Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
95s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
01/11/2023, 14:13
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.8229ceb36b9be0aa4e55dba154014d10.exe
Resource
win7-20231020-en
General
-
Target
NEAS.8229ceb36b9be0aa4e55dba154014d10.exe
-
Size
1.2MB
-
MD5
8229ceb36b9be0aa4e55dba154014d10
-
SHA1
110bb4e17460034cde9f138cd0f12740a5fd8a5e
-
SHA256
2e5444b586cfdda26847fac29a3a1154905e63dcce8d32ef553b9f6c6f0cf55a
-
SHA512
7c0e74ebf71ef721ff7f904bc129d5389804d52086dced9eb60075b368c8c5178efc0ad912d546416f515182ba604f71cb0ddf5ffde2e91da0ba2c11245f965d
-
SSDEEP
24576:/y98MUE35eQE738SH7hd01j4wdkxsqjnhMgeiCl7G0nehbGZpbD:/y98MUE359E738SH7I1kFDmg27RnWGj
Malware Config
Signatures
-
Executes dropped EXE 12 IoCs
pid Process 4660 alg.exe 1136 elevation_service.exe 2968 elevation_service.exe 4124 maintenanceservice.exe 2708 OSE.EXE 5108 DiagnosticsHub.StandardCollector.Service.exe 1520 fxssvc.exe 1896 msdtc.exe 5048 PerceptionSimulationService.exe 2556 perfhost.exe 2816 locator.exe 1384 SensorDataService.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe NEAS.8229ceb36b9be0aa4e55dba154014d10.exe File opened for modification C:\Windows\system32\fxssvc.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\18f242b66b2b65a2.bin alg.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe elevation_service.exe File opened for modification C:\Windows\SysWow64\perfhost.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\SgrmBroker.exe elevation_service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7zG.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{6D1E095F-36F5-41C3-AA9F-CDD3FD51BCD2}\chrome_installer.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe alg.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 660 Process not Found 660 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4140 NEAS.8229ceb36b9be0aa4e55dba154014d10.exe Token: SeDebugPrivilege 4660 alg.exe Token: SeDebugPrivilege 4660 alg.exe Token: SeDebugPrivilege 4660 alg.exe Token: SeTakeOwnershipPrivilege 1136 elevation_service.exe Token: SeAuditPrivilege 1520 fxssvc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.8229ceb36b9be0aa4e55dba154014d10.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.8229ceb36b9be0aa4e55dba154014d10.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4140
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4660
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1136
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2968
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4124
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2708
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
PID:5108
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:1512
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1520
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1896
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:5048
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:2556
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:2816
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
PID:1384
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵PID:1296
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵PID:4432
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵PID:1824
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:3432
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵PID:5064
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵PID:4884
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:3888
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:4968
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵PID:1940
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:3504
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵PID:1956
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵PID:1056
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 916 920 928 8192 924 9002⤵PID:3268
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD58e0b9e156230be844daaab2d40c264bc
SHA11ad7b0123a709a56f9a1e9aa94eaa3bd0f9385d9
SHA256636bb9539e5945097324587c0f50a7a3aa0c7d8fd7c7e4b1a599d1dc9498356b
SHA51208803902ecccf39efb177ec1d19928b4393e12ac4dcb58516a62bb9b4066126742becec30eee7381f3d7d730d4fba38b8038853344393bfcf80e76b55f60fba5
-
Filesize
1.5MB
MD5808710b60277281527ca882f3c48a0ac
SHA14c5df75deec6cd6489922f29e7317c43f9cd2f7b
SHA256605cc7a1bd4784f739e0474196f47e75c2fca5424d5e325d4a993067ce3f9d0d
SHA512e81aefd539e159b9ea299146a27af6da134b9dc2ec55a7c38b0bdab48365dd36cf12acceaa68fa6d57a893010d368d7273685556d8fbd05ed4613fe940f10c93
-
Filesize
1.5MB
MD5808710b60277281527ca882f3c48a0ac
SHA14c5df75deec6cd6489922f29e7317c43f9cd2f7b
SHA256605cc7a1bd4784f739e0474196f47e75c2fca5424d5e325d4a993067ce3f9d0d
SHA512e81aefd539e159b9ea299146a27af6da134b9dc2ec55a7c38b0bdab48365dd36cf12acceaa68fa6d57a893010d368d7273685556d8fbd05ed4613fe940f10c93
-
Filesize
1.8MB
MD5843a9cce7e7b2b40f370f173616851c8
SHA18419d7a320c3d2d878baa06b2722f33c7df2e227
SHA25662eb13cea85fd2be3ecc10d5b145927cbc992ecdc260ddb79e92024ceb57bc16
SHA512b38da627a11049149924192cc4bdd861fe86484ed1f90a7c8c81b5d9446b9c1b5251c6a6fd286f885d2f7699e1253083bf5c1be81f96f4f02a45d787e5d8e222
-
Filesize
1.4MB
MD5108f020d09108f1fe0b83f378a40bae8
SHA12d4b704a92e8e31419b484c9827a270250132571
SHA256e7b413cf84b0ef0f1df92b1e30bb4649b7c35274ee30940b33dde7574d6c06ff
SHA5127080fe64dfe461db7c59b22ccf4b6f8637451bbcfdb7457b38e4cd8a1412c9cb1c2108a0760a1bb8eb5a5d44a263c0c04ce03d3a57ed4f070a3dca4f1afa9b9f
-
Filesize
1.1MB
MD51a97c589c849756c7ba5bcf180c02178
SHA1d9e344f6ccc0b8ab959f18b82905dbce8ee74df5
SHA256559905f0ef3a0437c0a70746f570e0541acba8ac774c7c20fa908c160c0169ea
SHA512b37f1c67b16bd631a0fc1ec04be5e8e0e0805f7d9d926bbc5350d0aba416853a5102b03bf1fcb07f86c2642176fb1e48fbe25e8d6876626ce32d3294cf2df7bd
-
Filesize
1.4MB
MD5bc08d85a60cbd19c229d57f66f572d31
SHA139be38a84e6101108a211e6aca6bd18af43d0439
SHA256fa5fe519df301662dfe75d2ad2b97151c964c84cfe6065fd0df579ecbf045124
SHA51263b4bc450c93aff50a683cf6c47910a28e4cb814c9222f3a35167325808e6a2a97ef44693d7f50e3b859f9279ddb311345af5a0ef166117b3b205ca1dfd6b2b0
-
Filesize
1.6MB
MD53859b1a0f2145c444eb1e5c56f57f953
SHA18e554fd69ac1f5a2d3d098a69d48074cb317490a
SHA2561fcc974bcef8bff7d261255a867e9dd4e85f58cebb9765e7f4816d7303dced44
SHA51295cf9475ab41017a546f5992c56e9f62c24cf8a5257f4e2453969af3525e975c173588d732e3a78e4044056f02aa6cb904d33d79db95dd5a2a2e2c27f7b4fe71
-
Filesize
4.6MB
MD55700c6c2b2b53975b2aaff341bc9bda4
SHA1d34a7363575dc09eca8321dce0f12e1662494e62
SHA256208eae4cbbfbf19a3aed91466e9567502ff0c1fa365850484cc3f516dd48c908
SHA5128971bf390182726cc86a97c0903852d3e0fa10a9150e2191609cadbd7d3b986c756facd682f0426dc46b3d663cd8645af5263796ba181bc665ffaea5b93c3ec5
-
Filesize
1.7MB
MD5ba0da2dc00965388b9adaa4b2e48cc41
SHA1c10e9b4fea5b4f1a88cc7834362d810cbe841fce
SHA256e343b1bf506ac215d989b512e5454e78dfe19ec0ddea367b599330ed3c65a600
SHA5129bace76f0cd67c35cf963746d5ea9cc69b9aa36487c29254e1a8fa170d265949f6beac88534744a995d07308de4c505ec80463a57f1bb3f9e00197e6a47c5cad
-
Filesize
8.0MB
MD5d2bcbcdc5ad16678e24893b66fa0571e
SHA16ee8ac66084c7087b9cf6545e0bc6f3cb7bb76d8
SHA2562f98153f81619f4a79f954654ef1a98d5c4050a1abda006f524429995ae0984a
SHA51281d0febce683bf4bdd2d252b4ddf7525ec651d80e83cbef3049a7c74b1b19cf6ac22b92070dfce23c5d3f58cf842a1e5a584ed848f56fe1fae8e3b5c0d827093
-
Filesize
2.7MB
MD5958b430bb15d016a3327db8700b11b30
SHA128abc065d19c03c099be0f19bd1f5370f36732c7
SHA25608d243396749401f0a9540d9d1af7f3e6723b2efcd85d16104a955dfdd9cd026
SHA51290d3bf08a2b394f6811492dfc6564e2868906f72186674cf6b14b94e6203123b0359cd2bcd11791829b3407be36f4b1e540b5f93d5f449b63687408ad2bd532d
-
Filesize
1.1MB
MD569b0352717d0af54e40e2d9d4d7ad3a8
SHA17bf0e61df7f434ba89921e1cfa32720515409157
SHA256e3b7057dfc69464a72aa4d5aff1b84c4293239d532ecca7e8b12d2932a69ac48
SHA512f9f74f3a3b22928f1923bf64b75c7df37033014977e8b2b9a330a6a5938a079b743652c60e60038be42b704f03facf5adaa51f492511014ab8cb910c81dad585
-
Filesize
1.6MB
MD5b3c0fe3c3b55554b217818372b34af13
SHA10c07c6cbad313d92cf3699a9da7991c5d1f49034
SHA2562024f22135964826e452a0a73130ff9a7fc70e7b7f4f29a7c84788307ef8b3e3
SHA512d8c266487f31c0baf55d103cb5796c017c525b9fb6859830ee54911aa5511e4bcee2b96c6760193a98c9c79bd92d94412380824e27d105325c5b3f64f3c3fff8
-
Filesize
1.4MB
MD5a2219295a075b51bb4792aad159bfd78
SHA155272a0fa19f78caf57ebaccb215dbd554b00a98
SHA25651b700e4ab901e5dbf27d015f50725359d084946d8b8ff1d12afc7d4e68de871
SHA512ef46a5b8a794ff444fea6bd1e3b77e1c6c3f1f325cca31681a55f23fd76ba07ac7d743844508d02afd6ac124c40eae4c5d3398f851121a6c03a9930433811191
-
Filesize
4.8MB
MD55f1e5e2e473836e4a7d5c06f6a6eb671
SHA14960c8c3e83fdfe3fb2ac9b8c3a38ce3737aadcb
SHA2562e007fc9502c21e79a7dae5571d35b589c1c471256a74b8e00373bc9f113dd9a
SHA512a62b4dd7e1b51657ba91ba1dec41023c15102c8f638a068f9fd2e36468b2da193aeec7cd46cc181d24894f98f4aeb69281aa83f934ad18d1071775ac380c55fc
-
Filesize
4.8MB
MD5e1ed4546c74737375ef39996a0a19f4c
SHA15f40bae25af9ce3914e776551204684f47f9db37
SHA256ab6cbf115381ba7a36dbec2776ff80dc30f65f4ee5ebcef289f96755c96019f2
SHA51283e811465beac3e4257d1a54721acd5b7c4dc4f84fd773b7da46cf13a0e7945b8192d80ad6624f6a6f268e308f8da1cc9c0fc1aba8d4d074fa32a327c964e2ba
-
Filesize
2.2MB
MD5844fe86d0fd990fcf43f016723a66632
SHA16dc659468d52607cc782de406738aac6767a7b32
SHA2567d061d2bf10f3e17439fb8ed5503fa6202146573c8003995f83f047b737b1f8d
SHA512c4d7c6dacb3b8d835ae3a22569c40e11866731b32a81e15ab6d3daa90ccde7cdd19f2a57dc436cc1230403d3460a1f46b8a3d4ef7247419004355a561af168ef
-
Filesize
2.1MB
MD5a5fff2fb8ffba7b12aa3a7d80a038a6d
SHA114cc122e75430dae46ce25e1fc54f38fa58a2d6b
SHA25662022e9245060e793059786b476a093f7d551e68eb9613c9efe549e8d7d04f37
SHA51280c9a7c569eb6d9a4630bd5383c3cefafc024f8fb2054a75933eb46544e4a9866f91ce522ad73b166f2479672bba8bcf6d255091bc481e3f2d0de9a2baef44b5
-
Filesize
1.8MB
MD5e326159cf90028446691dd717f3d1990
SHA1efabd6f629d56dccda9f0285d1659add03dab026
SHA25627ad8878beda75487c7124bfb2c7f59d8e14cfe0c02be70572fa4806bbade9fa
SHA512e95fa3a4f669aa3a011bccc4fe5162b1b2f1651cbe977ed6fca2347c4e3c5d093a9fb44f9bf15a8a78fa7296467c092274fb1a9bee9d99bc45663f8b9d625cca
-
Filesize
1.5MB
MD5d9d6f130ce4d91befe40e43ebe465225
SHA190698bd24bb3a822c0ce1ed8f3423f1ff70469f6
SHA256da3bc3f7e7d7d8a617ccea8b72307f11a0b2efae46a0af842ab81b923a3ee0fb
SHA5123cb99d6f34bfc5b3c8728440abf9588edaadb2b5cbecc3f861ede3ba61da6cd0a8f1eb7e112de8e3814423513ab3893b764083306fe0e6d01ddf7024ba22d83a
-
Filesize
1.3MB
MD5a297254515c9188ac093d9af073d5d35
SHA19d0b7b6f3a8cd64988c06b7fbf02b4731eff3bf6
SHA25642d48e1c8c7051c4b2025dd36f291ba0168f89920cc09c00c5efd05e0f5b1a4d
SHA51243c2c64492680a91226d781bfb64361c359d423355ba7619355e691fee5d29b440aa0b1a22cfdf81d497b41063d35c1823d9d4258649b496f77f06b83752228a
-
Filesize
1.3MB
MD5b8bebc1ead5618b864e13312346f7d12
SHA1c5d937367e9effd0ee329737b0889bba7e90430e
SHA256a950f16e74cbbde9553d0eb1ecd362ba620448e9190c520c13be25485f8e97b7
SHA512e2f6294ffcf0fca733464d06f86bc5bf11a935c3a9d460f4a418eac77fa402a213a460fae369925f7b238e051e3a28f4db24d0c3a52281ac278abbb0c5d2d281
-
Filesize
1.3MB
MD58a2048f29b8547223f970263efe3f90d
SHA16d3b673409d470e350a0bb6fc84851eeb447ce48
SHA256b5f4800f445ac39612bcba2ae8f9c7d51ba22dadc380300c98e999beca76cde1
SHA512f69e69a1b511f0532ba38deab1144c55a949a2761e88228cad36aecccfefd8b2e6367d1b895bb2f7a94570b6f60232e70cadf8bb6ba607cfb1fe4fa668170d1a
-
Filesize
1.4MB
MD52a7a209a34a321a6799b906a0de0cdea
SHA10c49fd9b0beb7b149d2deea27c95d2c986414914
SHA256965df4268cf39fffd8c7f4a31cdca899a94e4843e830c61d39bf8389efbd8e94
SHA512f5624368444568f37acd44e6052f3129e5d254e68ab5d0ecaae003d1d153857400b23731812a3ce56431406a9bef5c781e95be780267882cf743dcae753308e7
-
Filesize
1.3MB
MD5aac7b98255debfbc8fb26bb2c6a5c0fe
SHA19bd5e6d13dbe7e2dbae66bc28209528d5e2b19ce
SHA25627135e02aa6719bcd84fab4d758b6024ab79c329d9076c29c85ed466b1166991
SHA512483f068bae9a7ebe353053dc8c40e7bf15adca951186813dd073676ae3fe2b20ad5596b5b557eab584a8c895024bfe54d081fc9cb9533cf5981ae697e127fc6a
-
Filesize
1.3MB
MD5ece1acc0bf2a5eb8bee40281d40d3d83
SHA15e0fdb5b5011351a5484cb94876bd70658805164
SHA256a07cee45965006487ac7a08b889fbd515921fc2ae025ff134cae275ec861bcde
SHA51225ee5e809b1ea7b8b40e12094672783a11cdf7a694ef6fbce73423d24869e56eaede14c2ad599671eaa02f0a0a4fb17e7887d63d4a56939393bc685f03a6f355
-
Filesize
1.3MB
MD58bba95905a7b4f7bf0d8d4d05d094d37
SHA12c143b46649a37e18e4c907f5582d7c1ba238727
SHA2568f05a72e41a345ac8330226780f558135c799ac0859c9138063c6d8777c95f0b
SHA5121af425d623c9bb9f3d93a9f5ec0a60ed88578569f25ff7abb17ca7e6ff4bcb7ce861372363358168393d12a67ea18fb6677386703133be0c708d5e9679485247
-
Filesize
1.6MB
MD5d4e716792f38d62f3f2cfd2ace96578b
SHA169dfaa23a4dfc3db9be5da64dc019d19da4bf0c3
SHA2561866a0cd79b093bce46718cfa92fe02d6f6d53dcfe80dc01f5c0ad6cf29d6b9e
SHA512ddfaa40a49fc01155894ee23347cd5c2e920c6ac746ed8a1c14f20ed2a7d072efe5a77f3decd3eec8bf2dcebad0b745d8db379761d0d0295f6f16f83e6f2f665
-
Filesize
1.3MB
MD57f3f6cb309419614a41505c411df8f60
SHA12187baebf92357929c643207cb985fd57cc67afe
SHA2567b48379cbbc344b0c2205ecae72464ff23638f98fedd292739193cd3de0c3aab
SHA5124213edf836c0305bc95d495175d59fb0d15bdbcf42d42609f81dcc67327b15b581f2f9e0e3411e658bc7a6a84c3b9e9d06143cb3e83264fb05c09962b53e4375
-
Filesize
1.3MB
MD5cb6fd07969be104621f32c0b65480cc6
SHA1e29ea579448179fc510877dcf2dd7465c656fe39
SHA2565f7c0623852756a21c36f00cd4d30ab19f27df0585a45857294f87d4c0aaf1c9
SHA51247c7a9d953c13837cc04c451fc4e809d440e3c60f08955210ec2c9254acc7c0ee5b6d10088bb0a944873f3a9d4b6ee5464ba50e1b0283fd95a5a7814343cd3e9
-
Filesize
1.5MB
MD5558ca9c8930273200a6ad514c0237c5c
SHA193cdb672ccf38fd357af79d0a6aded9609c628c5
SHA256aec828e36f04e8cd009c14fc97217ba52b45ffc93612efd22df01624764fac25
SHA5125f3859a70bca63c2fba018833689494ea093eab1b3669cf575bdc5929b4f2705ae9dbb2bdf7e161d786f84bbcf6acfb918a91d4a8c52e7915991c709914dcc70
-
Filesize
1.3MB
MD55367334f27b86ecd3f5158a6ae1e5e8d
SHA1dc5714a4f0e7228fb7e2b44772471301e28a1f67
SHA256b56dacd494f7c68c59b2908e30d1ba13dd8d65525909c5781f205a14fc5b3ab6
SHA512cd5af8a1961615cb04a56458d74496b8de11c5dd70016e232f5b5d34f5748147e62042194c7b903ddad4b052f1c69e2a33d60c150244235d3a2423b7f44e0900
-
Filesize
1.3MB
MD5c3a335a4eb097347f3a06ce124e818bd
SHA14c070dbc2d929330637ff6ad5b77abd5561f246d
SHA2560b22d26ff4262537c1e6dcd7432fe6d9e9ba104c8187908f4448919678e0462b
SHA512afc6f50c4b418f54fee3f4cba37f98a9733bd886ed48364727a6c4874b1e3eac37c8d5ab552c426faa8ec0be54c8a825f9f44059835fc78cde72e9cac2db91be
-
Filesize
1.5MB
MD5487ada7b22e8a21faddb1cdb7ac464d8
SHA106225657e7aa0870c31973de48f3146220dfe718
SHA2564cd004c55ef677b8b9424d9200b652f73f4aa5858c16c3c2347cd0e54a5412aa
SHA51241c25ff8b7deb2fafca149e4b89b8c5e5e0527995fec9f23cd23b800be4f9446291a19df87c8662a752df55d21992db168fdb7a446f4f9bc4625ad4c547cbef4
-
Filesize
1.6MB
MD57b693a1be26713f5ab435ea726663665
SHA108938641147e763a391e68b1918a063f92eb5d2a
SHA2569f12a9cc4352f83f3165f754976282d7716d75497622b6d7579d058edc49298c
SHA5122bea767d91e048e704821d8abb791a3501217a647380ae9f10e23ec883b8aab865833847337ce6d26e98e29d2324bb7f7cff26ae4b960a2dbb63e665ea8c79af
-
Filesize
1.8MB
MD5fd0fff2236d3c0ad4f355f1492d83a39
SHA11bf848a369b1eec236ac739e40da1c661976eb7d
SHA2564c1407ce11d42384347550d9dbe446a74e84f147b373ddbd43d33ac6dd0552d8
SHA5121db43013b27bd2739461657a9bc8301856d8ddcc3d4bfc8df9e2ddd5d3ead614974e65e55f9b24fdd53ba5d5cf268e45fd7d9af81be2fdf08b104a8c1d83ebce
-
Filesize
1.3MB
MD5d557717891dec671a36937f839c41f01
SHA148e8ea86ddb08cd336fd6a5bf19ff011b4d14c9e
SHA25612de1dc234dda0c6b16bbba52c6b6356eeb82fc7ba474f827ac522418badba44
SHA512309d9e566a5d12e9df7a8d2325238104cc567eea6c8e317e88340f61f781e93f6a27ecd821d5e136e5ffb700165095b3ee51017719393e835e69c7558fa0f6a2
-
Filesize
1.3MB
MD5aaa8b2122d2abf0d9ac2a34d8375f8ba
SHA1fd72cdcafcb0f5837e8aa4bdf7276bc868bc9e3b
SHA256cf0b494ef21652151e195f00f239703f3fd7cd42e5f4b2986dfe4ce3290c053b
SHA512c43fc7dada7ee2b73e6a992e0acca7536c4d8498fe0ac5fdb5b14165db0d7f037a5fe20f6af5cea8479cdf1fb312ddefa995b5e6a8cba46499b1ad6d412fc611
-
Filesize
1.3MB
MD501e46badac8526f18e941bd247039382
SHA19ff09ec43975724c96f97e01408363a7422f9700
SHA256144aa0e77edcb5fff160c90e7aa704134d491a0021b7bbd7b786d42ad15cbdf2
SHA51291aa0f7dd627a2a1e743146a9fdc9aea7f2da978153ce430b676d3814a9a9c3104e4d0b22ea62bafaf0e81f442e7b8b10f89224fa6589da940a6aa1e2a039a31
-
Filesize
1.3MB
MD5cb94e87f9263f618f66becc2a6351c24
SHA14bda6dda906bbe9e95c19da1a36d71678e15adf5
SHA25641d7e547976730e2b6c9404b6eaba50d26e905dc152dcdb5b98bc8f38653204b
SHA512c5c7f6af8d10f1d21d9f1a4093c083d3cca4fcbbfea9fca8a2c27ff56d2e06bba12c11d2d9b6282e9827293f515a7d13f2c7bffd6ea106cd8a99406c6ada3450
-
Filesize
1.3MB
MD5af0ecdea914f0b19e507e8e6272ba72f
SHA1eb4d147a6f096396a3f8cc378ee814947b03f025
SHA256e93999f14bdf2fdafe088dc8ce3329c31defe4325129c6ca11deaa16f2d31c04
SHA512beab25352237a4f459d18ab54fc2d3b1f832b2707ef169d8b274860722b66bead6b9ecb6a181dfa7b29c0194c4036a10acf731936f6b6db21f7615614a1ca42e
-
Filesize
1.3MB
MD56a55bbb38be25e7589b6a5654b6a9c1b
SHA17812133e03c2425e9654aec14780557895aa0032
SHA25678caee2b26e3f20b4ebf6115de71cee1eb08532ba6f1e705756572ae7845bada
SHA512d15179c2157359563a102a3a238f2ad13dba5e1d61489d4a1752dcc41fc197a0d61cae20dcf4749c294c6693d10bb9ae7de1ba157694778b4f6319b569389d8c
-
Filesize
1.3MB
MD588d0f73a58c091093eabfcdccd7a3c93
SHA127540c0cb92bf7f114a96ee4823a62ffa8e66437
SHA2560061b5f950508edc7aff1416eccaf4a0073cd5e035c6edccab28d32b67c23d72
SHA512c6440cf3ca6f8b08f2956d935a1d0bbe7b942e00de003a53489c7a2c06e38c77b6e2d571487bcd2288d0d76490ea489f9e3fa28e8ad3db037332845b5dd6783c
-
Filesize
1.4MB
MD53cd8693f7a2aae29baf1fa459e2cd6f3
SHA1cdbda1c516c29c6ae800a2003b388d1c427c7913
SHA25648f5387fe4709ce9c680024e7b7d0fdb6675d5db947c355077bea31c19ed4d8e
SHA5122516d9e6573e7303d1c3f36c575b876b30570b29465cceee164932e9649d938edd51dc45f4cdfdf55896120c0862c88f67bb8aa4d621027e0b2e97517281acd4
-
Filesize
1.7MB
MD59ed0f95a02acf07010d77631431fa0f6
SHA1c2d04a4b59852b4dbee4a273bda7962882c6d409
SHA256e31a953e07893b97dfc3b051ac9c03b76b1bfb2afd6fb8aa8f473f861b8ef0ab
SHA5125fef70c84c6981f5b83f394c614a3528c7a00785fa1d1a7476c09a922eed0ac0925d8f8017d422ef54a2c96f72373807a267194ad270e93187fd97a1dece77d8
-
Filesize
1.4MB
MD53845a19e8265d76151c11fdade8c6186
SHA1ead1372b301488e00880aee9ebb9e571be02cc28
SHA2567259bcb1e44e75277dd5655cc7864c21c5b3958e79725114b587a083d835d0d5
SHA512552ee52847a73e86a8021615dfc4a5b3a96eafcaab9a6998a372297c146558f82e3f198643bda1c78bb2b9940618414610df35b15c8d5c4a2dfb396a08a26387
-
Filesize
1.2MB
MD5b5c258aad2758be384a2f2a39389d5f7
SHA1bdf45245e65875447e8ec3f0fd37a641042310b6
SHA2566a58307ba1897ce17a17d338df19aa6cc01994a97b9c2fe7f2e885c57db7648f
SHA512257d28409563a904e8a84446b1c72e338af6389945e765da3e5f44c9410e58470b440d0b811de6aac9068bf3bf8a28ed0518a20d5f81536e9162044552dedbd8
-
Filesize
1.3MB
MD51bd665be5c3cd2ba3dadd76d8cf32d32
SHA16523e9afcd2c3e753ab57338b73190858c52a8fd
SHA2565f2c037e9040f776da103120c43f2ea1580d35bc3c427760b9d9f29c52d69033
SHA51298e0a4ccaf0a25259a883d0d5ba7fa0d39a178252a9070f1c7b461fa6615f146b8018e842735b9c32ff68ca88cfb68a516ec7c0333557bbb9ff6674eed1a7d98
-
Filesize
1.7MB
MD5d2b68eb099b2b93c69f1f76423c45a74
SHA1b5970614f2bf850fecf36c20e421c96689d96ca1
SHA256a94e4915672b5abceecd034fdcb8234f1f38b967417ef2070ed8cb5ff9e4f408
SHA5128c755bdc6fe6a09d478662ba8d534c0dce1cd671f155a5ec1654fb08495c1125846616dfeffb18eb8e5ae6067d8b2595ffdb587a4d91455b04708a8808d5b6bf
-
Filesize
1.7MB
MD5d2b68eb099b2b93c69f1f76423c45a74
SHA1b5970614f2bf850fecf36c20e421c96689d96ca1
SHA256a94e4915672b5abceecd034fdcb8234f1f38b967417ef2070ed8cb5ff9e4f408
SHA5128c755bdc6fe6a09d478662ba8d534c0dce1cd671f155a5ec1654fb08495c1125846616dfeffb18eb8e5ae6067d8b2595ffdb587a4d91455b04708a8808d5b6bf
-
Filesize
1.4MB
MD5a00057951f18c300c3480bc3052af05e
SHA1fc8ca2c8fc60b515fa0aa2fcc692291581b47b6c
SHA2563acab07c5b6a56c225a50607d3325b08f1d21e04c13881429258858b1978064e
SHA512f6bd6b35eceb63b02c8299079dfa33f4b4f845e9a66ae590691715d9062c63cbbaa5799db47dc765dc28bebb96aad6026f33434fe0b6ad359e3af650fd5d335d
-
Filesize
1.4MB
MD59cfd66720463eb3ca816189518b0425d
SHA1ae6f898aef5cf312b54d950350832ff7a5bfb2ec
SHA2560f9f892ee65c51f2bfb59b5a7750b741d5c83ff7e91d2ef0dc84fd0282e75460
SHA512fd8ac1ccc1bd078889be87910b48f13542956e2a1a4d73865ef92211a7a6eb7d2387245dd6bc01d3cbfc4ea635e643f0905a8c029efbbf7a3c43efee6652213d
-
Filesize
1.8MB
MD514a6035e27e7e61cc8e15275e55d4bb7
SHA1f3c216efa07827cf78632da46af44d4df465a25f
SHA256883aed0590b7ea6c1ba1ab8c0668a09546f5aaf4a939a58293de72079a69fbc6
SHA5124f5f1c4a64fd13ab45e1ee5a931b79c05bd4c69e7f18813097b10de135c35fb3c4f9f7422477dd074c4a985c7f31a6546d81b8cb4176d5b47cb6b82d5717cd9f
-
Filesize
1.4MB
MD5f9cbd8af79fb52c34c8c578cc9e6836c
SHA1b6e485b4160c42716e01e848c153618dc47ada1d
SHA256e360906c7ee8c04e113e0fdd2e70624638b65b08640c5257dbb5f54f85cf3ca2
SHA5124db076813ace5a40bcb3edfa1255716bae86c7b5075e94094bfc94a3ee6a1edaeb86f424b577fcc5a9b4cebde2fce5cf75c22929a6a8a8a3fd0df25044e2afd1
-
Filesize
1.6MB
MD555a49e58c49160183e93951cda261764
SHA1ad3c6ad583044bafb513a802649c0a4b39d25d82
SHA256c11f49533c494cbd2a9e94aa211d46bcd7526ab33113c527ad04242dd4a7b4b1
SHA5128f8ea556e9a9b44d6ca93175ba9f46324acc6b226257152cc595f0b664dcc8b4776dd398e12bf210345cb3edd6b7c7348a8870f4c48740e9350b84ccbf72211b
-
Filesize
2.0MB
MD5807805fadfa27428aadb2cf3b4bb879e
SHA148c7f566c07bc0aaa0d60b6d16eda28e8064d770
SHA2563f0cfd8935cb49377546b17c26a7f5fde7f30a3da8d4f1a7618bb4c390ace55b
SHA5120851fca7b1109e842797e20e25b93d02ad9eb2925969643ee0a26a246057e1f4ca9bbb5ff8b91e2aa20a114927a5284ce45dca74945d28b46ae9b29b755a7aff
-
Filesize
1.4MB
MD564eb702cda51e33165cc75b60ded03a7
SHA16b6cbf998d3046a136a43b19df659d967eaeb0f2
SHA256c7648653f82ddfc30bbf1488b0584b0d6920b1a1e7a316289cd3574692fca666
SHA512045d3be21cba1704943211f89a2b2df52c3e34788d43e77f25ea987572f340f0410d4e43e77a6401192f3d6581d017906567feb096a4c1d6cdfede5ce14f6ce2
-
Filesize
1.5MB
MD5f133dc72aa8a066a320c337598cb3c95
SHA1acced8257ec412a1229dcc9a08fc869d0b0342ab
SHA256ca10033fbc0319979383e2a74689a6831e07824ef15a50223713343819ef2707
SHA51272161d2d5aaf6a07716ad09cf39ed7b61c19c92ffebe8134fd34de6846e9956bcba395f6a92c00a11b1df3fcf8c852f01443d8a4be4548d534d3a26623ba9ca9
-
Filesize
1.4MB
MD50f069517da16f15b1755a1131e220187
SHA1684ee3036ed7c958307b00d4d2daf0bde0a118bb
SHA2566774bd3c3692ce49b43ecc93475fafc4e6e5363eb30e4919c0cbd3baa62a7cba
SHA51280f3d0ebc7a6b1faa3a1b9f046dcbfbc0ddc494eb1afa9d641b178b6f42978a8d1ab88bcbeb5cc7370beee404ee0d05b088928f7c72bfc2e43795d3dcfa4a5fb
-
Filesize
1.3MB
MD57a56e61cedad7479ef02b7b991ac93f7
SHA12468419f45bf652b2c19cb2860baea35428fcfcf
SHA2569a1184079b8aef622179fe35f2952b9aed4ba1963f2084085a9337726a994036
SHA5129055eed235cef2361b96e141af998728b8fe6d6921c8a4f835b002635af1a8ac1b0b1f7d4229c33e7549400d4929869b7c170fa5c216d3f58a5eab8f2833a5f6
-
Filesize
1.5MB
MD568b427e65b0c7c28d4c147ace582c27a
SHA16e023b1a97fdadbd09715a7ac249f3400077e99a
SHA256cf89df48f9e1005c0e385912a718ba33145725df42290c436965f68dddb11153
SHA512a3cdd0827b6d6d86cb7f6ef876cd1e57586d68e992f6521617c9e36de1da468b4e3fcf293962116447bcc2bfdefeeedafc2809c15cd0a90f5530a82f0f9597cc
-
Filesize
2.1MB
MD5c50af5b9b3feee5a21d7e0b369b1a1a4
SHA126900b420ff282bae3cadafdfc65e6d6d5acef9f
SHA256c91b8c406d9a8590e101a8382fa83a72c7723528435174d13eed58678e8c814a
SHA51229f975d5e6727483ee382596d13c735b83c1a88b30f4142979a8db1e050871d8bbe25724437150d59962c34f5b2cc247dd076bd0d49dd3a77ffc14df0cbd56f5
-
Filesize
5.6MB
MD53cb0d3e5871c60bb3ae8dda0180f9b13
SHA130960c5c3632c85232ba47ac08f0c8c7232fcdde
SHA256242fdb65a6848f9da9f9aa7041398a67aee366a4f3548e0013cbdbd4fc9d01b6
SHA51283f3365a6535d8cf64dca79fca71f4a8d2a0ecfdcbd47364dc81bc4496440315f4f822e3e88a90409e5f0a24e8575f2751151ba18deb2fd0cb4f793005f51dd2