb2c1e64c367e0077abbb1fed135a16286b079597a5d19938
SHA512c32c36e71aaf2bb1cbea998af8e0a861b01989d0f51f8d9091e6636f3862c2f5ebed9d94caaf02f6f36e8bc89047b5f41569efe32b0733496feedadf45403d7a
-
Filesize
96KB
MD5c07c556cc95d51139523c1d2f5621750
SHA13d79127fc67f7a352866ff8be470b8bda3d0cc39
SHA25689995483683bff8cb2c1e64c367e0077abbb1fed135a16286b079597a5d19938
SHA512c32c36e71aaf2bb1cbea998af8e0a861b01989d0f51f8d9091e6636f3862c2f5ebed9d94caaf02f6f36e8bc89047b5f41569efe32b0733496feedadf45403d7a
-
Filesize
96KB
MD5c07c556cc95d51139523c1d2f5621750
SHA13d79127fc67f7a352866ff8be470b8bda3d0cc39
SHA25689995483683bff8cb2c1e64c367e0077abbb1fed135a16286b079597a5d19938
SHA512c32c36e71aaf2bb1cbea998af8e0a861b01989d0f51f8d9091e6636f3862c2f5ebed9d94caaf02f6f36e8bc89047b5f41569efe32b0733496feedadf45403d7a
-
Filesize
96KB
MD512d6f8ed4eed24e6c4958a80c5f6f6bf
SHA1d06ccfb3d5cacf8e7cff22e2aa1074103888bfa0
SHA2564f2097f43794ba8b350b3c6559a9174b0e525edd53c1410feedbec39af80659f
SHA51231df72a0d4e775d8c8ad2b195db7776916a3ceb80464598f26212e7a53490eb68450eb0fd7ef8c42a3d4cd004d52bf7b2b22af6c9c3d9a097b27140e0ade475b
-
Filesize
96KB
MD512d6f8ed4eed24e6c4958a80c5f6f6bf
SHA1d06ccfb3d5cacf8e7cff22e2aa1074103888bfa0
SHA2564f2097f43794ba8b350b3c6559a9174b0e525edd53c1410feedbec39af80659f
SHA51231df72a0d4e775d8c8ad2b195db7776916a3ceb80464598f26212e7a53490eb68450eb0fd7ef8c42a3d4cd004d52bf7b2b22af6c9c3d9a097b27140e0ade475b
-
Filesize
96KB
MD512d6f8ed4eed24e6c4958a80c5f6f6bf
SHA1d06ccfb3d5cacf8e7cff22e2aa1074103888bfa0
SHA2564f2097f43794ba8b350b3c6559a9174b0e525edd53c1410feedbec39af80659f
SHA51231df72a0d4e775d8c8ad2b195db7776916a3ceb80464598f26212e7a53490eb68450eb0fd7ef8c42a3d4cd004d52bf7b2b22af6c9c3d9a097b27140e0ade475b
-
Filesize
96KB
MD54a5d0aaa63302b8820afeb6de7a3e032
SHA115f78d1a301f3c33faef8617fb74d7e15957876c
SHA256d8ef221c8cb6feac36f9ac3172b8023be2e0baddea17e2557e0254d6812aa765
SHA51272cd79f980f391c4dc6d5fecefaf6aeb99bf30fb85a826396253f0f37e1f8ee6d6b2c0311ac13a2a1d71f3df20845f32cc066538ee3b424e34944f4f089b80a5
-
Filesize
96KB
MD54a5d0aaa63302b8820afeb6de7a3e032
SHA115f78d1a301f3c33faef8617fb74d7e15957876c
SHA256d8ef221c8cb6feac36f9ac3172b8023be2e0baddea17e2557e0254d6812aa765
SHA51272cd79f980f391c4dc6d5fecefaf6aeb99bf30fb85a826396253f0f37e1f8ee6d6b2c0311ac13a2a1d71f3df20845f32cc066538ee3b424e34944f4f089b80a5
-
Filesize
96KB
MD54a5d0aaa63302b8820afeb6de7a3e032
SHA115f78d1a301f3c33faef8617fb74d7e15957876c
SHA256d8ef221c8cb6feac36f9ac3172b8023be2e0baddea17e2557e0254d6812aa765
SHA51272cd79f980f391c4dc6d5fecefaf6aeb99bf30fb85a826396253f0f37e1f8ee6d6b2c0311ac13a2a1d71f3df20845f32cc066538ee3b424e34944f4f089b80a5
-
Filesize
96KB
MD5e352b9d9fdbcd275b8243d8f29279844
SHA14635504d7e1cacc8b8f8eb4f0c355ee2a4424323
SHA256f6dbb2dd39d7d522222a64287b4c1eb7e2381bb371d014475580a1a6abf6046a
SHA512f962f0f6ee7c70394f3e86d663ca7c1030865f87d34e0b1200dd4fcc4ac4e972c1e5968b7568fd82cc040b24f45c670a794d18f247afb3f0895eb41deb30f782
-
Filesize
96KB
MD5e352b9d9fdbcd275b8243d8f29279844
SHA14635504d7e1cacc8b8f8eb4f0c355ee2a4424323
SHA256f6dbb2dd39d7d522222a64287b4c1eb7e2381bb371d014475580a1a6abf6046a
SHA512f962f0f6ee7c70394f3e86d663ca7c1030865f87d34e0b1200dd4fcc4ac4e972c1e5968b7568fd82cc040b24f45c670a794d18f247afb3f0895eb41deb30f782
-
Filesize
96KB
MD5e352b9d9fdbcd275b8243d8f29279844
SHA14635504d7e1cacc8b8f8eb4f0c355ee2a4424323
SHA256f6dbb2dd39d7d522222a64287b4c1eb7e2381bb371d014475580a1a6abf6046a
SHA512f962f0f6ee7c70394f3e86d663ca7c1030865f87d34e0b1200dd4fcc4ac4e972c1e5968b7568fd82cc040b24f45c670a794d18f247afb3f0895eb41deb30f782
-
Filesize
96KB
MD5c7e84d9945ad02a1c7fe037f204858d7
SHA1a845a63cb67c09cf547fd1f0ca7a33a76d9f6594
SHA2568d1106b73932a55c2ab13bd72a1e0af564749abb17636892bc8a4eae636fd901
SHA512a2a0807e0cf023f50aafa6c80bd49587ecdf2ab10d2ece8f4c88343b8c7a3001e467d17d001befbbb8681d567eb47c01da87e656399e714850ce7d79e3996199
-
Filesize
96KB
MD5f2e2a40d18bccb0026ab8617093e404e
SHA1e4afc4d87996a619be4527e7dc115f43a2ff3d0f
SHA2564f5170b30cd4bd597ba258810f4b44d678846c3b71eb513fd12f98e51ab86646
SHA5125307222360ef98cbe2c59be5b5c9463afdf17a4a90a3c94363e05ea69b63be8082e7392f7a4624cf0cf1a856d3f1bf367ed462b3f6de236282793d81edd60578
-
Filesize
96KB
MD59809d2862abd0c4a93908e23f953a55a
SHA136e8074143f6dacf1652673e1e459f082da8ca2e
SHA25657def7537327baf32140ee8733cdd7153d91bf389f4847a60078387d32ef261e
SHA512a32dcec13ce366582d7dc6a131572cf3d880f0be2faf98ed8c421ec88da765c374c5fb51fd6b81fb7f3aa4492eaf27ee0e18fa4927309474fb0ea35cbb3927e4
-
Filesize
96KB
MD5937c1aaca448ceb24a3e1a2ce9b14460
SHA1fd331c1d936e322c1d1ae5f6008b827855353866
SHA2560d57ce9f476e3b0b31037acc314b5f4cf3e74463ad46f7979848eba2e4b0f8d8
SHA5122c6c23378dfa2a4caeae51badf76f1a91c6159555d964432e1305c2821179f639cab0e2d1068946837f270ed1ceb06a308c72ac2dd27c18d108e98d60424d93f
-
Filesize
96KB
MD5538056245268f04df49cdd94a36c17a2
SHA11e2f643bf185c6e627f5ac7eac4cb77bbb0cc729
SHA2563963d9f5d19d144a8567594d785e048c876111e41ed8e7428682428d18977777
SHA5128448b9e5e560897d4a575e0dc2ef8d066314875718cca665edcb8b264c285d3da08660304996079fc3da8f62a49d795f30894b22180bef3cc55fcdf8da68c781
-
Filesize
96KB
MD5abcda20e64ee91fd77faa8b820982612
SHA19c59d624eecc96c8e97f1f0bc6ade00d32a21b6b
SHA2560389bd306382998d7bbd853340d9d690dc9bf4c889ef89d0ed2e4fc12378ccab
SHA51222de7140e6acf2ea5eb6a5f98a9f75e94ba2c9f976117cab30bcb07f502088a82380fd3cb02abd013440817f13431bcacb2d58fe0c0d0867c6815a38174cfa5b
-
Filesize
96KB
MD5abcda20e64ee91fd77faa8b820982612
SHA19c59d624eecc96c8e97f1f0bc6ade00d32a21b6b
SHA2560389bd306382998d7bbd853340d9d690dc9bf4c889ef89d0ed2e4fc12378ccab
SHA51222de7140e6acf2ea5eb6a5f98a9f75e94ba2c9f976117cab30bcb07f502088a82380fd3cb02abd013440817f13431bcacb2d58fe0c0d0867c6815a38174cfa5b
-
Filesize
96KB
MD5abcda20e64ee91fd77faa8b820982612
SHA19c59d624eecc96c8e97f1f0bc6ade00d32a21b6b
SHA2560389bd306382998d7bbd853340d9d690dc9bf4c889ef89d0ed2e4fc12378ccab
SHA51222de7140e6acf2ea5eb6a5f98a9f75e94ba2c9f976117cab30bcb07f502088a82380fd3cb02abd013440817f13431bcacb2d58fe0c0d0867c6815a38174cfa5b
-
Filesize
96KB
MD59819fb9ceb249d34c65d26c1372b2040
SHA1baf5586ed2d0aa8db00ed2e055babdb7e9f60396
SHA2567f4d8879ad68e130cb4ab01d1cf88bedf0096cca20708913203c182cbee51c9c
SHA5127b2f75ab9d131aeb6bb2a7dcfa8e89861f810280f84daf11cf82d0951a9bae9c775a26b84898ffeb2cc298b5d821317c523ab475556a1e1cb85e343f063a4821
-
Filesize
96KB
MD57d9f05b39dccc5381a35eb12a048d38a
SHA151ac8616c089d629c77784cc2015249001474662
SHA256b2b8b76479027c7964c943cb2ddbbb93e5d4ba7d3eec48e9b8114210835c86dc
SHA512d78e661a6fd50e9f789d628a2ad0da12959daf3dc7487ced585f5bb4ffeb04e22689b0f2e5c486b14a636bb6f8c6071f226b1b1acf43e7cdf32009a635345bef
-
Filesize
96KB
MD5e15bd56caa57153b8f5a78c0c921e31a
SHA151722f7eef4ff2da1016cbe9c9d51d3b81584b97
SHA25689960f4af07faf01f17b0d2cf1ea277d6a0628a06b6446f048d78d9dd62a339c
SHA5124cf580994c6f700b8cab6f832b73da98d46fe937876da4f03c78903da6b9435a103ff1cffe42a43680443db2775c30c9e70c237b9be75953be72fb6465bed660
-
Filesize
96KB
MD5cb84d79e0438e2983ece7d3cf3dfad1d
SHA1e19b474249dd312d8ba0568b5261d0573c0ae414
SHA256338f6ca06b47aa446e61b1532066c01e653a07a8319f6439b61c6090673c038f
SHA5124b62f97f91111b009ebb9e78c2989299916ec2f5cff801abac9ae351d8f6654373253e34d6bf87219366041d2ae3ff10cd5a7003f762150a8dfa2fe398d253cf
-
Filesize
96KB
MD53285df2b477ec8dfd5f22a6292578434
SHA11f736f77241809db512b6307ebae93905177457b
SHA2565bbe0a9db5139086d4635d5226693ef1a18cf36c2754baad5277086b1c348e1a
SHA512be641807191275f97e245ac3c3bf8f3d30952e9fe17ac8e23ce29c36f72e9e5da4a1a8f8c29f24c083c5ce1401e780d4cadda3f43249a8cbee0a8b15bf0948b0
-
Filesize
96KB
MD541099c58ce5d187734456a09bf01a1f6
SHA15bbddf98b629d5cb4382a4b99aeb16597c4e3be5
SHA256dcab0cd234e7e9389211a9261845256b7b5aae6a3e83a6553bd73d3f8a5fa3f6
SHA5129e49a4c858dc9b4de3f4d0bba38437da48fc9d29edcaea702367e047a2fcc8c87eda1e5d28bb20cc3c2085e2552ab31ebc596ae5df953aa69cca348c8f7d8ffe
-
Filesize
96KB
MD5e161eb246541a42181348e85ed3f579a
SHA1289de0ab1145c3c2410262c36abe9ffa9a461ccd
SHA25687a093cc6a6b940d5d4cd326b2c3dfd399311dc273b4fab67340bc9dae856aaf
SHA5121d8bd54af274e856fe0fb2530fa7877f66964c40cb85489318c1ae7e0fcbfd05e575b3ff8120462be884ab60b8b3120905be438ba803c8b2315a27da82dc0b7e
-
Filesize
96KB
MD513b17d519af5e1ec5b69b03c3b3e610f
SHA108f43164e13f3d8261a8ea4daf130885dcde97a3
SHA25682565bc862c28946e6f3d3c998fab9b9e8f298525fd19a931caf85c01148545a
SHA512e273cb652dccf948529d4b3840b82812bc7e7d504d83bff24190afc44e11c5749be13de5551221f786ba9f369afc1fbecd2d6a9cbf1406c0f05ebf17f1a98507
-
Filesize
96KB
MD53c46f5dc8d125ba19e2ed1fc497661ad
SHA194036c67181f33948d8abee2671d30391e3b2eca
SHA2563c61c6a2e7267ba557fcb567d70588c90c27219500529c3fc8ce72fa4ae8aecc
SHA512b7b831ad9302f398e4058f2e565fdf91b45b26030e3cb5424a542a8cd0399e9b69d588b62bb396fc1e11b0453a85800118af0ff0b0936b617dc0c591e9f9868f
-
Filesize
96KB
MD584a506deea0e18aec1d31b35f37dc638
SHA1485a4370cc599c7c705c5bd6e98e383245b0a128
SHA256e8bb20c62174de5eb0d302987a95fbd677bd447d500b061c33ef363515ba510e
SHA512db52d77c98102e4debd4b196a5db7b71c5fa7636572cebed2e85908905ada07eda5364a73692a446d3068314976e95550210fdeefb7a8c05d5879082ab26af42
-
Filesize
96KB
MD5aa42193321bbf0220cd3e4a16b73fe09
SHA117fe0679b37b7d4467c6c447ce2ce7c73cb8acab
SHA2566bdd45e7880875c0229ff62c849bd85c4974ed19982d6e966ecd819c91cd04f3
SHA512b0e4452ff81b23d57540484fe86e30ea25e9e5d348a405f090ac6f4bab74b5195c77339d087d15d88c0534a28bdf1fa5ebff0527b8cab4e732c158904b69ea41
-
Filesize
96KB
MD521e69d1241bc7fda2c4567b463707028
SHA16fad9272a5754e680d835be4b06e0359cf0d088a
SHA2560c3d93df5a1b030bd4b83cace22d532e345826dd0772041cae87da658a0eceeb
SHA5127f7142e2fc1062530eba2fd632046f608dd061c7cfd93b664cd8c37061910820ea1bdbb27f5d34bed0281bbe391e9de216e32baedba4633af974da41108b70d0
-
Filesize
96KB
MD54637fc3e4a6ac56a0ce98add4d4a1a03
SHA12b1ab3dbe3b5b1b3652898ab03b253fb1dafaaff
SHA2564d4cb8d1bc41ca186c0c544d0de261e6dd659c61e5873bd06b076322a0350901
SHA512f1bff4f172d280b0da349e30972b022df09e7432ccaf69bc268be4da7f02e7aa296e243f68ae37356bdcd2959128883d58b8463180b409439a42e4b83a670493
-
Filesize
96KB
MD5078b1220490459ff88c2a5d75c34d89f
SHA1c9aa2b238b73203e628d2e083b6e0dc320a6afdb
SHA25608a1f03c3973cce366022d25851a63b7da98754861799a66c2f6f8e23b592219
SHA5126567bea18d30d4d97fb6feab5f4b3b2705c51d6b34a0585877d0a9c1d6300e0ac07ef17e43d523912595b560656bc4fbf9215810b508833f1c2f8a5e5e13319f
-
Filesize
96KB
MD5e311e31e44d19113c4a74f95c52be2db
SHA17ff960fc178bf736f59852be3fa283508ac1b1ad
SHA256390022d3272d49fbecb739b4a478edc06708696b80f8f74c6ac07005338ffe96
SHA5126449591a7067a3641f11002170c1940b5e92cc1e99ace85dbb0a34fb4c5802fadc08b574163cac837f2f7850d42a0903cdfa381962a74f29e979ad7cc6609269
-
Filesize
96KB
MD5667a29b6aa0a047237f954de03c89726
SHA1dfa981c6375129dc9af7072dca2a9dfbc5ddb3ed
SHA2566f0f5790a42f9dbbabeae8e1af07620f77ef92f62977a1190748deb0a6dad4de
SHA5123da6ba9bce7c37b84ce67136c2095d2cd5d6c0d0f19c2d95051d7017ca8996cf37b966f2e19bb2ff48062c3678e08c228184efe1820433fdcd78f5fa7c12d332
-
Filesize
96KB
MD58ce58a378597d63325fa25626358ec57
SHA1c54e84fdfe20fb18fd531293cadd64dba9aa87fe
SHA2568a58e8406a533035f4baca63b35fa21cfb1036f3e7f603cf801ec61ced4754f0
SHA5120707b3f97351ed514ab3cf925cef723dbe791c9ce12cadf6d1e41363522a3eba3bc9a3ad2778de5d6d7aba3b2366357374b8d6e9662508767bf292fe7c7ae99a
-
Filesize
96KB
MD5bd5d8ea0ee613a1b0d6dd26c60562637
SHA1c63c7f5958d85dc704c7873f3e8f013100907006
SHA256a500dc33ef0e5acf93b53a3e7bb4764687f8ede9cf21a3d8d286e4d3507f0222
SHA51205b935c5e84f5a941f4322ade5a20540b99fbefc9ecfedb8fcbd36bfcb0aef1137803cc9104654269e94f2def9a17f6f5dcf72f414c80d2f48f1562608be1352
-
Filesize
96KB
MD5a1c2e3c47ede5cd4bf8d5f573925702d
SHA1180c7620f33504bab4be934826d53af7c47a7a97
SHA256826b177ec128df749c2b0023e2967a12eeea87ce3ca3f8dfa0731ac191f220f2
SHA512b295495ae8c15d429c96afa44e26c63b4466713824d92062edfb308ac9963f503d9a6d7ba8cd2fe9276189a036c634ecbcf4511b1e68cd1ec8f99571691cf98b
-
Filesize
96KB
MD5aa45ecd9fdcf86b055148ee9d067d6b6
SHA191b1bc5edc8e054f3dfd1eff66baf14af35551f0
SHA25663599b423a41d03e1fc6d259f5b2e32255b7a4eb514f1a64786c0c2b3c10e848
SHA5125969ef992b68dcf7a1a274bf299d93d65ae9555470e7ac1942b2a323883fb103e4f27c0ebbcacc355502eb73711b2727a5769702270cd2539aafd4023eda520b
-
Filesize
96KB
MD56c76db873a63df2048ef75bcb0617fd0
SHA1469d214ff77f3d045f667d13f2a61b5f0d5c5d00
SHA256202ef871ef720b9fae5c9004086862f8c27761300fc2a0153d8c0a59dd16b5df
SHA512b13f9f32e98f26368fff424f7f59605a3e9972108baabf37a5fbafa162d08a7b7d505362f352ba94cd9e2f116d97d9bf719372e1bbe2d24769351682a676991e
-
Filesize
96KB
MD5771e1049ba8daab836ef3b777e0747dd
SHA1e8759d579bdc177a504133136028768eee34e8bd
SHA2565a0d8cee0b31efdcdb2307e85cd357fd425051eb7759a3acbb9c076568bfe174
SHA512fc2e5d4b411640d86025868274434838973df0f28aa753b4e577661c8478787dab5045ccc37b41b726d1a174e22f3bb7a0a55cffe406ac90d50f6b7b29b23775
-
Filesize
96KB
MD577f9ae741497cbd03044a9b4bea88c89
SHA11fa71b23d4563a694c1a13999c202255bbaac7b4
SHA2562500351916ad1f367a5acd44f8cc6ae438908e78acdc93e581450f72d4046772
SHA512fd01ab0c11851e6a980d41add5440f4292a910fbe20bcc99999b750f5a30de810087b8421d2c564346284bd4019a7d8cacb0fb5b250878f53c916c93168e4932
-
Filesize
96KB
MD54aaceae49b457e4e30e7545a8b3ca4e1
SHA17cfc133b540f6717c08012ebaf3831f0e3ce251a
SHA25653d0dbc80a0f6b3f896e666078b1a774cb3a3b10773f7643aaf7d131dcc98455
SHA512af82a2766cba64bf5172a4f3ad0a00e7c1ab43f03a8750628f2e052b690bfd692e866ffa0289241409b372190708add51e5172a4a8ccec3bbe8c799d801ce4a3
-
Filesize
96KB
MD5d4d9efe014deddbf9726a4fe32c8dab9
SHA1fd736429fbe584ca5d6d188c720aaa3b21832872
SHA2567e0792b3a88f663083c139b40c4007685a093405f153f242bdb7238036778a43
SHA512f72a8e60fb68ede922b927606753b0d7d563ce3b3774c92f2e8ac3638f2f0d92297fb9019d127e3107860d450cf1cc0ea1e3734d4fed0711025fe56770fb8dbe
-
Filesize
96KB
MD52400b22a8f7275dca296d99b4d384ab4
SHA1dc30ca22bb5f2988847327a33da94da1c1fe70dc
SHA25630404888cf6937c3085b2f76064a24366ade0256690cfe76db5444bddd3d114a
SHA51209bf041e71c4e95c7acb83cc0be08ad04b43c205ccbc3f80daf2ddedb6346d9b4fe9c0989708eb1da63f1266fd9664a15b98c19864aa776fd8013d0e4b95ef20
-
Filesize
96KB
MD5d9cce060eacfaf6bf89f3c93573f05bc
SHA125afee01c8e90ad2a718cd4279a11cb801965233
SHA256e6a0eefb48667eae7d7bc9fb942ca3efa55af2f96a6d26a3cf9803e1dcc87c8f
SHA51296f11a75e8f0ac1db7eddfc35bc2ef1f49ad553097e9456e5fe00555e1d90e89103e5ebc115a2497f3ca2925aca94c6cd31a672eca8295d9412d85425744b716
-
Filesize
96KB
MD547b9e7fffa9e6b5866c03af3f63511d9
SHA146d917454a5dc36d7686281d67be871eada7c767
SHA256bda0603590ac8dbb873f3bfdce693069f75915d6e64b8da0506c1a8ace898f6c
SHA5124bb96a2c468444e196444208f9853266b6bc5432b2c47bfc3f59593a9523689eb1aeda00821d41de54105bd0f3cdf7fb54888822c425b7609b6c636c98cf7dcb
-
Filesize
96KB
MD5a88c3b1fc5c350572a2a7ab3a04aa322
SHA1d401ebf2d5f58e32fd47c5467499be08dd7ed32d
SHA256aea98997ba3a553e5dc54b455f2661dd3ce9a88432ad5bba9b88e7335eb4c613
SHA512250b7786302cdfe9ea5d532b7181c4c02889869b8d93fb8c3ba3e59e92542a6477bdc111f2b99a46733e795f6089ecca5cb29a7f92ed91492e16a0446bb563df
-
Filesize
96KB
MD544037ec284729093f86956717db7144a
SHA1a2c94f004577febfc0964f33e7b32e3ed004d577
SHA2565aa81b5453712bcaff68923b1a6aed5e29daedfd030b6d560fa9d829f7d6b465
SHA512ccfd933ad2e062e1261192ec754d27a3741c0050c8a057f1525d26f099ae17af397f1b4aa98a4929460ac235e82d4271d0b948dc6031a14389f5f8dad57ab459
-
Filesize
96KB
MD544037ec284729093f86956717db7144a
SHA1a2c94f004577febfc0964f33e7b32e3ed004d577
SHA2565aa81b5453712bcaff68923b1a6aed5e29daedfd030b6d560fa9d829f7d6b465
SHA512ccfd933ad2e062e1261192ec754d27a3741c0050c8a057f1525d26f099ae17af397f1b4aa98a4929460ac235e82d4271d0b948dc6031a14389f5f8dad57ab459
-
Filesize
96KB
MD543ae028f7333cdad609f005242a4c96a
SHA1c3eaf7c81319ce6f121fe8e4a4bd04434d7264c5
SHA256809c0d23898a5dab5ec5794ed62d4badc88bcb09e25c4ee4f2601e4df3d078be
SHA512597bb56477ecde62db86b4ad65bbe1fa9e71f0b47fa627280a068eb43a675c6f569c029665963a334938c84e0ada6b31b4e6536f5bbf7e827e27dd14ee3ce95d
-
Filesize
96KB
MD543ae028f7333cdad609f005242a4c96a
SHA1c3eaf7c81319ce6f121fe8e4a4bd04434d7264c5
SHA256809c0d23898a5dab5ec5794ed62d4badc88bcb09e25c4ee4f2601e4df3d078be
SHA512597bb56477ecde62db86b4ad65bbe1fa9e71f0b47fa627280a068eb43a675c6f569c029665963a334938c84e0ada6b31b4e6536f5bbf7e827e27dd14ee3ce95d
-
Filesize
96KB
MD5b49a081d2cc64f63a685687bcec311f1
SHA10a2527361b24d73c5486929ac8a3a684b3c7793e
SHA2565c8c4255ed37e847b4729794a7568ed8620275049ca080576ae429b6b6622dd5
SHA512a86318edb91ea156910f5fbc9fe1715961022449a6e435bd5f52feec47cfdc37948901ada342a4d23ef5e67c74aab76863efd71622c297f265bcd5f94f4e4b43
-
Filesize
96KB
MD5b49a081d2cc64f63a685687bcec311f1
SHA10a2527361b24d73c5486929ac8a3a684b3c7793e
SHA2565c8c4255ed37e847b4729794a7568ed8620275049ca080576ae429b6b6622dd5
SHA512a86318edb91ea156910f5fbc9fe1715961022449a6e435bd5f52feec47cfdc37948901ada342a4d23ef5e67c74aab76863efd71622c297f265bcd5f94f4e4b43
-
Filesize
96KB
MD5701059b3ee419bef3df3520a2c694cae
SHA102a0374003a35e7c58015eee170eb45b269011de
SHA2568478d4a2335174bfcbc37d49c3b7892d9ab9a9fd5e318c1164f801cbe0affa9e
SHA5129b6019ace4f803da988d97beeabefdf02a1cd2a47917ab6d91d6466eb7d6cad145c35d6ee87e151acb7a107c8cb9fc0009cef9e40e88d7b6a47fd5bd2fec35ce
-
Filesize
96KB
MD5701059b3ee419bef3df3520a2c694cae
SHA102a0374003a35e7c58015eee170eb45b269011de
SHA2568478d4a2335174bfcbc37d49c3b7892d9ab9a9fd5e318c1164f801cbe0affa9e
SHA5129b6019ace4f803da988d97beeabefdf02a1cd2a47917ab6d91d6466eb7d6cad145c35d6ee87e151acb7a107c8cb9fc0009cef9e40e88d7b6a47fd5bd2fec35ce
-
Filesize
96KB
MD56fbce06dab273c9566234d663abb6b64
SHA1c9f5577ba734ade0f4f670f3aad50cdcb3bc9082
SHA25699830befa97fd15d4b7035afc98eef0ccaf8e1f0ea0e27a257fc0a745500cf79
SHA512f897e840254547da2c7057f05b4c81c2d538ad6f32d9af94bf3edd5bea54b4cfcba2f6c9ce2c84e0c5d4192a922bfada44311a169b335021e0ade425c5195645
-
Filesize
96KB
MD56fbce06dab273c9566234d663abb6b64
SHA1c9f5577ba734ade0f4f670f3aad50cdcb3bc9082
SHA25699830befa97fd15d4b7035afc98eef0ccaf8e1f0ea0e27a257fc0a745500cf79
SHA512f897e840254547da2c7057f05b4c81c2d538ad6f32d9af94bf3edd5bea54b4cfcba2f6c9ce2c84e0c5d4192a922bfada44311a169b335021e0ade425c5195645
-
Filesize
96KB
MD5508c41fa9cd74f489c0c40f6d1254115
SHA14f01665f0e6fed9690aca9b55c5d7eceee58f21e
SHA2563160830ffd61f0d5d3912881ad7c0927aec378e2ff680c29e0937eb5d4cfa5dd
SHA512c61e7e3391df5fc04c966ac8ea71385ffa664f8ffe743c26c06ef9d5597d0ce5858192a4d68caa6e010ab2d534c288e2a16e84ea2c46a785a7106fa008ef6f01
-
Filesize
96KB
MD5508c41fa9cd74f489c0c40f6d1254115
SHA14f01665f0e6fed9690aca9b55c5d7eceee58f21e
SHA2563160830ffd61f0d5d3912881ad7c0927aec378e2ff680c29e0937eb5d4cfa5dd
SHA512c61e7e3391df5fc04c966ac8ea71385ffa664f8ffe743c26c06ef9d5597d0ce5858192a4d68caa6e010ab2d534c288e2a16e84ea2c46a785a7106fa008ef6f01
-
Filesize
96KB
MD57f0a1e68fa226a885c8bc4ee1da5d8d4
SHA12e769f7f7ce5b657c14b47297172cfa996365b94
SHA2569195e1049daf69544c63b3db66d568308895bc5c21bb3b3bacc7f7dca67857fd
SHA51279b048cd5819fc6901fadac940b00e25781db78c6690fee8027dc4611507eb1b674a870ac2e6e2612238e3bc4e4f215f74de3d5f591648c20f92ad04260b747d
-
Filesize
96KB
MD57f0a1e68fa226a885c8bc4ee1da5d8d4
SHA12e769f7f7ce5b657c14b47297172cfa996365b94
SHA2569195e1049daf69544c63b3db66d568308895bc5c21bb3b3bacc7f7dca67857fd
SHA51279b048cd5819fc6901fadac940b00e25781db78c6690fee8027dc4611507eb1b674a870ac2e6e2612238e3bc4e4f215f74de3d5f591648c20f92ad04260b747d
-
Filesize
96KB
MD5ea3a31ffa8462c8652456968d42f7f8e
SHA15ddd62b10468e2aaf1e6f37efe33fa8777d48bdf
SHA25663d05bf6490a6abbdb2ff6430752fda4003797efc16e20586aababbbc5fdc31e
SHA512e226403472ac9e64cc36602e59e1c1cb8d0bbde001c789cb3f8b282e0ddf9aad60596f73cd6465affbfcab19eb574115ee375b5908ea906b222a86e43af08e4b
-
Filesize
96KB
MD5ea3a31ffa8462c8652456968d42f7f8e
SHA15ddd62b10468e2aaf1e6f37efe33fa8777d48bdf
SHA25663d05bf6490a6abbdb2ff6430752fda4003797efc16e20586aababbbc5fdc31e
SHA512e226403472ac9e64cc36602e59e1c1cb8d0bbde001c789cb3f8b282e0ddf9aad60596f73cd6465affbfcab19eb574115ee375b5908ea906b222a86e43af08e4b
-
Filesize
96KB
MD50843d5ebdc20a9288183c400e57fe9a4
SHA158bed9135284c2e1449e3941641cf44a22d0401a
SHA2560673db0212296cc83b84d97fee40d8c19d6825eb418bc3eec055990c1887ff34
SHA512ee685f28f329d16ee1983dda015351c6f51f523e4053ab87541caba1bdf7a3fde03eed070a25475ed3b383cfc567a7fe31688ddaebd9c66369722e529e104f15
-
Filesize
96KB
MD50843d5ebdc20a9288183c400e57fe9a4
SHA158bed9135284c2e1449e3941641cf44a22d0401a
SHA2560673db0212296cc83b84d97fee40d8c19d6825eb418bc3eec055990c1887ff34
SHA512ee685f28f329d16ee1983dda015351c6f51f523e4053ab87541caba1bdf7a3fde03eed070a25475ed3b383cfc567a7fe31688ddaebd9c66369722e529e104f15
-
Filesize
96KB
MD52f104c27223458a9e7dc53a94ab17c16
SHA1528e1b304bbd17a8c432ff0f5d5c1f544802fdf7
SHA256e8a5eb91c871968bb01a012f29b9e1d12d781410b98158a4cc1087f7efb7d7b0
SHA51214e895f52dbb091fba631ae9cb08ab6fdcf5d3700b8ee6807f334dd2f091850ae3bcc86901dc947d6ba50a6b678d0e1d104deb5af52d92ba976fe899f7b52358
-
Filesize
96KB
MD52f104c27223458a9e7dc53a94ab17c16
SHA1528e1b304bbd17a8c432ff0f5d5c1f544802fdf7
SHA256e8a5eb91c871968bb01a012f29b9e1d12d781410b98158a4cc1087f7efb7d7b0
SHA51214e895f52dbb091fba631ae9cb08ab6fdcf5d3700b8ee6807f334dd2f091850ae3bcc86901dc947d6ba50a6b678d0e1d104deb5af52d92ba976fe899f7b52358
-
Filesize
96KB
MD5dfd9416bef58793876b036c49f11a231
SHA126898f10d9b2aa6786f03d85e7e68fd7a9bf26b9
SHA256137afea861a510a274fa59859516f510dffe1dcc67db176784a033241a74349a
SHA5127b637d1c446a0b40331671034c55ce8650f843fdb183a775ba8442350f99a12ae788a7be707b188422e1895dc147d41c0f5e0525512375b3d5cc2faf27b5035a
-
Filesize
96KB
MD5dfd9416bef58793876b036c49f11a231
SHA126898f10d9b2aa6786f03d85e7e68fd7a9bf26b9
SHA256137afea861a510a274fa59859516f510dffe1dcc67db176784a033241a74349a
SHA5127b637d1c446a0b40331671034c55ce8650f843fdb183a775ba8442350f99a12ae788a7be707b188422e1895dc147d41c0f5e0525512375b3d5cc2faf27b5035a
-
Filesize
96KB
MD5c07c556cc95d51139523c1d2f5621750
SHA13d79127fc67f7a352866ff8be470b8bda3d0cc39
SHA25689995483683bff8cb2c1e64c367e0077abbb1fed135a16286b079597a5d19938
SHA512c32c36e71aaf2bb1cbea998af8e0a861b01989d0f51f8d9091e6636f3862c2f5ebed9d94caaf02f6f36e8bc89047b5f41569efe32b0733496feedadf45403d7a
-
Filesize
96KB
MD5c07c556cc95d51139523c1d2f5621750
SHA13d79127fc67f7a352866ff8be470b8bda3d0cc39
SHA25689995483683bff8cb2c1e64c367e0077abbb1fed135a16286b079597a5d19938
SHA512c32c36e71aaf2bb1cbea998af8e0a861b01989d0f51f8d9091e6636f3862c2f5ebed9d94caaf02f6f36e8bc89047b5f41569efe32b0733496feedadf45403d7a
-
Filesize
96KB
MD512d6f8ed4eed24e6c4958a80c5f6f6bf
SHA1d06ccfb3d5cacf8e7cff22e2aa1074103888bfa0
SHA2564f2097f43794ba8b350b3c6559a9174b0e525edd53c1410feedbec39af80659f
SHA51231df72a0d4e775d8c8ad2b195db7776916a3ceb80464598f26212e7a53490eb68450eb0fd7ef8c42a3d4cd004d52bf7b2b22af6c9c3d9a097b27140e0ade475b
-
Filesize
96KB
MD512d6f8ed4eed24e6c4958a80c5f6f6bf
SHA1d06ccfb3d5cacf8e7cff22e2aa1074103888bfa0
SHA2564f2097f43794ba8b350b3c6559a9174b0e525edd53c1410feedbec39af80659f
SHA51231df72a0d4e775d8c8ad2b195db7776916a3ceb80464598f26212e7a53490eb68450eb0fd7ef8c42a3d4cd004d52bf7b2b22af6c9c3d9a097b27140e0ade475b
-
Filesize
96KB
MD54a5d0aaa63302b8820afeb6de7a3e032
SHA115f78d1a301f3c33faef8617fb74d7e15957876c
SHA256d8ef221c8cb6feac36f9ac3172b8023be2e0baddea17e2557e0254d6812aa765
SHA51272cd79f980f391c4dc6d5fecefaf6aeb99bf30fb85a826396253f0f37e1f8ee6d6b2c0311ac13a2a1d71f3df20845f32cc066538ee3b424e34944f4f089b80a5
-
Filesize
96KB
MD54a5d0aaa63302b8820afeb6de7a3e032
SHA115f78d1a301f3c33faef8617fb74d7e15957876c
SHA256d8ef221c8cb6feac36f9ac3172b8023be2e0baddea17e2557e0254d6812aa765
SHA51272cd79f980f391c4dc6d5fecefaf6aeb99bf30fb85a826396253f0f37e1f8ee6d6b2c0311ac13a2a1d71f3df20845f32cc066538ee3b424e34944f4f089b80a5
-
Filesize
96KB
MD5e352b9d9fdbcd275b8243d8f29279844
SHA14635504d7e1cacc8b8f8eb4f0c355ee2a4424323
SHA256f6dbb2dd39d7d522222a64287b4c1eb7e2381bb371d014475580a1a6abf6046a
SHA512f962f0f6ee7c70394f3e86d663ca7c1030865f87d34e0b1200dd4fcc4ac4e972c1e5968b7568fd82cc040b24f45c670a794d18f247afb3f0895eb41deb30f782
-
Filesize
96KB
MD5e352b9d9fdbcd275b8243d8f29279844
SHA14635504d7e1cacc8b8f8eb4f0c355ee2a4424323
SHA256f6dbb2dd39d7d522222a64287b4c1eb7e2381bb371d014475580a1a6abf6046a
SHA512f962f0f6ee7c70394f3e86d663ca7c1030865f87d34e0b1200dd4fcc4ac4e972c1e5968b7568fd82cc040b24f45c670a794d18f247afb3f0895eb41deb30f782
-
Filesize
96KB
MD5abcda20e64ee91fd77faa8b820982612
SHA19c59d624eecc96c8e97f1f0bc6ade00d32a21b6b
SHA2560389bd306382998d7bbd853340d9d690dc9bf4c889ef89d0ed2e4fc12378ccab
SHA51222de7140e6acf2ea5eb6a5f98a9f75e94ba2c9f976117cab30bcb07f502088a82380fd3cb02abd013440817f13431bcacb2d58fe0c0d0867c6815a38174cfa5b
-
Filesize
96KB
MD5abcda20e64ee91fd77faa8b820982612
SHA19c59d624eecc96c8e97f1f0bc6ade00d32a21b6b
SHA2560389bd306382998d7bbd853340d9d690dc9bf4c889ef89d0ed2e4fc12378ccab
SHA51222de7140e6acf2ea5eb6a5f98a9f75e94ba2c9f976117cab30bcb07f502088a82380fd3cb02abd013440817f13431bcacb2d58fe0c0d0867c6815a38174cfa5b