Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
15/05/2024, 21:10
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-15_5e59ac541dec051f71e6c7d6144a6c75_bkransomware.exe
Resource
win7-20240508-en
General
-
Target
2024-05-15_5e59ac541dec051f71e6c7d6144a6c75_bkransomware.exe
-
Size
1.6MB
-
MD5
5e59ac541dec051f71e6c7d6144a6c75
-
SHA1
53d06fdda957a23b640b7d572d6b14e38f2a3fd5
-
SHA256
ca4ff92023f433abe5f7e0bd90074da653e88e7ed84755a2db75946960db202d
-
SHA512
212050e904d38f58b994f4b88a805720276bb20b513718dfd66301fb8d4cb9dbfc1d05d89f3d97b78f4699aab4104822e3f048820cc29f08f6458ec46eae4044
-
SSDEEP
12288:Y2lWRPkhA9PRWg94MTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:Y2lmk4RVSkQ/7Gb8NLEbeZ
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 232 alg.exe 4144 DiagnosticsHub.StandardCollector.Service.exe 4184 elevation_service.exe 2520 fxssvc.exe 2252 elevation_service.exe 4912 maintenanceservice.exe 2400 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-05-15_5e59ac541dec051f71e6c7d6144a6c75_bkransomware.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-05-15_5e59ac541dec051f71e6c7d6144a6c75_bkransomware.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-05-15_5e59ac541dec051f71e6c7d6144a6c75_bkransomware.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-05-15_5e59ac541dec051f71e6c7d6144a6c75_bkransomware.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-05-15_5e59ac541dec051f71e6c7d6144a6c75_bkransomware.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\7beb932cc3136770.bin alg.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\BlockGroup.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log maintenanceservice.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe DiagnosticsHub.StandardCollector.Service.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4144 DiagnosticsHub.StandardCollector.Service.exe 4144 DiagnosticsHub.StandardCollector.Service.exe 4144 DiagnosticsHub.StandardCollector.Service.exe 4144 DiagnosticsHub.StandardCollector.Service.exe 4144 DiagnosticsHub.StandardCollector.Service.exe 4144 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 672 Process not Found 672 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4892 2024-05-15_5e59ac541dec051f71e6c7d6144a6c75_bkransomware.exe Token: SeAuditPrivilege 2520 fxssvc.exe Token: SeDebugPrivilege 232 alg.exe Token: SeDebugPrivilege 232 alg.exe Token: SeDebugPrivilege 232 alg.exe Token: SeDebugPrivilege 4144 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4892 2024-05-15_5e59ac541dec051f71e6c7d6144a6c75_bkransomware.exe 4892 2024-05-15_5e59ac541dec051f71e6c7d6144a6c75_bkransomware.exe 4892 2024-05-15_5e59ac541dec051f71e6c7d6144a6c75_bkransomware.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_5e59ac541dec051f71e6c7d6144a6c75_bkransomware.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-15_5e59ac541dec051f71e6c7d6144a6c75_bkransomware.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4892
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:232
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4144
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:4008
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4184
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2520
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2252
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4912
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2400
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD568570dc779954e72459d74b92ab9d546
SHA1572e908338c25d2c0966b2baf7f1a9bbf5d8ac03
SHA256da523843be5d6fa19dac4aed16cd5b7693bec160f647549aa5b8246921f1ded7
SHA5129ae466c6efef64ec4dbe3ccea477f620ef1e0fbced6ee73891312869c41a62093d143a81297d8d90b169ffcc5e2ca54631b8e93084b48086ddde17e84ab03766
-
Filesize
1.4MB
MD59c7104526eb537327f2566cfcf814508
SHA1c4404163cfa6c2c5dc42fbd4a0ee6323e5e59e0d
SHA256ebe428c526b0b0289014f148fd170e6757ea1b2635ff5f4f2f58bbc103721362
SHA5121fb0a3018d54128a09d4b7188aab1790a7c1cc379fddb962b01f0666a84f1e53fc66a3cf7c2981e697786ef872f96069be06a202cb5b830d1ff2bbcbd8b88bc0
-
Filesize
1.7MB
MD53e05c36ca17c79b4fb7c9e0c18997f8b
SHA1b1c160bfb947200ac9615b188d052e350dc16aef
SHA25611471fea6a553339699692d1d5365c6d94cfc167f3a7d8534cfedc20fe4399fc
SHA512a54eedc05f832e4536f6be03c9170d125150987d0cd83ff573e162a9bf4693fd93186379313a9bbce5c2f97a6fa5528cee90cfb5602c6bada81da335c189819a
-
Filesize
1.5MB
MD5292576cb9bb2fb584f26eca3037561bf
SHA1c4a67022ec276225efd791644f9104b37a728c52
SHA2561bc997c27346e4ee64757e97d89b2e30a5cce2c9174bf0bb47e4c7b23e99a633
SHA5127692581184bc0de99f2b67898c7e6d85e532dedb1e957dab60515f24f597851b1e5e54b8ce61dcfdf4d4a3ebc3bf627a7ff08e8bd32aae090d1a4fa628aab842
-
Filesize
1.2MB
MD54d2a57d29060de4f19718ce91c121c0e
SHA11ce3097c53e2223d6670e6fd997b11d659558796
SHA256fa4d09d8e7518a18780e875e8ae93a8926c858d02016d5e51219cdbf6627760f
SHA512ce9b38fda2512099ef5aca9fc41d19d7b8cc76e7eec99f1acd9e448afc8c6e5ac5de6292eda14d0defaeb12e5c319a8f9671124c7c4182307f3d07230832a5ba
-
Filesize
1.2MB
MD51c6574937902ae014e055e6c004f740e
SHA15faec084cfc30db36df0c8f27f278b3099d83ecb
SHA256423b4432979d8cf8e8862b264a9b6a64d5a1b928ed6d59523fa5921e3b174248
SHA5122c72a8e3170053454e7354bf302a201b313924c8b8494390e0cd785a190f325233d9df92780fb47ed746a95c3c928ea29335dc838a4d19f2c41f5065cba45f87
-
Filesize
1.4MB
MD551e82353891aa9d802dadd0e73ed625f
SHA183f993d21091b78198228eaa46a16b80819f592c
SHA256fc9d80527bb66c25dc88adacec75b7c7b00158eed3a5edce46fc658a11b72255
SHA51253f2a9e162837172f042622869682c57c809f0a9e53e0c162166d53e23dee0497871f3284ef7a06575cef90966ca15f2404fe51a5ac6f4be8ebacbca2c3012a7
-
Filesize
4.6MB
MD5487788b183b06d94dd880ce9b7b853c6
SHA16a9fde84751e7df79c6e189d645e247367e1de9e
SHA256a7aaed1333e795466e6108025f3181bbbcae1d7d7b4f359e5ac2078fd28badd1
SHA51260d215097793f56b7495ec6b341270644dbbd9e3bd068401545964e176576e652b064058493fce98caf4ec5bc91cbf669f445596643424c6866b5f0215bc0c14
-
Filesize
1.5MB
MD500fef85abcbd25663af9b52cd12f3c71
SHA17467813c5c9e1ebbbef7475aa772f94b51ad4573
SHA256ee1f2dcbd2046b685453c34a18f466ece207c1c79b7c5e897124b393545dd70a
SHA5129c9b94520fd4ec1bed155155814a69d4744ec77e6475eb1c32e3f94fb22bf307d730bdefd2e39b64e08daa2d261c9f7ee49bbe9f6461fd0a1b6a6b73a6e16c36
-
Filesize
24.0MB
MD56f5a941b61890529741b8533f14e6d36
SHA124846d9eb2de1cd04192e2d2d2024efffd317062
SHA256b8649f34186fc06543a18e4ed7006c9ab2a5c5580e19b7eb693af6d38e0d0ce7
SHA512e4f9a1c53201a6ce61db1fe34a9da446d6743c2c93da026f2ebf0648f2da791524d8f54e37e4a9ceaf3bd335029a20a88d23e1b0f587af46b48257486898e39d
-
Filesize
2.7MB
MD59f89376002c8f46fbfb8b3f7928db3be
SHA18dcfc6539191512b0984b34ba16ee551993c5df6
SHA256baffe50d851936a3e792a35e04f423e266c29546f2a8c7bf7ec230847c7d29b8
SHA512b2e1f4783c8158a1c60b93020abca5aeea222d6ffb84571c2e055887b489b340f83339d16eb1e77651eca7fd9e1410bf92a7d82e74f97aa9664b0cdb679592e6
-
Filesize
1.1MB
MD5ed4a4dd0857f2799406feaa7a00ba46b
SHA135d48622532908836ef5f202a0235a94297141de
SHA25631a4ab4fbe9b762407bdb824bd997f1b88b050f5e5a4a067d3ecf352e20dfd81
SHA512d25fd280ceab2a9382a293639a7f8a2b0aa0246202cc0c53769258fd1126cb2fd528732d7d100d27aecda47e6676d5bed421b9d8e3445200ae33344e88a77069
-
Filesize
1.4MB
MD59d813422b938f29585a418edd732d874
SHA1893dc984828b205c6a072fd43f452595a3f732e5
SHA2562b45d6866c499df106a9b5c6769e2d905078c992f061843525ac60acf8ea59ff
SHA51217101963ffabc9074da717acbf0c4d0d0adef3227d1bd396ee09852dc1c733d0bb0da61c7a0995e3931056655e46b9f52d0c68501c530295e489e82f69a03b07
-
Filesize
1.2MB
MD5a3bdd8d7b0b2eb34eeb52ccaa3cdc1c7
SHA1a20d97bd2c27184deed040cadda8d7d79d7f947c
SHA25661ade1638c76fd96f6d1cc5422996f7aa759939ffa816f09c1c896a7a16ad347
SHA51260b49dbb0a03675e4f62608ade2707ec7bb7d9118bbb7a5ee298ea5a8b0085af7871dba6688add7656ca1436b4ed92cc26fe791180d6ae91ecfeadf6a64fa2b7
-
Filesize
5.4MB
MD5f54ee2c8113199ed8cf07d0d5a88c3ff
SHA166980d5be56cb0b3abc334304ff454ae75c16e86
SHA25686c8341a78c7b894dcdc27b8ccceb4676182eb119b2104da6cb00fe2f8f56b98
SHA5126f859d7ceb7f78a77bc97f5a36680a3dbd98b8eb29878a74d331abb406cafbbbae166ccf8b2982ceae5223fb9fd0822a32b103e71ef267dc13652a51aeac8931
-
Filesize
5.4MB
MD5b513be324a04bc1bd1bda3e468bea6fe
SHA1d5a41f8a16a51a49fe6cc40875b34125f892cedf
SHA25664600960b81dbc2340b3568ff2ee0fbf42886bd1ce336ed84a66773ccb7fc47f
SHA5128da3a29b35802c4283a9251a4c237e820668e997d9068a76acb41dd58d9da375908661134c289d0cd6ab9233dfe0c14752c7eef5e756bbe34462e9f1ba023359
-
Filesize
2.0MB
MD580a1d72b12348a5d521f0ffff5d91a0e
SHA19b287be05bb1b0b0e2a81c6ca6ac1fa587ce0c58
SHA256df132297dd48d660eb13b972b82ad4a0efade2472cb33883754e9429e572c49c
SHA512c71a344773ec015a9f8ddbecba900e82736de1064cc9ea7634f436ca49aa0166fa926fff435eaafbc7a3f00a715b40b1b50d04b642e545e81c7685a26c7712c9
-
Filesize
2.2MB
MD58c4bca781505593d782cf41a0cae5a31
SHA15b4d9c9afe136cba72d755fb2d110178c685fe9a
SHA256fe26201119a8b453465684c1e967dc6fe7f91fe6acef18fa06edc8ae16567534
SHA51200ff97fd58d27add4be84805a7b46b0173374950223f5552fa39c4760dadc206fcb2a6cfc316b11df167073a61d4c4523f050ed2349a6a611288d7a1947a42b5
-
Filesize
1.8MB
MD53e1ca5475d22fac3da987fb0a83293e9
SHA1c67ff8307723fe337eab7ef17b98b9762a96e9f1
SHA25663bf90bfc34ce41d9eec96a4256353c87f49611af66942b45333b36763fbeaa3
SHA512289ef41703915fec32e715b501545499977eb3c086ccbcaa5c249c6d30c35f503b42740a47244c6256fa663ea1409fe0d92e3401fb14e073b7366576f78c2e63
-
Filesize
1.7MB
MD595d30dc9f238a2547f034b2be4b57344
SHA1adb6e55862eb7af8bb9d08fb19ece993ed0b1ce0
SHA256fe027a97895cea75d4521ae18976cd1a33a175c0b8cf8bc4bc992a5b2b86f8c5
SHA512238c8a7f5164c2bdc42c98e27493354be30ce44adcb1d33ef9ccce01e915a3a89bcaf716a945ef4f0c3e013cb1c9b909efc6487759e3d1fd8788c2d798fe68c9
-
Filesize
1.2MB
MD56c49b60227311acd372babcc4b0396be
SHA187e512d0bd9388fe391304305ee708a317a68ec7
SHA25650fe72a03fb0368f8dc2e4282dcbb7669cfc7ac957bcf1d9baf75b965920b1ef
SHA5127612036f498ba60f1f4b67536161622521d8bcce871338b1a09ac35117f999abbe5958b10c512b48845d17136f66a34745276558b79ba6adc814232df133a525
-
Filesize
1.2MB
MD58b7187d51139817fb5e6cd6b45f47e75
SHA110de2aa59110b2d46b965aab3c5121e04d88de13
SHA25630f0276c3f5c7ab6dab8b382d746ad05974d8d4d1d58d5c6a524ad189958071e
SHA512627259421f668006f5093ccc9d61fadeb5a7cdb764e0174e93e5156d56b8729408c21340666c241632f55c147de31963ea8b8577143ca8ce7dd623c2f9bac601
-
Filesize
1.2MB
MD581252cb0e0737162f122d79255088e82
SHA16541326ba8cca3623d1ca748b84c87895f2c6622
SHA25694e6f2c3160e69df990d39ffcba80b6d2f79b55f163218c05b5a4b72bbf2bd6a
SHA512f439e20e2f473e8fcb86915ebb61e6546e64c98b533a018225fc4232a65df4bc607a2d86efd42fbe78e9fe88a6e6445b5ddbe382ee052da504cec465283100e3
-
Filesize
1.2MB
MD533f79c15977013c770f5279e588406ba
SHA1c04ed66d0d68867966112d56862251f2d7d876a1
SHA25651e931489d27679f8957e00dfe2de486c7b5dd7f6cac435031c3ebb06935e6e8
SHA512b9b42e2c8d66140efc10d14f1ca07bbc1d961c0c45e22be7cf6ae7ca6172f1c817360140bf42f6dfa4a388b12c105fc0af3f8cbc1006eac977fd873ea9e6841b
-
Filesize
1.2MB
MD5f43d6a3274b7c6edbbc17bf3a126d8d6
SHA1275c39d7ff1dbd6a49909515003592a75417acd7
SHA2566019fc9b3f538e7812ff6e113c966e3381c511f79cf1f6f46c2b6c85194c9136
SHA512ff95f5011e552ec869440ec2930dd79d979f49397e50c07fb69426f6197661f3468ff6f5b4305502dae13a3f742430b0ed77f0381ba74cb9915abe48021cc382
-
Filesize
1.2MB
MD5e26f7f0dd62121a1041afdcb4b8fbcbd
SHA10dbab9e2f18d6e4d1fd3af1f7452618241612628
SHA2565414d9bfa4081ec5d32b209f2baeeff8f1b096a57280af93ddf3d4e838305f93
SHA512a9b09d021bcef3dd472298744c29414a22479179c0c683d9d1b36dd4d407a765da967ce6df04258b6d8c5b2ef37d5c990dadb89566e3f576754187a45af11638
-
Filesize
1.2MB
MD549571e0235cb97f7d91f92d7555c1e15
SHA1bfa72390426e5612b0c8ecb1fbd5d2bb09a29495
SHA25623f905f505334e8d4cb5a3a891d563b7b27c13cdeee0d9e441badfe4253c83fe
SHA5127e22e42eaf1f3cb45ef85340d707fc36577ea16d907034f8af0d5f723f091e48b66e52c155c7e126b0799f85521c4226214b1827a0ceebf583c1346b0347cecb
-
Filesize
1.4MB
MD5ecdfb82a91002a444e673c1dec99340c
SHA1dea7534e08863ced193f067a62768f38bd9e2a23
SHA256fe8caf61e0415c5bbfc1c05944b15889f62a9ab2aa78e092e24eb0949d702742
SHA51222ea5fc105addd80267c4ded9525dd4880c76043c299eca5e669b1de9cf8adb938e8a5b7c22e0f8253b62a9afcd9b567e7147b3d073a6a3c136886b31ee8d9d4
-
Filesize
1.2MB
MD5dc11e527ad2cf58254224a8f3e1f6986
SHA1bd46a09cf8d6d51eb1b333173be9263d6b4f3644
SHA2566b3aabbaf79ec580f53c33354744858313ad42cf85a254624329a609b4d677f6
SHA512cea1221a85977e81df6c9f59e238caa5bd7069060b7898778ac623002c7b50d544a3c46aa84a2384aa6e63aaddf6b9a19ec359dc160f9938eb18ae7391c70c87
-
Filesize
1.2MB
MD5e3fcca64f19204e39c292bc4ce44bee4
SHA1b0d130866bbf6ac8d20238a9bc67469608ca91db
SHA2561ea3429750116bf137dffd3eca1711ab2273bd87e69e33bfdc1214f5bbd0ca22
SHA51234d0a1984eb02ac099c86813884296a7d4aafba218d940e6890a7b98c794cc196409691134695157aece8d4ecf46e1d8dbb937b5bd57870d30ec4a4398ae3043
-
Filesize
1.3MB
MD55bcf7ce47a3945d7b67890ff460374f5
SHA19417a54fa08d35c38323801852ccfe3cddcafa4e
SHA256e33c028813ebd22f34260c06b3bc5da22976cab543f8396c7ef612a12abf5a1e
SHA5120ce12c1a6119c60d46b7215e62d62a3a3bd6047ef7f842542cf21c675f29fb5ac09cc520c8a72107adc7601c69cb6282e1909854a8614b544b5ec3e29dbdcf20
-
Filesize
1.2MB
MD50c060e9328673f4bc56b0ca7966016a4
SHA165d4d939dd7ffbc37a0f3bbba57936972dc5bd29
SHA2567018456a38dc9d0dc61a42d2c90b07ddbc4f7ab7378eed712baaee753d3e7005
SHA5121e83d4e092d2a267c525445237bdcab10c1a3970b233b3ce5850580624783d23ad38ea8c24695a45b4e4efac9940bdc691ce480d68c98f9ea608997012327a17
-
Filesize
1.2MB
MD59f0a075d55ee2a9f5267ca79b0d46b5b
SHA14790898c61242042b061fc110b1c0e26e29e8ad0
SHA256a73e367f273d6d5261ad92a7700d5383eaaa803fadc9a8d2a5470cc794a36f7f
SHA512f0acf6dc4aaee18895b770a01b92b82ef42b385f37789d77f26878293e1b088e546e87b37f21bb8e293e8be38b7453747272cbf140bf3b970ded59c44c856f4a
-
Filesize
1.3MB
MD53c0705e5c34b580bf5c93accb46add12
SHA10881259d1370dec9da279af2e92ccc82f025fbbf
SHA256e9a12e560b2faf7d81a17dc97b4ee11bab8b610458ea935b2613af78f95d35ed
SHA51282bffbd710f41d476312b5a6e61f3aa3ffb14cc526da744d186e4fed857732ae5b6d99e667c273a99aeb8bb0cc356c5f1b72cfb448ca375e6fb760064992ec83
-
Filesize
1.4MB
MD5ba86bb9449cc2a7386f28e142cb86f7c
SHA17c90e219783d6fb2e641f8758761a6a7801467e3
SHA256694ef16da9068b3ef486fd871482d435eab5aea3c02439c91467dbb57276b246
SHA512359516d0c305eac307370d2468c3e69537b9011df6579083359102e4dd6627de7f8fd06c9588ed66be8b8cde9b2f5e78e2b0b6ff748f0dbd8f167636f6df3a3b
-
Filesize
1.6MB
MD5df880dd0f951c22da472f41959f0e388
SHA1ffecbe41305906b695610bf4b09ceb3f963208e7
SHA256d7a36667b2111170db954ce87b274ab0b2a893e24e30fbcda2143e3e03567d08
SHA5127ecfd1dd5d9edf775af63d79469f5009cf94ea998fa007a0d9293477b05f117ae0e4a2595129f32a330eae89121e7b55346dafae87e02719fde23f6f01af695d
-
Filesize
1.2MB
MD5ac83b7c1726eb410027dca6766ec869c
SHA109a17ddc464ddfc18b13ff09e28e6052acb4f87f
SHA256e078a68ca5daaa31f8177cff1539fd7504f76fd1795f79950724af13b9ea68c6
SHA5122943d13e12d2f7e87aa6800d3a6ab53f6e83d876c75efd90bf21cc26eb789ba9043b4b9a4094b0c9b67c46de449999a49c12be0680da22d9c09e2b46a80d5194
-
Filesize
1.2MB
MD5d42ee9b1386c863dec1ab4cff3ef3c9e
SHA1927cef6120951c9549cf3a6a01dab9071802c3a0
SHA2566c7b836444fbe3197c6e791561eabc889f5ce6ee4dbbc60ec32018822e7657c2
SHA512470349f9b079bdab932583684a98dcea743c8c9a4aec0d56335b4a17b3e0222378bd411817130981b73230a1eec629bee80220da6e56bee0150208070ac278d9
-
Filesize
1.2MB
MD5d18dc2a7df7bea7d3ca1f8a737536c65
SHA1cf78530b811d2d3597740078e7509c2ccd6f4663
SHA25609a8ee2feea3448dc7635c77a746f8ed8ba4a988b53174c365a865c28461b808
SHA512eef43c5372f9369d4579762dc47a141f9992be2d4eb712b0d584f59e4b98c57347cc590f0becc8587a4fe4e0cffa41d06671c179eb015a2c42c0348c3ffbd39a
-
Filesize
1.2MB
MD5323d5793ad212058bc3029011258fe24
SHA18972bf698621b30999a782d5b8abacd99d59ab71
SHA256a124a5bb8561af620c7fc421ed33888467623f164c581dce0414aec59050ff79
SHA512ce93b1c6854d3e56b760d65503f1d7bc602f3cb501b1c28129bac18209e35500d0bdfa4b63d4c12a2e4a1d9c1f1a4a31fc4c64c4a19677953137fe150fc06d51
-
Filesize
1.2MB
MD5f6deafdc75c8ff2548dce483192e897c
SHA1135a1f969c454b5d732b0bb2869907bc611dec30
SHA256b415fc49ce87f492617d985c15fcdac3d383f2faeac66d87660ed07af25a9354
SHA51269898959014d0bb764f75be8890d33db6c52cb7f9c904c6e549188b0f3af1228158e88bb8f6de9de11f13331b6ff257beb3fceb0266431cb33d62b78c1ef7c4f
-
Filesize
1.2MB
MD538b011d937a10aa558fad0efe064d9bc
SHA158a216e04b71edd1602f811aee50529c99541d0a
SHA25665825902f4a39af7155258cb05377f6d674e34f605e331a3fe68a3b2ef7d9f46
SHA51214e7a9e9f6706a4fab4ebe60c72ebdc4ebca6c18db4ac3f9e276a79dc00ddea0c0b0513c0288c4b5857f3f3583c9e844e140e1b5c7fd94821b24d40ce84628bc
-
Filesize
1.2MB
MD52c5a2cec1f6680b599d834ffdf4f2694
SHA141ec6f742c4c96f46742e48b92d73d22fcfa7abd
SHA256a3f73b968ab84848a2a74693ef2e61ad6b3bb6c4f8301f9f61b2381cb015a9b3
SHA512d9a323884537c26463ec396f10c7bbbf51f29a90d45466c61d9e3001d69f18c2ddbc496d72069cd821e814d3b40da4269bb62c08f2cde3921cfe02ee6edd4196
-
Filesize
1.2MB
MD5daf7c657d02534156d0b30c4d4b60f66
SHA1ae6e0bd139d1ddb356a5aa395230a410d3fe99fe
SHA256d5572ea9e57d5398aeebcb1eff58dbb7c3fa5b42c08ea18e405f59a1021823e1
SHA5122eacf75422e5613b0637e91bce113931468f5805a04f5752cd85eb1da7140388f6caf81f7b78417a16f924e1a4f853dea27c0e7955e7b88f36a0f92624128df2
-
Filesize
1.2MB
MD5e9d820924364f4fd8b5f39ee311423c1
SHA103d7d6b5de8755625d5578374c4f54886a65065a
SHA256773e28a1866b5d117bc4f8fd29dedca08a9b0ab10e0f334ee4852150597db0ab
SHA51252e3574a52a480eaa22847e519c251903407ad416f539ea4b0f609a06a63dc2233ecb8aa8fd9c92d2aa31a8703a44212439dba0ff9680a98c21a83a8bd0825c1
-
Filesize
1.2MB
MD5838711a7cfeecc70c6ee86c2659fa953
SHA1db4864dce9407f0ce2f5a66f518f69bb9aca1946
SHA25691fa8b411b235f5cb5b1cd90b0c5fcc47fbff8d4a3003fafac1e96726fbb5834
SHA512c49b08eadfb8a4ae41946695de5c0bf8db2025b847cad5c3759eabfb901638935c1a62c4281330010c03bc2962cd5c559318553d4f8098b579db5627664cd31c
-
Filesize
1.2MB
MD56dc79bb66b7839552f5afc9e8e6380a4
SHA15ee56374373c10aa7fc7f461da9e8300d76973ba
SHA2566f7f3519fc3dc5cb9c908c85b91db00cc5e01f950b59c1b7b8393dfb7131c51e
SHA512771230c1529145b3034daa06c6dab7dc2ffa9032d31becbac633a0deb2e5c71b74502cb03483d9f8ed5ae0e756ccce0a092bee45b2e62b733b822c48808c00a1
-
Filesize
1.2MB
MD539adad66081586b7667c2df113f2377d
SHA12a4acc529807043cf09dae581b01a62ca6d2f37e
SHA2565af3ee9fdd38d4d0ce0e54517266f9725f63084da3537f28ca99c1f4d2eae9ef
SHA5129758c69d62a7865dc78defe217006d07a5eb1a9189ebe396cdc9ee0c605359c3e9440ec18565fd0b9dfd87dfa92e1da7c8b318a67e7106556e0e0797c2afd781
-
Filesize
1.2MB
MD5dd4f5ffa00c6315862a195312e0ef865
SHA1c2e07d63adad7c87b616d7b37b4a96599893c510
SHA2564d2ebc15636c42f477933258d80224b2f0f526046c77e42cc92de9cfc11fc983
SHA512debeef00ffe4ecb755c7b2898db9e3bd1ca3f22fe0f9270c915360469762e925eb938606743ff7e8620fdc3ee6d4d73ac9697c2bb5eb8e911d8e96913db65e5b
-
Filesize
1.2MB
MD5d5dcd1f07970521b2ad66e140eca1f4c
SHA1806f3aa3c65fadfad0f4a926d1538b9053d987aa
SHA256d32e857d16b29eaa4e3bd1069ee68b5400a88339cba39ad3b55483d7af1dc3af
SHA5128796c281b3a8f4a311e6e5e1ae133229346fcb1dcec571e09161ece8170ac9eb8ce1f84a75cf39970788325ed6fcb6499f1191bf97332bd117ea1ff2055b1f79
-
Filesize
1.2MB
MD5d984b6a266c3b534a2cd0e6c62a557fe
SHA180483401839293a35d0428639c42154bef513c0e
SHA2568ee26398074b1282b84ceedcbf58f1ab5a7f9794f446fbd5b030aeaad7f628e7
SHA512ef9c83d53e4280307eae83aa23893b91188b619edc1a948f048ff232b77f66d396027e3886cd2de8ea8c2c4c81154694f87619c1c53e841b5f8d6d34b2bf344b
-
Filesize
1.2MB
MD5e595e0d18870f690b128d62ab3c14177
SHA1c56f06c02f224c7ec9c415f1f54f3b660d7fe710
SHA25600a2ecb279529947a7a2f0e11a55ac57cd935045bb442981d8582c2ca19bfe9b
SHA5128610d789ee8d1b7f3307043de08811b3a87e69d5c4239659f16796ccd1aede6e67ce75a2a36681252248c9e23122c977ec0c0133d8ae0e090dbc3b5defc3cd38
-
Filesize
1.2MB
MD5565248874083b83b9d33419b11e512b2
SHA1e34721e29f0800c1f6d9f57fa9b334b2a5bede55
SHA25617df8c7a824987ff802463db211ce3eae4d42946809b1d964fc4a378b1ccb68f
SHA512228e423f12fbfa984b83a43036e1cbcde6900f6b3bcb36e1592384caf717a85c46bf65df45ceece045e8bec1a0416dfe89b577f56921c6e620f8293506ed9778
-
Filesize
1.2MB
MD5f2c8da66bd30c007d5274818242e41a2
SHA165b26158befb84e3465586c1e59ecdd55a745d0b
SHA2561428aaa92c87c7ff3dbde293c5109b89f6b674b0ab17a973b961253c8f7eaa08
SHA512bfab7a520b27ce6c2d1b4e9d35fcd3a072583ec4826a80d192e9086f1855376061a2ad7187ff7e4f8afec26daa13aed49c9e47780252471f2737cc13b7bfe1b0
-
Filesize
1.2MB
MD578b24779af60196f70dcbe3477b0f567
SHA1a400d86e660a96d7c8dbdad6894efef27414efb6
SHA2562c85b3b3df8bcd090b6062a0debcb6a556964435f84efaf0c1c9ee00c0a81b18
SHA512ddbfc74db3f639a0603a3d9a2f01a58acc6686e95886bc36bfc42b7f56e3142b3477703800d3df0c24df2a8a1083f69bca7c2567867b52724d3e894b359d3d8a
-
Filesize
1.2MB
MD5a819dd98d89b42b4db25e2de8ec6ad96
SHA18589d148580c71db1dd03535fd2122f8526dd423
SHA256e36468be4665c37a4f6083012d2d5bf08237bfe72a7c922bb7f8e1ec6ea8401f
SHA512d1197a60a30677c44b9c590beab2fb0a3d6d7386f8df4c149a24b7ebe33bcc553f789590c6abec9d0ce8c39ff15d53b7efb475d60f58fb98f8f080b3bb5ac375
-
Filesize
1.2MB
MD59147cec263636765efa02ea31e97d7c6
SHA1fcf6cafbd3244608184edc6f97c6d9926d3dc221
SHA25684b2a692f73b897a866abdf5e2baefa024201d201b3ff4f8ea29cab19d4fd939
SHA512b2c6392d660108a72d6150a01c840baffb31ed1e9191d15e8f861320d85a3d41bc037b7d12c6e2901cfee22fa9b1c234c60431dcf969cc06c5fc299d0ecea061
-
Filesize
1.3MB
MD5759eaf5e0766997df86232885b9c94b3
SHA1daecb66b0da9eed2c66b4919d2a8879b2962dd4a
SHA2560612fe41f46a211b184813df071d78a9987fafdfbe920368ecc3572c2719a685
SHA512c84894611e594ffbfe5cb228d94efdc3c04d7a38f63c68da2d59a780878c43f5a5d03b12d7545a15b0b51fcd45cd9f64ae056aebb77ede3f61b527c71a4d420f
-
Filesize
1.2MB
MD504afb820303ba5b3c8bc5de6a643a421
SHA145844749cd069b00fda9a959b4a11dee5fe32944
SHA2564728687dcda5e0c6c9565e69ebe46b7030d6abeb7775795a704fe18584934480
SHA5129f2f7dedc34c785b8ff471c03f074f5185bb66ebef92f0769d9fc9c487b688481a833b12702190bdf528290d43e9d10355514ad0953f8a27fbf82a9468210b8d
-
Filesize
1.2MB
MD5706e74e5da1ae01478d7f69d211d1e03
SHA1fcc6fd53ae455adf12500b5710ae95401f5a3d89
SHA256e4ae24c22d6e45c7c0ca5780c0aea7b212b3adfe8e25b960db1035922b82d392
SHA5120f985d624080dbb5b4575478828f46ec28ca2e4e5b7cefd9c626813541f8b92f618f22d402973de36d00b6f9aef4051440bb2a60d90426f31b87d2f26be61f45
-
Filesize
1.3MB
MD5ee756ad3a521772cbeca690c455da8bb
SHA1db5eaf32f373a2b047552654e44306e4188a15b6
SHA256cab44beadbd6dd33f5906786b6901946150a992a1266d11cc02b84bbe18a7780
SHA5123cd601324c22e96fda1bb3d5a2563fef79b8ab9a40b77471a7554d6b675af73a17929333d616fb03f162295deec1625072e6ff675c11f7adf93f6c7b6d9b2fb8
-
Filesize
1.2MB
MD5fdc113df2b5d8ed225e272cf29d03900
SHA1bd601f2e78cdc1bf03cb8f9834159ebea86316fc
SHA256f39e37af97568ca2aec6d41288bcbbe5278371445b927ea8f028d0f2cfa53a00
SHA5127384036656b45a460c0f776614edd8178c4f67f92763639085636745d680cfdc2d72fead1c5812e89c175507f0b58101970838d294d83e0efe7ee7e9494700bc