Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
10/07/2023, 18:35
Static task
static1
Behavioral task
behavioral1
Sample
dc2c38b145abe3exeexeexeex.exe
Resource
win7-20230703-en
General
-
Target
dc2c38b145abe3exeexeexeex.exe
-
Size
2.6MB
-
MD5
dc2c38b145abe32f3faa7f6206911413
-
SHA1
2e0d237c7742fd9159712cc3473d74c41215c617
-
SHA256
be9344bf0883a5f75e8a32e47c4d300d3db60a29995d9b49f2f0aa953b341600
-
SHA512
153988ecca2c7b2894a88d2d673acddad7cadf67317d57346b87336dd2ca2ce36fa8aa1e9a32fee717574903a070f9dfbc5ea73b64e164c64ad4f0f6bbcac448
-
SSDEEP
49152:IKYNu9FsGsL5tj1XUNgASK4CTfVf1WZ62sHzMb8uY0sZPUFo2+4rhTHZ9tHFjT1B:lmgzHwb8uYiF
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 4440 alg.exe 1012 DiagnosticsHub.StandardCollector.Service.exe 1360 fxssvc.exe 1772 elevation_service.exe 1416 elevation_service.exe 2712 maintenanceservice.exe 3940 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 11 IoCs
description ioc Process File opened for modification C:\Windows\System32\alg.exe dc2c38b145abe3exeexeexeex.exe File opened for modification C:\Windows\system32\AppVClient.exe dc2c38b145abe3exeexeexeex.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe dc2c38b145abe3exeexeexeex.exe File opened for modification C:\Windows\system32\fxssvc.exe dc2c38b145abe3exeexeexeex.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\cd18370fac07e206.bin alg.exe File opened for modification C:\Windows\system32\dllhost.exe dc2c38b145abe3exeexeexeex.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe alg.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaws.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmic.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\ktab.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\unpack200.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdb.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jhat.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\keytool.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javac.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE alg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jcmd.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\servertool.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jsadebugd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7z.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE alg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{6E6044FF-6EEC-4043-9795-F9B1393BB24E}\chrome_installer.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsimport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec64.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe alg.exe File opened for modification C:\Program Files\7-Zip\7z.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdb.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstat.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\xjc.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javacpl.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\java-rmi.exe alg.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1012 DiagnosticsHub.StandardCollector.Service.exe 1012 DiagnosticsHub.StandardCollector.Service.exe 1012 DiagnosticsHub.StandardCollector.Service.exe 1012 DiagnosticsHub.StandardCollector.Service.exe 1012 DiagnosticsHub.StandardCollector.Service.exe 1012 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 676 Process not Found 676 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4080 dc2c38b145abe3exeexeexeex.exe Token: SeAuditPrivilege 1360 fxssvc.exe Token: SeDebugPrivilege 4440 alg.exe Token: SeDebugPrivilege 4440 alg.exe Token: SeDebugPrivilege 4440 alg.exe Token: SeDebugPrivilege 1012 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dc2c38b145abe3exeexeexeex.exe"C:\Users\Admin\AppData\Local\Temp\dc2c38b145abe3exeexeexeex.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4080
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4440
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1012
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:1520
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1360
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1772
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1416
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:2712
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:3940
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5e81e8ae92c1f19d9606014936a79adbd
SHA1d3405f50b3032db6a640d49d266e59dd15121898
SHA25630ebb619da74243f5db992bfafb445be642e904c59a000b20879b4320eafa5a2
SHA512f557338e188516356130681b30c2929fd55e111eb7884269879bc4a1f2dcf2a491e6bf2fd78c419ff54698859aa7fe7f8964b7c8054cb8da2db4cdb4b01d6d18
-
Filesize
781KB
MD5c78a9ffca5511d674abd7e82245456af
SHA15a87ebc21074120c94637a06b437811a1c27ef16
SHA25697cfb37dd4d10bd6225c197e27a6833813831b487a018556f2c444cdf047d836
SHA51271a83ac5fb0dd7cabe9c10e4f43007694b737bb0deed4200286610e08c994d14ffa80c57cdeccaac80199d8d6ceb06ffa5ad905af0d1542f4643851e0cdeb221
-
Filesize
781KB
MD5c78a9ffca5511d674abd7e82245456af
SHA15a87ebc21074120c94637a06b437811a1c27ef16
SHA25697cfb37dd4d10bd6225c197e27a6833813831b487a018556f2c444cdf047d836
SHA51271a83ac5fb0dd7cabe9c10e4f43007694b737bb0deed4200286610e08c994d14ffa80c57cdeccaac80199d8d6ceb06ffa5ad905af0d1542f4643851e0cdeb221
-
Filesize
1.0MB
MD5d038f7ada3ea36d025c49968eb5cf3cc
SHA1042bf077e1c6f25938aff08614153ff91f9113dc
SHA256f0b95b6545ab260aef1ceb127dff4a69cc8ad2d9fcedf580a5bcb91a5807efea
SHA512b8ebc38483261b2531a252a107c04775f3210796098b869d33efb11402a1cd9d15ae0a5bb004e74dbdd813b27275a9c5cf45ea585160b9f9b6b2c3d5c054c61c
-
Filesize
1.4MB
MD59362ba9ecea266fd54fc965002919c78
SHA198c8afaf7dafc6320996ceacd1d5dc98005c32d5
SHA256b4d957417c6204d493fd3f1af6930f0710c125f88c30193886964b2762ae495d
SHA5124f3ba4262bc8bb69445dd579fc8b6858de5459ca76e27152a14b600423bd026d44b7e7484695b32d005c118c6c65be432e22a3636d62c65ebb97d16fdbcf217c
-
Filesize
1.1MB
MD59dddac7c8df13a431f2672b41da31b10
SHA13b07481a06cca9ed76845e84cc67d1bcfd20053b
SHA2560bbbd077ae7ceecc26c5d98f3fb4e982d51fa7685df38298e36f30c9efc7f74b
SHA5127a43047279574caa03e7fec3cbcebf8988a34c5da45bc499a296e6ff70bc574c69f79f8fc6a8b80b6577959e2a89724ad5267c55ecad926c2aca81173e0b1325
-
Filesize
583KB
MD552451674b7b74324fa42becff15543aa
SHA13b768c09de99731fba8c0bd45623c289e9e02b53
SHA2567ad6b99487bc3823b76dc35f75194e5107ee04904c34fea6d5eb362110945d07
SHA512a102ccb7ff742d4c1ee21dc55fad104096cecbe9df159f0bc54fa295212ff36a0c9a3d498699d70689b10b82b812b080e8a8adb5575078913f233e22210dd5a5
-
Filesize
840KB
MD5aae1b75dda999e0f74f4371112324430
SHA1663fd1f8d855cf9605f4518cff9779178e0c3445
SHA256ebc2df0eac125d0032f2fa4e217be8395960d59bf949387f423afe7d17787e67
SHA5120d8a7781a249c2a95e0a393e3330b5148a1533593e22b53b9f19b097f5e2e8e582c56eda2844de882651b44f588100232fc0063042ec1f9ae74338da44c7bb30
-
Filesize
4.6MB
MD57741180a0248c0736a8f51f5482dc9ae
SHA128b5f00d746ca5f48e49aaa5ba62fa2837ac8559
SHA256c219990238c99fbdc4c155c23621c8f8632a8c0134524ccceb8e2727f8a61962
SHA512b596791101a2596c7812f693dff23bedafb632d51a0133f5319a8157dc3f52ad8cfc8fa5822f50fe429840e9c758887e5d7fa7f68fae3ac9c9f5d00c430252e2
-
Filesize
910KB
MD5a45eaa9d9970263655b1c334ec184408
SHA100d53047feb3f167a283d055326982e602bd12e6
SHA25645d93c86798c84985d7052ff418a15bf1f85271593f3630c28300b6e46b600b5
SHA512c127477fa1e86acad910a6c4398d665c322737621581623eeb08021d97ccfa8312118a6b21233b1d48c8d6abc1ddeebb8596bc98f05001c2596122231685d88b
-
Filesize
24.0MB
MD5f6f9a4dd0e34796d264ccd928a937862
SHA121e1cc71d9dbc7a159a042a862fd020cdc94f3d2
SHA2564c2c579fb55c4bd3141e17ad1ed61647bec4e06f3889a218168923708160876b
SHA512b2f140badf4c145039229d544bf4bdd24be84631b5f8a89e8d4446e694d8740aef3ad9e743d222394ebe099110ec17e46f9e2cb4372cd21f68b7ad5c0704b9de
-
Filesize
2.7MB
MD5ac2b22cdf181cf572517c7a1a2d9330d
SHA18ace1a1c304159beb18935a1c81810415e7cbe2d
SHA2569059ed84a7f9523afd3015bd9407d332f2c4d1fedafa222cb72b5162e26fba3d
SHA512df80f3ff8799f1512e4cf1289bc4262af1e60d83f2cca97c0eb30d72c50e8233cc52fda91b927d0152f6f0604958ac53f9f841d57d3d756eb1abd3154400d115
-
Filesize
1.1MB
MD52b4627ad89b5d7a82ebf4f4dc60976eb
SHA179ff9465d0382212ffb85a8a13caf4d25daf5edf
SHA256d44c6d11780d4ea500f65980cbd3b33890d3e0e0026187d6e1044c32082f97a8
SHA512df12312c0e91ab144ab952b63b1b4222f27d45a00615a18b446ebdc51b04cd382f94cfdb72c02c11460be1dfb0e9d5bdad3f0b3e889f7c45b0a2be591244dada
-
Filesize
805KB
MD5d1cb22993ab56a50fc943fdf420ee48a
SHA198760f2bbee5d4a333f029b2a6c8fcb45bb23c16
SHA2564c58ca61bd327a62b438af4f79170595d9bce208289bc012406d1540dcda1374
SHA512ac2aa4808c3ea69638a5da3088c4698c2ef43035f8321d5e3271ca8cfd3b679bbc948caeceab1623ee085008358a203a67d88100248ebda8716b2d4289ba115f
-
Filesize
656KB
MD50ccbee25c5aa1fb478a9f30f22ed1b82
SHA195e90b48fdbbe28e42afd565b2eec3422b41ca6c
SHA256447bfa23265c9cab3770e6af7a14a4fe0472cb246f327f29c41bd1eeb8fe02b8
SHA512557c464648048dd5bed0d08c419e0e833fa6f566fe9e002c0dc1f8bb6137943ae0678ae32bbc4fbdaaa93892ec4c8e60d6647dab11d402a927a18682bc1944de
-
Filesize
4.8MB
MD5ec09a18808f9dcbfff8ec9785a4d5b6b
SHA1da6e2faae162f38efd1c7f946800c9a8a5955c74
SHA2569ab2e9c02bd402430b3428819b9beaaf1dc54becf3aa9884dda8b11bae17fb34
SHA51293c9ff93b6d5d60a518800712861aa0703658194d39644b9331953f7eb030c7b6deb052c0e05566a7bda10ff96a9ea1f263c89e7cc585e9101e91040a64dfc88
-
Filesize
4.8MB
MD531d4fcd5606b9c35c9a8a8a998e38876
SHA1873508f20d7c17116ca03912ced09aed45fcbc31
SHA256fc08b63d9a03ab17a3572dfc4304dc1941bb41e032435dd198e39c56bc9809a7
SHA512f67b6e707ae7716393bdd09f16aeb798cbff62b6fe3eabc0b975f2dc6730fae4625ec5838703ff398ef60d4bd2c2cce8bbf64fdf4789fd08fc876cc5e63b39b2
-
Filesize
2.2MB
MD559f907dc1f1b54e05fb991e1ca8c516b
SHA18add5559180f92165a7aa4353c1e4cf4955bfa14
SHA25634629847d879935ce0ed0499f40844abbaa46d3b7ecfd00afeac607b0b9f3412
SHA512ff651fb1ac9925fc2c0cdf96f859b7deeaf112ae489f9b0ec4b07d1bf2719c49a32d42176927a3b0bfac258db1811d76caa5c9d6cacd8ee599a9aaefd606ad24
-
Filesize
2.1MB
MD5258cb9cd6ca1db21f58b00ee192af436
SHA107c965e3b4ad534f3019c22bf8feadd22d03edb4
SHA2568336cb4f0c65306c4e9ee86636fbc822d441a5a0c17188626279cbedb8c11714
SHA512b41ec849158e3c5a08688af9ca5e1c981bbaf8ba94b4dcd722a998e6480f4adc1839b1701fd2d188eba791be15079ba29617ce1975920e7989902c07d00428a4
-
Filesize
1.8MB
MD5d83d3e3b6fdc5ee3d3b1de57e95fdd54
SHA12ebe74b3bcec0aa357f7236e232a044bb9c9af29
SHA256bf38f764c50fad2ced23212153add0ef9e60905c6cd2d6463a041ff65d09e788
SHA512f81306759dbd38726d268cda7478924add13c6e5bfa859335d23c5d5e0fa63c513882118b5db26dd3a9d9a3ab7c4615caa906c488ef5e10ba18a1f588493096c
-
Filesize
1.5MB
MD5aa6d9f3a91124ea5c2f50995ab806d61
SHA15edba6da9285ab09ebcfcb8588bea1e1e6a6a742
SHA256fa378717cf86719a2f0d9aad3e273d11997bad272eecb4555aca6e616d722989
SHA512f2bfd0055331f8a688d1076f5d517a28dc306a236b33a26278628e5f1c3f00148b0c3b02ca83b419c8ff53d889f66fb37e52c437491d29c25d1b89153e0291cd
-
Filesize
577KB
MD5334302019cb52506448aa5e236912f00
SHA1920cbe331369f28e8c4302891db49c300041225e
SHA2560af0fd9f667612bc9bbdd4611ae209b2e67646d5929a3f06acdfc00a0a0afe52
SHA512ac4257f7fbb7ce77e4362211fcf104ed02bb4e50d40ded2164be5879756e2c63282b8aa967e00da5231c7f922dd441f52c589f7e5d7041262cf0415954b2f80f
-
Filesize
577KB
MD5c025036eb37af68d78616f57bd3e32f5
SHA10a4471549a3ca49531fe16b3f7dcae17f5ad1d41
SHA256977bb1883bde2f58abaa54f5413a29f5526a337af8adfcf0064c321e5552d6d9
SHA512a8468e33403e2c26fd850f4694bb0e9977514798f71a33ca1cae482b055086b5dd0c8f2287547c7c30dbe4d7d9c20020408f9703aaccb00e3137489b673ad71b
-
Filesize
577KB
MD5c4d822dadfb51edff17eb6f59dceb25e
SHA1e425fec13f3f0be301993a8bfa6f6b2343df3d7d
SHA2560d38523fae9ff8c4dbe659f20e64295b9b8d350a0dc9160db25ac3a99c4e9275
SHA512336e9bb3d6401e03a30d7df87390d6cde8fe794c7b3050c539c4c919ece7ae8fbbf683b37192513dfb58f0f1569ac0095d0d23bfa163aef0d1181648425d5261
-
Filesize
595KB
MD57518e5bae95b19f3e8055653ad61354e
SHA1c0cc4995523667ac583b53ed4a871b6e3cc6b937
SHA256d22cf9b36ce72cdec394906b03a72618b78d1153d817b0a5bb446bfe1716e699
SHA512311c9e2220a639cef1d57b7aa6f7ecb6ae6d9914d6bf693a56935970724d7fc928a7ca3a9bf2f04b59ef5d8dfe65770687d84b29832976485403e3a3e533516b
-
Filesize
577KB
MD51f94975104f7b1925118ed8363d1c034
SHA1f9ae4f28f0949d6dcb79e12e463e9f0801b746b4
SHA256f01a386f2c53a1086806cb188a4349b6d7465ba9dea60ea115fc5f0fe0d57e9d
SHA5121d4024786c68cbf45d19028e6b650f5156caa854247dda22563cb0b36d0f553cc85669e005b0a99441e7ccd3c14c4448babaf9910838c46406630eb524f9fc93
-
Filesize
577KB
MD588d89047124e1e3ecf8ed7c246199635
SHA18423638d19964d4a28800f256362a9a8548831f3
SHA25652d9885862e0ea1088122e20084e2054afcd5ba26ba5b3c692ee73e3ac122831
SHA51220b0ac9214637d16fa35f104e8bdd1b5e113cb2b7ae94f729d7b7400ece65a5900501a4a46483f4d8443120175200d54341e7c669d1dd25895d0edacaf0faef8
-
Filesize
577KB
MD5790eefafd0bbb7da5d85fffd02ab1995
SHA1ce6cb637746041e5e36bd07044a9051224c9781b
SHA25679f194c2140c504a4bcede5b5fd340cc91aed10c38fb232aaeb1ca90817bc216
SHA51228e9b2404ea6e64fa5881e3ea0e30c5d777e5954f0ab65ac2138367972a3b7c0a1478420d064c0a027266a22ab307fca327ba718e3f99e6aa9ee80cc038d0be2
-
Filesize
762KB
MD5e18d260acbffde0e8654403ad735068d
SHA12c5dbaaff0bb3064a6ad6a1b5b059c532348b258
SHA256c69386f2e3b00162af811189f4df2db38bcf2d3fabf2a8a7882437272c4a9a51
SHA5123b3fe43f1e39a4fb2f36e12c9cd00778fa91a2c4d53b9208562177d0ac90f3e18b9f6938d9b11e712d36d1b13b322e933416d86c655fe5086cff7b3696aa0717
-
Filesize
577KB
MD51a9084e2bb65fe1e2642b76b61db35d4
SHA12dd7546fda6d65b33e2bfa59c0900605297d30f5
SHA2563a928c2cb35518dc3a278cd9e81ae3c6f9c34dfed9e76ee5e28002545e1e8984
SHA5120dd87ec89870b6112d874f1625467c9d6b7aa9841869b32de54b87d732d0c61779583b2381173cc9b96e04b86fd9a486c5c83af0e8d36fe737c2cd790afc5f29
-
Filesize
577KB
MD56ece615925a4f86fd9f860b382cb80bd
SHA1687fb8d22ad83a2db020d33d6ad7b471c7eece3b
SHA256daa85ad842d5805280a64aa10ed6f151f7c23e052af2cff57e825526e0f90084
SHA5121189504a25fbc6ba520e26990b1e8e3734c6485d643e1142d823085228a1a27dffefedade89008775dc90dc89a8377070bc842fb31154208b0025e2b015ae361
-
Filesize
690KB
MD58b0dd128aaabbcc7d92da3920b22894f
SHA1f7487ce9b91548f80b8bc1f7ce3fc19a48a001f5
SHA2569e02318e8dc1eba1def6b041285333bd34fcd885400003ec7525eda01e0d0fa6
SHA512d8b047a419acbfdf12ce4b3e9d8a586c068ba57030ae9ae7ee6727100d7892c3e2e27758175fde4d3a7aa08be30156c70c0a3470100114a8b400be129414ab5e
-
Filesize
577KB
MD585a0a1ab65947ee140115d27a5612e20
SHA196216379d68439aacd301225d787c02e11af688a
SHA256a38c1864a9f8c9cc5d1b0d4c8864554eef62092aaafe983c0c6ad333277af614
SHA5120743d4b738abe500a5783349775d065fc138d57121235ced03479520477387c4f2caa3ee1f50a23c53997d616d4b3413fd51d2184675ff2615c37b72e9a1f120
-
Filesize
577KB
MD5d1520d1199245ca22779d30d43318282
SHA1398162fee7a5650573312cf04a5d1a1807d0e9fd
SHA25631b7013801e7c5fb4f8658f824f12fa8ab229567876a9b9921d283081c20e022
SHA5121d21264b8c7436b36b8d82a4c03cfabfef8bf25808dcabc92d5af7e01661148ef00e50e28f6a3f408bb9a5118f7dbcb88a6bf9b2ce942c571f16556242a5922b
-
Filesize
690KB
MD54419a70d797d4a5233b4b7984978963e
SHA144770c1422aed5ce11d93c51681b2945afa2ac3c
SHA2565022770d5e91be9e4a2d2e307bc048d8f3b9f810e0c1d7745fca7d57e39203e8
SHA51211cf244d08e02bcf7d4d3c282cb806a85d99863eeda5b2736a401647774b4e8ee60b09c8899d8d7a9b546aabb3bf86bd8bde9ccccae99abae772b7aadd6db69d
-
Filesize
762KB
MD5a8441ea54673df3bc9c49de4f69771c9
SHA1b841833fd70e68943a4f88ad1ed4ff2a31be5af6
SHA256cbb79dd6b64a9b5ca74a705bfd55c514043692b39b9ffdaad015542d4ee35a05
SHA512943255e92502fb5b20f425241c3d8ac9dbe28bf6a1cb08ac836a2b185baef90e7727ead8e7d2d76a2ae9edb2621832fd5badc51ffa1151637ab0666e51e31e52
-
Filesize
878KB
MD56d80a7ce010e9bd153c5488be4f331ff
SHA1a845407689e8be89393fa0ba94e9f26892ccaef0
SHA256719f104f7149a044e180371407d27499b6b20855d9f3f6e9921ef06e99e29310
SHA512a44e21ae4807d6e2f0b5b832a340d9f8a5b7f102c12cdef5e56fe0357e4c85efcc5cf3c36d3f78ea59b012bb213344cfe9877b21faa853bfbad956a48cf8917a
-
Filesize
577KB
MD51d639b110305449dad4c19c57c46b738
SHA12dedb6dd246e0663454d3177d0ad1079a4dc1f3a
SHA2565f9fe5f6709ddb4bf5625ef14087a084d41814bed09316679079adbe823bb47a
SHA5125ffe71df6fa37bea9e97715020d4dd13916b4ac9f956aa21adf95fc09cded6b25d9fa71a64e7420a87a5880ea666dba09d9fcefb5ab87b84b7e5053829f24d65
-
Filesize
578KB
MD56f72df1d2fa93e62c2083206d7a2fae5
SHA1600978e4871d0f809f8acc962ef3bc91f96fafd3
SHA256402f504f30942db47554d3df6d5b331416a208f6008b8914864270333c0064d1
SHA51251401969c27940835afa4db74ee9e2a04993abb932c9c030da994ec8556bc5b429f2eb9cd69d757eeafcfd35c5abea48906cb7677f5d6c071cf83f54bba9e9e9
-
Filesize
577KB
MD58b05031fe430d24108a503635fca17df
SHA1599daffad0d34a274bad39dcba4e1958e9440da6
SHA2567ae6d5fd44dd9484cb0cd3b2c2cc28538863a2a070e31d1fcff298cef2d79ab9
SHA5129fb085ee9b99c14b3cf3171379bcaa3572f30dfb7325ad3258ecee08a7c8ba34f889143e6000660e5c1277a087fe466cb9937ede7a27df518ff80abc1272b7b1
-
Filesize
577KB
MD5c542c0f5826cf6e13711465a323746eb
SHA1ad898fbe1b77b0e42c6f32967d79f2fc929e39aa
SHA256b50ae170f66620a59ceba8c5ad0482ca4cb518550b119dac7abc1640ea7a172f
SHA512806af978b4dd4294faecc2e2a57811c5b792fc43186a6c27bc9015a4121f6f368f94d839344b955ea7b178439f272d6a34c0999376d40c0a0d93356444c1612a
-
Filesize
577KB
MD57603820b1ab32fb04ba7117facf5550c
SHA1b84d7275b24b9ad54a987bba711efb95c3817459
SHA256853ba76f63dad8c12be56e5b1c92cff4f858834d358b2e4dd3873b57cbee7a15
SHA512825043c37230b6f482cbd0421d8f9536e2ffd352e07727a26db0b1fd89c4c88d895f9227873121fa2bf5a2adfd3ff26cea11be3f055e8d4ce2fe184a6e12e0ef
-
Filesize
577KB
MD5045fd86267edcf92f8005af72032b70b
SHA15e51dca57dd0bb44acf4ca3b2e34ad464b19622c
SHA2565765aeb95885ad0fb2be8c025fec7826b453de579cb211fc5c7522b3030fe397
SHA512b700fabe97c683e3d81b094507c9ae9d9c90067e7a8616547109e41ca745c5a75d99190c2ac8a799bc967a512d2dbe26683da9f66878c73a4bd159f748d3fafe
-
Filesize
577KB
MD557021175ec9ddc6aabafe6a5e6e91d63
SHA155c4779a1a2da2995dd999993e628e8436e7dc86
SHA2569b31416f75a1a205697b839e4fdd23f37004c254e45f1ea9712b6933066b1087
SHA5125ca840c0c8dcf8b5c868776da736e364a220121e0140d435dc8213f4a11b8c4db219894aa502efd38c9d5da6a4d9051e530e790d54dcc35edc7f24e27f885deb
-
Filesize
577KB
MD584f966e61e4cbf79f05461dbc8d46938
SHA1a58c495b2c01e7c9148f48a11bf7af2bd73b241e
SHA25633f50ddaa872b1e8b1771f64901a61448b70dc115609fdd0dca2207fddc9af56
SHA5125ca7d416655b4ecc3c44c83d3dc5e92b9b354180c22feac93cff56c3d6af962da8c3d1b35fae8d67d4ea52911cfaaebd0779cfe091c11226931726204eb27f6a
-
Filesize
875KB
MD55c8087d0974bc81669c1856d94450bbd
SHA13502d2352af4a8cfc768bf68d411c7e77150c84c
SHA2560bc904e4b4c9ab667e0195279fdd76e3dd4da91bd083c33896030f3e56af6106
SHA5126beac90e9b07a41b3a79f72032119d7cd04bf61c29f10a7dbd6519bdb84475eb1ed9f61662cc8e5e066ef5a9bc1c8df58ce92294e2d1f7b26b8adf53279c7ef2
-
Filesize
577KB
MD5073bb9cd0cdc7d3f37658a70e34f5c95
SHA1ffad4a34c0b5b3f099197e5ce47efab8645a96e4
SHA256e658e7e1226b1bd8ec01dd1fc7cfc68287faf9458db0b2139b86a87ccef91ea2
SHA51204b5f217d8611baae25aa1354d0f8ed9a33aaad882a272d8b8f6c6818f74bc59417f563e956ddcbd14d929ed4a8225a5cbb3a6b204e5d57b93ba4a9733f26ed9
-
Filesize
577KB
MD57ae487a3c731bbac18fd77cad0780ce8
SHA1fa55dc765bc00a6f481452e5d4adad96cf096da0
SHA256ade10fed0fe30452a42fccf2d9db6d04eb47d5e156f2921a02838bbbe38e7916
SHA512a3a2021609f5c9dae592f2cf923dcc472deb0d068acbe9dfbb6965909e457f1b173101e8dca31cc8caaf9f3e26e572a8084e4a6bd8fbfba04fada88159c238b5
-
Filesize
577KB
MD5ac9c7d765862913ee85bf2a5a5fd4f84
SHA1e89a53c8a05e133f15f2d9a7af8133cbc6b43b05
SHA256b98897da05c43e96aaabb0cc2138e0b4dc866a0eec876622d0fddeb227d73098
SHA512cd05d6a92d2312c63d18c265f1b2e96d8ad118c2f2ded294e5dd0904bd725bff1848f153ce81c2968ac5fe3f0b9dc5a2f93b68e72137718dea50df62223e6e87
-
Filesize
577KB
MD510423c38dfd2ed18a1735d4dc53cf45c
SHA1f840fef6e3bb2c3d846e8220fcd15ccaf792c675
SHA25620cd187fbcc46b983dbfa2257c7ce4aae2573aefeae1518fe75b83f51aef05f0
SHA512f646588c26a7708bb064c617d240c00e28a872e18111f21d6f1d861fff47ff1e13fb732103bde47dc08bac4d5415cacc71b30f158904d8f54ac9f51cb0e311cb
-
Filesize
577KB
MD5489ea919bbc34c44912ced1813f7b752
SHA137b9175134d543d209d7e60c4273ad9b042df431
SHA256ea6fc8ddd9cfe4371d76a6fb563b6588d72c71dee655d22d33228010cfea7b53
SHA512246ede6802b8d032d5a49cb547bd02aa5b2f0a62e8cfc839ca1187b1234a06ee35f7214c80239c537de2d3f5d0aeedf055a8b862cf839ceb3c84fa3e1bee399c
-
Filesize
577KB
MD5e25de6eabe15326da62b91d985195258
SHA15b675b3946404687341347e0171d358398bb9357
SHA2566023bcee33b5627b76c58c7cbbf7ef89591b92c9541fd508a6b7a4e78c7eaf5c
SHA512bf73a421cdc6f9f9effabfd00e4c7cfaa1dfe4d69d565406e175144374cd8858c30dacfdd6f97bbbddd4c9de4d17ae255e988c8d8b61d5b9f8d142f90bd68cb9
-
Filesize
753KB
MD51a79e66ab95f1170fee9d10ea764b7d7
SHA1647e257543b8545a8ce242b0900db49fa59dca8f
SHA25679f727b01b07f934bac47d5abbeb8a61fc6080df5de6a8a73d8cbf758b969077
SHA5121320b282397789eca138b4f4bbe4526f000dddd1ae0f3b4d42b52b0f088baba6d63abcce648c20d1b8fe8a42e218c60a7cc9fde51b76f571d56e39c81a7034b1
-
Filesize
577KB
MD5b81db5148950e5033523d149c40f009f
SHA17965f328c3b61b335463257c31c09df03426f99c
SHA256a491fbfe9d7b56322a0d1e8981a46284f9e36bd825bc0674ad28806629b6877b
SHA5122c0c5f6a7ace9958cef8160a5cf373bc4627ab010e86bc2473247f39e5c41de84e4f7d416bc7fb3d7b4b35eb52ee6e71037e3cf7e8a8881af653e6f04a9ffaa8
-
Filesize
577KB
MD5d308059b429c94dbb1a04b0083d5120e
SHA19e1f29c801d7aa9be5e1150905adc6105a9b5ca2
SHA256f5addbddc3e39ccb1390d8b807765b7fc787d395536720162a0267dfa52f19a8
SHA5128ca78de910578cd04a85f5a6f16389faefb5497419768feb4ae87e3555e4303e3e5d6744e72ba23cf433bf45d35e5b97fc493aa5ab1c5ca748b441f6744759d1
-
Filesize
577KB
MD5b6ee955c0d5d81e4e3acb10c38cb4efc
SHA17ac1b987a9b83b348e95c74847c37a82e7608a10
SHA25639cf2bdbe1c7eef473cf597495bf334d8e2868fdb6d7f1834f47e60181c0cd6b
SHA512f5fa0a4797d1cc3ee4e80720a60d44957b8adcac0172cd686535cb56288c3f4d99017c6338d86a261a8f3faad7c542aa33509efde697f8d5112ab68961c800c5
-
Filesize
577KB
MD569a1467dcc4234aa8bed84adc5aa2114
SHA1ec201d3d7287063db842ca2dd344def7f8bf0140
SHA2560267d28155b7eb35677228e62d87cd216af72e19be16ab5c3ef0a70bd68b60f1
SHA51281175e6e4b87d8827f30fc42af5a948c77c4f6063a9e0a8579b29fceee088a4e07e5baf2f230408bfcbacdb9e3a99521c0dc6b0dc8d15df4eec887c84b0e4736
-
Filesize
577KB
MD5cfeeb2c3c1860a1eb7f1f9e3a8119cba
SHA1b1595a33958fafdd6e1f7292d1744eca4a946b3e
SHA25688636ee5bf690a8111f94a1cef05684d445f9eafe43fe95d76c1e291fcada2b3
SHA512e7c0bab319b2679064c6aae1c891eea79ffa61a76582164a5b4dcc530076be5a9ac8d62da21af12d1bfcdbe5839a9704137b12480173fed2a924d0d4158f50d7
-
Filesize
659KB
MD58d4d15bf38e0086a81277961c3098638
SHA1c14e78d09033889fce49fb7f66e9aadb0b49aec3
SHA2561b171b482b91031517d55aa9b84842a44fe8812293ec2b822974773085ec443d
SHA51242cd2bb65ee03c52b41654cad26326737587d800c97fe5246ca900481106554693ad1c9d518e48a335d15bb093aba4351b1166c3d0223723ad9c26dde08bb6ca
-
Filesize
1.2MB
MD5e2bcd8c172d08bd388f5c7c1ff1ff7a6
SHA1893d848bf42c89750e31e5ddd49b11d6a4e5bd68
SHA25695ef108f7ec16a7318bbd93b88688c4bb24f0878207ce2e1b71328bec79b5f81
SHA512061848dcc6bab716e7afe47d5b6d5b8bc6dc7c09e3b7e42c2682714c5e20027140b843de9b54c31838ca38f5e358eee52a774c0294d0ef3ba9c1d942abd281f5
-
Filesize
661KB
MD577b955b1da0cd63a140e18008fd12005
SHA1cec9616c8a3d42fddf11ab7a0e7be9cd80d278ff
SHA2566909ec2cbafd46eebece1dfe8cee966e04c5907d23e6aac184939d8d60011489
SHA512c1b5e96e3b266a78c65859461994e744a049631627e500c7b3152028f7b74a8a9897ed15c0475426638bafc62fa3d5c6a61c2e14d7ef64ab87dbb9214526f5bb
-
Filesize
1.3MB
MD5aeb433c3c4beb9f8ca4a623761af6135
SHA101ea11f20b34684867669e88ea802a464d62ad32
SHA256fab6902bd87424f725a313fb034f42ee347a21c966f6e19c135322bf6ce4be4d
SHA51229550be66c06536004a7a91da30bcb315a1729d65ba695556dd233d5890a6b52fd6cedf0e557a3dccb8930d3454faf02ca8cabfd38f8846c6300ecde0a7ad2e9
-
Filesize
1.2MB
MD5e2bcd8c172d08bd388f5c7c1ff1ff7a6
SHA1893d848bf42c89750e31e5ddd49b11d6a4e5bd68
SHA25695ef108f7ec16a7318bbd93b88688c4bb24f0878207ce2e1b71328bec79b5f81
SHA512061848dcc6bab716e7afe47d5b6d5b8bc6dc7c09e3b7e42c2682714c5e20027140b843de9b54c31838ca38f5e358eee52a774c0294d0ef3ba9c1d942abd281f5
-
Filesize
5.6MB
MD570d6ea6a957db331eca3aea80563a3e1
SHA19ac6e4e44246804f655fc09771192f5498dd68a5
SHA2567cc20ac4acf1f74df3dc7a5716aff64fb1f9fbfe10174624186d6b52e2881f19
SHA512d1ad254af4e534138af8019b04766b47adc88faa1850b305247fe4fedc3b05354c9f4e4f235964de08e0d786f8d2f78337dcfe004a70a3b4dd414e6d5417cf9e