Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
24/01/2024, 05:17
Static task
static1
General
-
Target
718b5089505fed92d1a44dc0dbeb36dc.exe
-
Size
2.8MB
-
MD5
718b5089505fed92d1a44dc0dbeb36dc
-
SHA1
f4afe14c1b392514350f4495c44f998d3f19128f
-
SHA256
df872b0b7c336241db1a1ff9e83100d6ffb2b898a46c0c7b37a47dcbd002b056
-
SHA512
4c9d292125343b5b7edfe0051454fff957c040fd822e9b9d32f6a94d654dae778ca6fcb1e269adcb83363b3ade2893ae2ae63558f2906185ed67298c841bc807
-
SSDEEP
49152:xcBszOxu3gCpbwOXh+1b4yFjErlsV6SP5iWyZ9KFFdZyZmj9MJ0yEwJ84vLRaBtf:xSizpbwOxKb4y8sVwWyZ0aZw9zCvLUBN
Malware Config
Extracted
nullmixer
http://watira.xyz/
Extracted
smokeloader
pub5
Extracted
vidar
39.7
706
https://shpak125.tumblr.com/
-
profile_id
706
Extracted
smokeloader
2020
http://conceitosseg.com/upload/
http://integrasidata.com/upload/
http://ozentekstil.com/upload/
http://finbelportal.com/upload/
http://telanganadigital.com/upload/
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" sonia_5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" sonia_5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" sonia_5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" sonia_5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRawWriteNotification = "1" sonia_5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection sonia_5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" sonia_5.exe -
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Vidar Stealer 3 IoCs
resource yara_rule behavioral1/memory/2936-177-0x0000000000400000-0x00000000004C0000-memory.dmp family_vidar behavioral1/memory/2936-176-0x0000000000320000-0x00000000003BD000-memory.dmp family_vidar behavioral1/memory/2936-387-0x0000000000400000-0x00000000004C0000-memory.dmp family_vidar -
resource yara_rule behavioral1/files/0x000600000001530e-35.dat aspack_v212_v242 behavioral1/files/0x000600000001530e-32.dat aspack_v212_v242 behavioral1/files/0x000600000001530e-30.dat aspack_v212_v242 behavioral1/files/0x000600000001530e-37.dat aspack_v212_v242 behavioral1/files/0x000600000001530e-27.dat aspack_v212_v242 behavioral1/files/0x0006000000014f08-49.dat aspack_v212_v242 behavioral1/files/0x000600000001530e-54.dat aspack_v212_v242 behavioral1/files/0x000600000001530e-53.dat aspack_v212_v242 behavioral1/files/0x000600000001530e-52.dat aspack_v212_v242 behavioral1/files/0x000600000001530e-51.dat aspack_v212_v242 behavioral1/files/0x0006000000014f08-50.dat aspack_v212_v242 behavioral1/files/0x0007000000014b46-42.dat aspack_v212_v242 behavioral1/files/0x0007000000014b46-41.dat aspack_v212_v242 behavioral1/files/0x0007000000014b87-40.dat aspack_v212_v242 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\International\Geo\Nation sonia_5.exe -
Executes dropped EXE 13 IoCs
pid Process 2828 setup_install.exe 2860 sonia_4.exe 2892 sonia_1.exe 2912 sonia_2.exe 2936 sonia_3.exe 332 sonia_6.exe 2548 sonia_7.exe 1188 sonia_5.exe 2476 sonia_1.exe 1248 Triste.exe.com 576 Triste.exe.com 2136 RegAsm.exe 1876 ucjjgiu -
Loads dropped DLL 44 IoCs
pid Process 832 718b5089505fed92d1a44dc0dbeb36dc.exe 832 718b5089505fed92d1a44dc0dbeb36dc.exe 832 718b5089505fed92d1a44dc0dbeb36dc.exe 2828 setup_install.exe 2828 setup_install.exe 2828 setup_install.exe 2828 setup_install.exe 2828 setup_install.exe 2828 setup_install.exe 2828 setup_install.exe 2828 setup_install.exe 1996 cmd.exe 1724 cmd.exe 1724 cmd.exe 2892 sonia_1.exe 2892 sonia_1.exe 1892 cmd.exe 1892 cmd.exe 2556 cmd.exe 2556 cmd.exe 2912 sonia_2.exe 2912 sonia_2.exe 2936 sonia_3.exe 2936 sonia_3.exe 2780 cmd.exe 1672 cmd.exe 332 sonia_6.exe 332 sonia_6.exe 2004 cmd.exe 2892 sonia_1.exe 1188 sonia_5.exe 1188 sonia_5.exe 2476 sonia_1.exe 2476 sonia_1.exe 2320 cmd.exe 1248 Triste.exe.com 2192 WerFault.exe 2192 WerFault.exe 2192 WerFault.exe 2912 sonia_2.exe 2192 WerFault.exe 576 Triste.exe.com 2136 RegAsm.exe 1876 ucjjgiu -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 5 ipinfo.io 7 ipinfo.io 19 api.db-ip.com 20 api.db-ip.com -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 576 set thread context of 2136 576 Triste.exe.com 55 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2192 2828 WerFault.exe 29 -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ucjjgiu Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ucjjgiu Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ucjjgiu Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sonia_2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sonia_2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sonia_2.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 sonia_5.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 sonia_5.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 sonia_4.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 sonia_4.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 sonia_4.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 040000000100000010000000acb694a59c17e0d791529bb19706a6e4030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47409000000010000000c000000300a06082b060105050703011d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c00b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f00740000000f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 sonia_5.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec5290f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae474040000000100000010000000acb694a59c17e0d791529bb19706a6e420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 sonia_5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 sonia_4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 sonia_4.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 sonia_4.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3040 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2912 sonia_2.exe 2912 sonia_2.exe 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 2912 sonia_2.exe 1876 ucjjgiu -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2860 sonia_4.exe Token: SeDebugPrivilege 2136 RegAsm.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 832 wrote to memory of 2828 832 718b5089505fed92d1a44dc0dbeb36dc.exe 29 PID 832 wrote to memory of 2828 832 718b5089505fed92d1a44dc0dbeb36dc.exe 29 PID 832 wrote to memory of 2828 832 718b5089505fed92d1a44dc0dbeb36dc.exe 29 PID 832 wrote to memory of 2828 832 718b5089505fed92d1a44dc0dbeb36dc.exe 29 PID 832 wrote to memory of 2828 832 718b5089505fed92d1a44dc0dbeb36dc.exe 29 PID 832 wrote to memory of 2828 832 718b5089505fed92d1a44dc0dbeb36dc.exe 29 PID 832 wrote to memory of 2828 832 718b5089505fed92d1a44dc0dbeb36dc.exe 29 PID 2828 wrote to memory of 1724 2828 setup_install.exe 54 PID 2828 wrote to memory of 1724 2828 setup_install.exe 54 PID 2828 wrote to memory of 1724 2828 setup_install.exe 54 PID 2828 wrote to memory of 1724 2828 setup_install.exe 54 PID 2828 wrote to memory of 1724 2828 setup_install.exe 54 PID 2828 wrote to memory of 1724 2828 setup_install.exe 54 PID 2828 wrote to memory of 1724 2828 setup_install.exe 54 PID 2828 wrote to memory of 1892 2828 setup_install.exe 30 PID 2828 wrote to memory of 1892 2828 setup_install.exe 30 PID 2828 wrote to memory of 1892 2828 setup_install.exe 30 PID 2828 wrote to memory of 1892 2828 setup_install.exe 30 PID 2828 wrote to memory of 1892 2828 setup_install.exe 30 PID 2828 wrote to memory of 1892 2828 setup_install.exe 30 PID 2828 wrote to memory of 1892 2828 setup_install.exe 30 PID 2828 wrote to memory of 2556 2828 setup_install.exe 53 PID 2828 wrote to memory of 2556 2828 setup_install.exe 53 PID 2828 wrote to memory of 2556 2828 setup_install.exe 53 PID 2828 wrote to memory of 2556 2828 setup_install.exe 53 PID 2828 wrote to memory of 2556 2828 setup_install.exe 53 PID 2828 wrote to memory of 2556 2828 setup_install.exe 53 PID 2828 wrote to memory of 2556 2828 setup_install.exe 53 PID 2828 wrote to memory of 1996 2828 setup_install.exe 52 PID 2828 wrote to memory of 1996 2828 setup_install.exe 52 PID 2828 wrote to memory of 1996 2828 setup_install.exe 52 PID 2828 wrote to memory of 1996 2828 setup_install.exe 52 PID 2828 wrote to memory of 1996 2828 setup_install.exe 52 PID 2828 wrote to memory of 1996 2828 setup_install.exe 52 PID 2828 wrote to memory of 1996 2828 setup_install.exe 52 PID 2828 wrote to memory of 2004 2828 setup_install.exe 51 PID 2828 wrote to memory of 2004 2828 setup_install.exe 51 PID 2828 wrote to memory of 2004 2828 setup_install.exe 51 PID 2828 wrote to memory of 2004 2828 setup_install.exe 51 PID 2828 wrote to memory of 2004 2828 setup_install.exe 51 PID 2828 wrote to memory of 2004 2828 setup_install.exe 51 PID 2828 wrote to memory of 2004 2828 setup_install.exe 51 PID 2828 wrote to memory of 1672 2828 setup_install.exe 50 PID 2828 wrote to memory of 1672 2828 setup_install.exe 50 PID 2828 wrote to memory of 1672 2828 setup_install.exe 50 PID 2828 wrote to memory of 1672 2828 setup_install.exe 50 PID 2828 wrote to memory of 1672 2828 setup_install.exe 50 PID 2828 wrote to memory of 1672 2828 setup_install.exe 50 PID 2828 wrote to memory of 1672 2828 setup_install.exe 50 PID 2828 wrote to memory of 2780 2828 setup_install.exe 49 PID 2828 wrote to memory of 2780 2828 setup_install.exe 49 PID 2828 wrote to memory of 2780 2828 setup_install.exe 49 PID 2828 wrote to memory of 2780 2828 setup_install.exe 49 PID 2828 wrote to memory of 2780 2828 setup_install.exe 49 PID 2828 wrote to memory of 2780 2828 setup_install.exe 49 PID 2828 wrote to memory of 2780 2828 setup_install.exe 49 PID 1996 wrote to memory of 2860 1996 cmd.exe 48 PID 1996 wrote to memory of 2860 1996 cmd.exe 48 PID 1996 wrote to memory of 2860 1996 cmd.exe 48 PID 1996 wrote to memory of 2860 1996 cmd.exe 48 PID 1724 wrote to memory of 2892 1724 cmd.exe 47 PID 1724 wrote to memory of 2892 1724 cmd.exe 47 PID 1724 wrote to memory of 2892 1724 cmd.exe 47 PID 1724 wrote to memory of 2892 1724 cmd.exe 47
Processes
-
C:\Users\Admin\AppData\Local\Temp\718b5089505fed92d1a44dc0dbeb36dc.exe"C:\Users\Admin\AppData\Local\Temp\718b5089505fed92d1a44dc0dbeb36dc.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Users\Admin\AppData\Local\Temp\7zS04350016\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS04350016\setup_install.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_2.exe3⤵
- Loads dropped DLL
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\7zS04350016\sonia_2.exesonia_2.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2912
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2828 -s 4123⤵
- Loads dropped DLL
- Program crash
PID:2192
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_7.exe3⤵
- Loads dropped DLL
PID:2780
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_6.exe3⤵
- Loads dropped DLL
PID:1672
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_5.exe3⤵
- Loads dropped DLL
PID:2004
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_4.exe3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1996
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_3.exe3⤵
- Loads dropped DLL
PID:2556
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_1.exe3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1724
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS04350016\sonia_6.exesonia_6.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:332 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cmd < Compatto.rtf2⤵PID:1512
-
C:\Windows\SysWOW64\cmd.execmd3⤵
- Loads dropped DLL
PID:2320 -
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^jvMDwkwydQdmnxGPmMOjYlbIlopECWXOZojRKCmISYgoKPYfXOyLKoMeYraSevCxTCAdoOyWjyxqVfYxlTHNQkrRvpTHpGGccUgofIipJpnFNMuJyYIpPPDHnITYVnMGn$" Oggi.rtf4⤵PID:664
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Triste.exe.comTriste.exe.com n4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Triste.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Triste.exe.com n5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:576 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\RegAsm.exeC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\RegAsm.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2136
-
-
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 304⤵
- Runs ping.exe
PID:3040
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS04350016\sonia_1.exe"C:\Users\Admin\AppData\Local\Temp\7zS04350016\sonia_1.exe" -a1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2476
-
C:\Users\Admin\AppData\Local\Temp\7zS04350016\sonia_5.exesonia_5.exe1⤵
- Modifies Windows Defender Real-time Protection settings
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
PID:1188
-
C:\Users\Admin\AppData\Local\Temp\7zS04350016\sonia_7.exesonia_7.exe1⤵
- Executes dropped EXE
PID:2548
-
C:\Users\Admin\AppData\Local\Temp\7zS04350016\sonia_3.exesonia_3.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2936
-
C:\Users\Admin\AppData\Local\Temp\7zS04350016\sonia_1.exesonia_1.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2892
-
C:\Users\Admin\AppData\Local\Temp\7zS04350016\sonia_4.exesonia_4.exe1⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:2860
-
C:\Windows\system32\taskeng.exetaskeng.exe {0AA21CB5-7A9A-4DCD-9A19-7C6598BB90FB} S-1-5-21-1268429524-3929314613-1992311491-1000:XBTLDBHN\Admin:Interactive:[1]1⤵PID:2464
-
C:\Users\Admin\AppData\Roaming\ucjjgiuC:\Users\Admin\AppData\Roaming\ucjjgiu2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1876
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
478B
MD5b96b1288ce038869fb15d4353f760613
SHA15a6f01cb0546a6dd4ae1e90279aaa82bdd672b60
SHA2562c1458ecd2cc31a6d798a1c6396926cb99a66481832f774dbdbc19594ff9bd40
SHA51236a72a5cac8b1aaa395d9efc2fc79b4525e408c57cebaaf2f00c1ba5b51bc08ee22e5676055cdcc961197c05e41d020c8d74b0d95426095d1a5b04fb14d3b04e
-
Filesize
6KB
MD591cbc40065525a70b750a918c34d7af1
SHA16314f256b9a44f5f621079b050dd691d2e1ff4c8
SHA256cd094fa365c4acceef1bb53788e7608f2b53182b409b6e813c7bc28d3d309cdf
SHA51205a506cc16a56ba8ce90a95da2b54ab9e92389e960e8bff5583673f5221d1f152a9a6b90d9a5d82f7619bd5a7807875e123e7a12659e641d9d40ca19e05929dd
-
Filesize
62KB
MD5bd16f5fd46ca118065d066c82887408f
SHA1c9f50f37fb66b9b11dd8ae430075179f8448ede0
SHA256016238bc14b9874d00224613aaa18e9014d8043aece4277f56f0db6a7b0a5e5a
SHA51235c5f762d1a20353c2d2a8faf57b2e2001d382956038c9e3a9fa99ce3a364a9a7eeef4f2875d782e3ded8702b54f342f59e57ec4e58195903e70e90c45359c1c
-
Filesize
57KB
MD5334ff4c14d881a08ddd57b80dd3f5354
SHA1572da2d8b470e149b0b45e47661a6edb376fd163
SHA2569f5b800b52687a605c33ad8ca17d04c25ab9ed9d1095a9cc015f7c912bb61db5
SHA5123e26964d612f42537bb7fbd0b01af96bb040fb095b2fcd435b529ff6173000f0e84e7be07f8fada20c7a9f31a5d252cb38573f5dcf863ce6036b0bc7535d4e84
-
Filesize
40KB
MD598629d98f1a3599d9c8282e2da55469d
SHA1afef7620a23ebd94af033afe9d9176d3c4b4d98d
SHA256687738610f65030952a3bcd82429a02ed2fd2343e88d86b90cc85af93afa9ed1
SHA512deeaf3742dbb84bcd41a88b24b7225b59c4f4999ead53f23c33d7c20cc6f32f9f8bef3b23ff175686f6548be21f1148586090409facac4953d5915954cd76794
-
Filesize
42KB
MD56c9d054a53edaa17ea63adc2d17b699b
SHA12f678e76eac0813045c0348980b5aaff8a66b3c7
SHA256009e1b09ac096636f7f7de2e2838ffbc203a90495ba68cc6a340487932b32654
SHA512a6a42349e8291119c9bb455fc64922cd6519196e597568756a5ce40332a50352c2e6ce700c7c372ecfb05551e54db0141d12eaef8cdb571b4c00e90bc42d2eba
-
Filesize
218KB
MD5d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
Filesize
29KB
MD50c8c443df95ee7aa3ed873e6e7a149eb
SHA1ed1a2531a146b953807c87279f4e40a29c1e35e2
SHA256b143b4a311a64a15c7da24371f339610e0c603d4452ead18ddd67f9a2094b9ac
SHA512fbf89e8a4c66dc54bba5ee8b08aad78fa6e3be3e4a2910c4ca2becd7466fdae68d1bb575dd446df97e24f9d06cc0f85b41afc28907e859721ecdf0c186dbdaed
-
Filesize
69KB
MD51e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
Filesize
119KB
MD5ad2bc6cca93cdaaf149e47de7b52ea9a
SHA1fc023d5de5d7a4b88546b8b07d734430f291997a
SHA256996d466bcb8f1c0c6798e32f0d6b522e369be2b9d078420271673bded1a1ca72
SHA512369dfd756b0139e85e53717c445a25ecf329ff0e0f5ee7e6d92b693a9670a2337b25c560fe417e69cc60ed04804b8c33376215c204daa4b1f21aaccbf391ba44
-
Filesize
110KB
MD51dd8b44fcee0aa52fbd245b89126b1cd
SHA1ba7922449fe76db186c99add51c4c182749bc4c5
SHA2563a10750c6a2763893ccecc91b299f18848645d0f51488c325bc564d429834e67
SHA512e068304a4d41f0fda4b026502a18b1eee5d40dd9fd36552cea0107440f6d1cac37aff8bf54a20692ae50f7a3eae89cf4a5f0bba96b91a56d0f0f0ff51ae36dfa
-
Filesize
208KB
MD55349ddaeb754e6d0cbdce89c85d9010f
SHA1d919bc726edfa8d51dc9c5ab2d7eab160d475b2c
SHA256aa8da6c93cf8da60b501c4cdda6f74fbd9b2b0a4e41c52667b6723ed26bb2a3f
SHA512746d4a23cdae40cd929aa9ac83424221e06e43eb696b41cce08ee6e41c4e76b98aa1f8a9eaf859352a931f49d292ff24b82a8dc4fe43c324ff5385cef8a80083
-
Filesize
42KB
MD5d111700237dcef28c03922d540dbd533
SHA1641f134fb9a4c2d0de8fb1b4d950b4bc1fc49238
SHA2563dda909fc42e43ffb6c0ee29f6309e7c1c4aaec7de232c836deda1a156e2d796
SHA512c61566787b7336b38e0c6557fbf7f45f7f38f96d64e8c67f18642b08212f388c028fea2674068ba11ba7f95e0326e8e8a465f65af6775881eb4c2f49fa857abe
-
Filesize
195KB
MD5b261ac32cd63acc343e5607dbee3ad2c
SHA113c4d3ae1f60c84c0cdc5fb626df504f9b7d57f2
SHA25656bac6070a97035a7f0451989f448126cba77d8fcfd71177748717c06984aeb9
SHA51299b663009b5bbacb56b410d1780250aacefa3c1abf17ecf6b25d48125b2abc5359c7fef355cbf81daf7e6a95ec4f8e4d03a79a7094e0f85f3c9cde6a04996bf8
-
Filesize
37KB
MD5e34cbfc3365cbd8e9e67747819c866cd
SHA12b4dc670bc5b794a9faab6b0b7b8bad9c2f1c477
SHA25685472eadfae9b6bfae2efed6aaef6f7c659bd7ef902134bfa8f615f798ac6947
SHA51233a3031a0bd063c3c81a95d9958a5c73cfa7427ae824b629ffc566510431acfc7b70b2cc62649a783e67a785655826af59b43bb4f55535226e6897789b04147d
-
Filesize
207KB
MD5c1b43323e6629fb1417c7c6a5ac897e8
SHA1100a9cf6760f3981963bd0f3752397e7baad40b1
SHA25651dc2706d16571fddb5378a502eda71ff90df9111208e217e69f6948373e76aa
SHA51225443d469d0f1be5cccb9c3dd8e1c348426e50ed074a26a38e2cfcbd7f062cd09d86800172aa01ef4b3e380bacb88d3c04beccc3591831df194a83eb72148095
-
Filesize
117KB
MD57dd2640ec31132a5496cad4094d5077f
SHA176aa4cdafa07236e3869192d3a253d29e77644ba
SHA25662a55fe169c776651d2c4061597373cc19a9fd89660eb1c6d0a17c0231cb7e18
SHA51283b35f90d02055c738670c7216ef68d6a2abbcb767be034a52df789063eb8771babd1720e47963be05d4b099f73696a5ebda2b170acfa386ed402160d8685095
-
Filesize
56KB
MD54309d8276fa38cca6c22b35004b600b8
SHA15d9b2f5f86d701b838dcd5093049676f71a7f068
SHA2569877277583c7e5cfeda689b162a35dfeedc1c9b4620395f801bfb452b9765162
SHA51269ad1f90fd33ccd9ed07cc8a55e388ac6ee43fc76ab87ca06bd29eb716ceae006f1f4213382002ed89778e9d14fcb82219de27eea8ba63e7b0bb69475b4685fc
-
Filesize
43KB
MD557bea39f489ee17abb18c2588c2674ba
SHA15da1a2338ae74935a23cebcf561822f667ce6832
SHA2567f433aed7d0c682f0ee4eddc7355f27dc3f2b4cf211a2479790ba1cd7a4f25df
SHA512fcd5f5e33696b7a5eb366a85d5cd0fa57f3da74fb1222691860198196fb51c2eb96d5baf053bbf581ccd707df9bb9ef07b67d89754e480cb417a90ba9a676c05
-
Filesize
125KB
MD595dba0cb83e528b92314aeb429e9a8a4
SHA110d48488ab99aad69c6137d3c858f7e926848ee2
SHA256edd793e6011b0107c797036f8b61881a4c833abf09f0b997f7efea73f564840b
SHA5129d62893f07fcbf59a97e0b041de469c51285dfe19903552b57e6b41b2a39fbd6fcc6745567af5feffce372b38e5c883392de59d01d717efddd361aa4ebb6581c
-
Filesize
84KB
MD5724d6150d02d685749a78f958e618071
SHA125571aa4878c87990411cf55765ca4db729b05d7
SHA256ac6c1c0ce5c488607baa6f38caf202a8fbc88e8e8c3d7b26e86b3134c0f4d239
SHA512696fcce1e707774c038263d972eda7193d1f415a2637871f4a603a0238ffd0078ec9d38c382cb97d77bb1127d0c5bc3a0909bbbeab9a24c2e5a30f7625cbebe5
-
Filesize
37KB
MD55e3dc144664c40b3a3adba00aae8982d
SHA1fcc73b487cfb1dcb87f9d4206338a32cb5fdadf7
SHA25636dbf68d83c7318eacff6749c8a6b0d39079737bab3e515834da6a85359e54e7
SHA5126cd90942940e5c278f7ad66cd34f3becd387a862423e1f3070132da6c4b2d49db63ee8c87b5eb27ef13415cd489a46bf443da1bbbba91d0655422897dc9b8779
-
Filesize
51KB
MD54cdd0d6f7ecce9edb7757f3cb3574ae2
SHA153a212be4f3415dfb694fb43c52837083ab6fce8
SHA256e192a337efda6db709e28013f3f537efc4c2988053a83a0dacab8287146836e2
SHA512b7fdb9c6a4d3e04db4d13bf8c764e1e04c876b38b6d588dc2c80ce10bffb6819f0520d3d575c09a0747a55c49497c09f6892fbf89f84a4d768fa09a106223a5c
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
3KB
MD5e43c9353d6753770f35d83e855f6efcb
SHA146c78638c4f0f2d0ec903aa4bf52be5517fa3f7e
SHA25602095e47473402ab4bb3c34ce1eec51e90ab4d732b919fb67d1e87fec1424420
SHA512e60d77cf455968554b6dfbab9bb4229a19d1e198c165746486afc860bfe93b5622d199b1904272f47ae5b245ca5fd46b183b3356c837da53b055ba9079920cc3
-
Filesize
326KB
MD5f913fe3944a551fdd0ef4203669433d1
SHA18d4343a03b442f65459bab83f27a6afbbe6d9966
SHA25665dbd61de49d92efb40971ce00d7e1a7861721499711ef53c48f10e5bed69867
SHA512608afd5de8afebb5b53bc98a8f9e97eb8c4884935f74f6de1b4e300d2f3cdb1e1914c95a1ed5404542b5d70d6db3d1c25a64e244c5513c04d0f410b71c0b22d7
-
Filesize
65KB
MD52e4aae339d96c4e2ffaa19f05a2ec720
SHA19637f0fdcbb901632962619594e56707328197b4
SHA25691b304a2c0244191eafce605a8d101c69e715a8bac7e6186108a3ef0629a8131
SHA512a8e3b71253f8565ad2878cd332da818da31fae8a7c4a0eb2173825c0fb9b731892f9054d75cb3826075f4f99d5493bb3b3813017cc15080e6ce28800dd88f6d6
-
Filesize
60KB
MD5119f8ede58b498c4caf124cf261d42fd
SHA193fba62a6c1d58a9455b33e254b9fa5bcfd836d5
SHA25623653678ea49cf67084de8bb500ed664d3e7c130c4d88d2b8f337073d4b883c9
SHA512b5dac5e98a7a8dbe8328f01dbaecfc4ad3b841ed719590d035f9a067fcd404a121da654dc37efedcc478d94f7b13c589e80447ebfc5659f64c502c13530c5659
-
Filesize
170KB
MD51f0c81f36d84a7bb8c1ef74b5d16770f
SHA1ec29b422dc857c2ac2a5488cac136ee52cce5b15
SHA256aab042947a0d2b6f52e7348377a446618d64e7b6b5a871ff3af405bf3e417e77
SHA5123980ae92b63c18c9df01073d2674b796c211362922461e93c23d64d65bd023ba49c8cb41fd2651b2dd4116a7ddb26f95f0654f0c634994bd6afd37fd02d67e78
-
Filesize
54KB
MD5e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
Filesize
113KB
MD59aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
Filesize
380KB
MD5a3e794a1fdb9f4b8cca43caaa5a49049
SHA11e90e0122ae4431f496f4ad705adb0de815d6fa0
SHA2562c5b71a5a10b700ff681090d7bf33fe2e60890b31e70f086d6e72997ed46ece6
SHA5127f67de81b3184a45319d21247729e93bd51be0e2fab8e6d21b6c3c89f79d04605206c2ed54baa12aad14dec4514aa3f373fd6104a594711b0caeca4571e09be8
-
Filesize
57KB
MD5e3bab653a37ab24f526dbfd5665a36c4
SHA1b2f34374831e23e62e7e6cf0affd7e150ffcff28
SHA25636133cb56ad9e5f08be272327ca323abbc2f0fc18136c7ac3205a0ddea7e8891
SHA512925e99c6a3c7c3f4aaa491161ae50e60fa0eb244b93cf7ff7416dd8cb6d7e8a473632a356228ea2dd32dab49e9764eb481a933b47ec47a47da3ba6668cf5f05d
-
Filesize
106KB
MD57042af330575cbd878a49e5c1f1f7239
SHA11980faa04dead9653cfe8462d1e89b4c74ea4041
SHA256ea6b668f0d2f8b3d12384e2eeb7dfcd504f9d8b11f83cc32dfd87745c3864e7d
SHA512c2255b40b970364a82a7db9a1ba7490c4412626631f1b2ca4c500c0a3caab44e6fbf2ba1d2d02423eefb5f30e225b10b4409807686938849c13fa32047d3dffc
-
Filesize
106KB
MD58fcad85f2b6c0f3cd90c27e78ffebc7e
SHA1b56ab6d32a4dfbdf32e993eda24948aac81ca8df
SHA256726e7206f5095527928f4de31f66b693c0bd8da29fd95597f8848718f035c388
SHA512af53b946a04a508a789bb50653e8a3ad7340495b0a4167802bc900860df45f2c404b1f76405cb55eb516b06423b19edb7612211cb87b06707c3dc13340543946
-
Filesize
171KB
MD5eb306d3a55b4d2142ea2376afa4782f8
SHA1c24e0744780948a83f7779ea3ceb6a6a855babe0
SHA2561eb9c5496ebb00a58f1e813d5eb6de4b860ddcf95b61b2ba1ba02ca8de7c64b6
SHA512d724b45fb35cbce110c2ed2d9f0f1aff08ac46311f991cd3dc19f13f9d120483ca372f4dc7cca52a2687ebf555f13672097cd7a84f49e1ed9921cf8238fac223
-
Filesize
205KB
MD54de28162042a0e571edbe403cd1f44e0
SHA1f8254b3658a6baa09e9df67c4e4f6dbc8475048d
SHA2568fcfaaa67848892e4488003c9cd45d9da8e5b407159fba9f5cffc192c8f058f1
SHA512f2d747315c222ac06231ef3ca2134497659d0d7f8c0ab5652320eefdfdb2efa423165d5f95d5d13b82102b33cb93ca5c52ecd26d1e2f0e389f11c23f552f1ae1
-
Filesize
211KB
MD570a123695996aa84df4950b33cc98fe7
SHA131287d9c76401389d4705798e955583c6021cde9
SHA25602a4347823cf6c28f8a78addcb496fc9a0e3d838275b490bd1d0057e5b457b1e
SHA512200979284098c9a3a24fd9365ffc23965667c4cb23e9067accb9616fdddbb821db59032fa8056c6cf4f9da91e7041fd45b63e2dc150c49f17b0db080dce62f91
-
Filesize
8KB
MD5048649053f5b07b3162de20d96390270
SHA164cedf77004880a591993da9536d29a660d87596
SHA256f70beb9e37f832b6bc2c7c325645cdb31a61d38b89e48e37f2c042f7ecd76b5a
SHA512c1b5f9fd6c58a006ecb09550d74031f79c218953b29ac3892740af8dac3b7e248148afddeed4ef8eb96304cef29f3fdd0a9f09e96d13a9ec904660ef862300c5
-
Filesize
56KB
MD5c0d18a829910babf695b4fdaea21a047
SHA1236a19746fe1a1063ebe077c8a0553566f92ef0f
SHA25678958d664b1c140f2b45e56c4706108eeb5f14756977e2efd3409f8a788d3c98
SHA512cca06a032d8232c0046c6160f47b8792370745b47885c2fa75308abc3df76dcc5965858b004c1aad05b8cd8fbb9a359077be1b97ec087a05d740145030675823
-
Filesize
29KB
MD532f3e6e34c56a7366e7e6c2a6c949c9f
SHA1d84536e3deff156ea900cf32bde54f4323227197
SHA25666979be1dc1036d1cae7488ca003f9be0e7bebf5c14bc08b41269ab83f3bd9f0
SHA51204f0ade8f16688a80ff715b9bc7628d35cef124579a0c30b5fad47147dc31bff48a1ff319702c08f2fd698d031eeaae92416a2dad3acf6c6072f48ebf195ce25
-
Filesize
32KB
MD521f2c334aa528edf551bad65badd1914
SHA12f13097ffab04a04303df2900ff599fd91fb7418
SHA256b483c52cd78ae25f527ff356481cf3b72c05eb1ed3efd15ffd749b9b580d539d
SHA512cddaf75dc4ac904e05cd7b30d1c045c33375be4ff3935a83f6a894fd0e23f6f39bd3fb0e0860bdf0f9a65723b2fd9cef906142fa804ddfdecd78d8ee8d1a8bd1
-
Filesize
228KB
MD58f1ccd8da5a204f0ae0464169fe5a616
SHA14d54e69f70f250efe8cf7eafc8c0f203873ae834
SHA25626fe34dd0d63ec4ff44454ef4e2ad32c63c859b4e8a6259cb18c48d04361cb3b
SHA512c42b7cd90cc9d511bcdc81590a69535a1edf0c42f1e3054f36004d9242423e3b82a47bbe9e2e9db7ed66b9218472e36c531fda56fea750cd7cce642c0bcda713
-
Filesize
92KB
MD583783371f6b7e9b04d449941cd069aea
SHA19a3824b80363041e371d83b2412f40f04c957251
SHA256288651b1703f5377dcf64ae51278cf257dcdd131601b75b84d2f00a586e7ed1b
SHA512aec3b2cc51ebc565089cdc128eec5ba119be27b9f6fdc809516f4c374e944657c4300fff64dd448ed67366cbc4a36fd0fe2fe43cc7fe8116008bb73bf03db0fb
-
Filesize
108KB
MD5aa9841ba9004080d4db2b8873828f258
SHA1977ac99c25c8256d7cb29f7a0e9718688d185ebd
SHA2569aadae76a38fa44bbca8f9a6eacc6101b2ae6f67ff794730142312a4d5fa35f6
SHA5123eacff4af8c2a7e50eb411fffaf812168afc0425a30a3ef3dc2a8005a5b64f48ee4ffadf3d9f1a5aff1839fd1b2c1e1c99379fd2e5610c430b30497d1e51f988
-
Filesize
65KB
MD55ce53bc15e96649673ca7c47671db522
SHA1a91f9671fd77e4b8149d68fa5b94572bc8ee4188
SHA256b5f098979af7c9ca88c23d46fd6a5295cf9edb9977a57c5d24d760658dd82159
SHA512b2654748070ee28ac0994776d13970a38792328f16f08651e2f378cbfe0529a0ba0b673c6d3d71f6a0b8fa4959c5e382efc6faef63567dae18db8f1c303e5880
-
Filesize
88KB
MD587a3724076ac0cc3410f4a4b43f0e633
SHA109c6eefdc7c56f5e88e8f0f8bc5239235f6f43be
SHA256ca002033f47ab04ca01458e901bb7648c76db5509c104a186e71979e78b9ac0e
SHA5128f99aef6af64cbc5295c86588e6b7c993d242fcfb48fc93581d12b7227b95a19c9882b94f6f314fa6569828d62936c1612b486279d94aad0cc80a9c79aff5b6d
-
Filesize
75KB
MD5968f0d2b2b91d76ca3d076068cb39e5b
SHA18cad72a36f2023f1cf4dcd8bc12a5c5a246eeaa7
SHA256dac0188b7daad358bb26bfb8924c9366f566f692c06e98e47f2c1ef86f1a019e
SHA5127f08ad6c0869af3fd39caf2f81e732244363567bf2fc25f562a0ac6ddc7d6c99cebc47c7d0b56136159c39b5c8c8c5bf3eed63deefc62451a6c69589f442c08e
-
Filesize
125KB
MD57a1dff6384b2715e9c1ad9ee7d090233
SHA1c46fc5a54ebeafaf37e2075f144982e67341caa4
SHA25653a16df32824ecd0b8f18c7c77eaccfc50419864ebc3ddd2def1f4553ee21f75
SHA512ace59327b3cc845b5892a8b6c4d7d1ac9e39bb578a8848bc4d3de5f97dad122507a2f8beeb40d74ca5a8f2cfcef1d6d20bc5082524375ec5cbd8d54c18d19de4
-
Filesize
61KB
MD5d3a2c8c4ebaf324cfd10f0d4b57a8641
SHA123b1be3404cb35586d85d5b3a0e73161a6c6c8da
SHA256b82314e843af405cfa814c13eb47c360067592c2d25ce449e23c6a400ede7f4f
SHA512bd72b4591ac07adbfdb15d87d280ec09a3ada11aed542806b5b379f60480e534f748fe3792128f2c326ee807ae224a3bb87e58b12786094dca4edf2447b3e4a2
-
Filesize
18KB
MD5c969398df911d2c584142de205a1fd6b
SHA10dfe2198a8ce1e4f871d510900d8e97b487548c7
SHA2567b606649224e59e85f63f54b20e22d21358034ba1ae19cddde8a7cdfaf8df767
SHA5125729f33a6afd8c2dc0fed6851da6dc4576262cc6351a4ee60ecf6c4e37c8c43c788e4a248baf3bbda9fee0b6fc0c49b6734c8b321e9d6bfc97c4b78759391c57
-
Filesize
53KB
MD5b5ff8ceb97b68f0b3e62ab4906af39fa
SHA18a2b089b040f279833e3b9cf37fb87186877a156
SHA2562d7a50b87116519f32d4c533750a9e6068925454afab7c47c639886c84e6da1e
SHA512d48b8e91394851582fa4040a21c76a1b1aca2f5e54d22d8ef5b9d783e3aa0e9d045fb7f746f967e1032d138ed222e902c00e8e19b366cdb1496e15b934fa36b4
-
Filesize
27KB
MD5384063a2065e9910e436869a26ac408f
SHA16492c6b8ffc709cd8cf65582d963fb5d7de47b6c
SHA256ed066ae313aa9d9eb1ce3f7e347175f8c7e5427f475136ad6fe70a69b4d26140
SHA512ed11596b6e92112c701376025698a25b6a2cc9a45bb6c22fc234ddec897dfcde1a7284cb56dc673dbaf51c5a46953fa61dfc57ed7762738b87b6670645bcca06
-
Filesize
25KB
MD509e4feaffb26ba11f7f87055de2bbb42
SHA141629fc96ea7ff4d5931fae95cfa749df2c4f5d7
SHA2561a21b508e2f9a2741a33b0ef0883d850a9af2daaad393ded73e493a7ee9660c5
SHA512d548a629be5c43720ca715f671ec86630320272b93f26cfcfbc12556a279ffe598d1e411abf9687582266ee6aeea2810e30de63daaa869d150b61daff7bd97de
-
Filesize
52KB
MD55c857a111fb80cb81e8aea99a1aa3261
SHA19601be2b29c5ae89c939b930ce3a6d3bd4f86058
SHA2560eb97c08816198829b74111435bd7514aee8b0e016e8f0f56e3ec86fe7fbf439
SHA512c5f789bea7729fb75f3a566866c858f904f68081260f91cc280736cdf318f47f89f7a7d514f3f85b2bfdd4b75918eca7aefbb8ba15aa77cc95748f849cb1c69c
-
Filesize
80KB
MD5abdab795d9a07a3de24994acf52365c6
SHA174243eb28fc356ea687c66890e4e46ca728c9f14
SHA2567ed238a4dc82551ee90b5640f35df9bc6a5683499bdd098237b5e88cb56291ca
SHA51286e93c7113be24d2c9a1ac57d118ca7b51016e9c601686440b3d8692189b90d776cc353a408306072e1009be04db562b20877a651b08501e433ef80bd8188257
-
Filesize
83KB
MD5c83b8fb30df371b26e00286f8680ba1c
SHA198f6df5e39d0c1f6c3ca3a7924bc024c50199ad9
SHA256831f6d2b0bdd2d47be23c565d29f17a7798642616e12faa45b389a16e5c79e8c
SHA51292e1da27280b083b96bbcb725dc0131d3d494a414d09f7f9ed7fd3085381a3d47015b75f8c5c12678d553873f21fd3594de93fa39d1c0c49ae92c16fc70babe1
-
Filesize
101KB
MD5a99338aeb9e4ba1ef5bf0d4a6d452738
SHA1ca705655b5904648b9ef038e5e3160eb6d48bbca
SHA2562de420550f2ba9464d8f7f42b44a001e306e7cefe0e0db055e3656dd73e7f57e
SHA512898cbfb6ebb44bb6acbacc3c9cfa473ebb885e42fb3b4a9d58eff21ed007c0c3b2f5ca4358a7fb7b602d7b418961a5855a4f3826053a27a172a4ac63ef2c9c64