Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
21/05/2024, 23:03
Static task
static1
Behavioral task
behavioral1
Sample
575ceec1f13146234afb02a7d17974e0c22a692584f200a65fe085b88c08df88.exe
Resource
win7-20240508-en
General
-
Target
575ceec1f13146234afb02a7d17974e0c22a692584f200a65fe085b88c08df88.exe
-
Size
1.5MB
-
MD5
171e03f8df73d44090e6b03cee7dcfa9
-
SHA1
290fd453dd0fc1600e3cd6ddfd8eeb230bba567a
-
SHA256
575ceec1f13146234afb02a7d17974e0c22a692584f200a65fe085b88c08df88
-
SHA512
a189dbef2a115bf7a193c8775de776692764222d67ad26dc9ee51792ffbd80a01b641f7c475a919c30fa75c3323b499b5eed57d76da42bd0ccea5da4f3b03c85
-
SSDEEP
12288:/vXk1vOdlI7KcBBxeXZY7Zoxxau7gnijY5C1uP8xwB:Hk1NZGXkHu7gi05yu5
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 1868 alg.exe 2360 DiagnosticsHub.StandardCollector.Service.exe 228 fxssvc.exe 1468 elevation_service.exe 4336 elevation_service.exe 3600 maintenanceservice.exe 2496 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\system32\fxssvc.exe 575ceec1f13146234afb02a7d17974e0c22a692584f200a65fe085b88c08df88.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\System32\alg.exe 575ceec1f13146234afb02a7d17974e0c22a692584f200a65fe085b88c08df88.exe File opened for modification C:\Windows\system32\AppVClient.exe 575ceec1f13146234afb02a7d17974e0c22a692584f200a65fe085b88c08df88.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\5d90eac6b3e2edcd.bin alg.exe File opened for modification C:\Windows\system32\dllhost.exe 575ceec1f13146234afb02a7d17974e0c22a692584f200a65fe085b88c08df88.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 575ceec1f13146234afb02a7d17974e0c22a692584f200a65fe085b88c08df88.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7zG.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\7-Zip\7z.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_156609\javaw.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 575ceec1f13146234afb02a7d17974e0c22a692584f200a65fe085b88c08df88.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2360 DiagnosticsHub.StandardCollector.Service.exe 2360 DiagnosticsHub.StandardCollector.Service.exe 2360 DiagnosticsHub.StandardCollector.Service.exe 2360 DiagnosticsHub.StandardCollector.Service.exe 2360 DiagnosticsHub.StandardCollector.Service.exe 2360 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 656 Process not Found 656 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2748 575ceec1f13146234afb02a7d17974e0c22a692584f200a65fe085b88c08df88.exe Token: SeAuditPrivilege 228 fxssvc.exe Token: SeDebugPrivilege 1868 alg.exe Token: SeDebugPrivilege 1868 alg.exe Token: SeDebugPrivilege 1868 alg.exe Token: SeDebugPrivilege 2360 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\575ceec1f13146234afb02a7d17974e0c22a692584f200a65fe085b88c08df88.exe"C:\Users\Admin\AppData\Local\Temp\575ceec1f13146234afb02a7d17974e0c22a692584f200a65fe085b88c08df88.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2748
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1868
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2360
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:1048
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:228
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1468
-
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4336
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:3600
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2496
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4328 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:81⤵PID:3464
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD5dcffeb386b222a920722c291ee7b56e9
SHA1e53b5ac4246a8b5fdee85862ac5c5d85c465fda9
SHA256bcc09b42cd8dd4d9f5c4cdeb8dea3a625e8cbc8dcf414a26a44ec02d756ebff2
SHA512892f0e3e66b4e20fabd719d43373653c3e61a0dd6d9960d807754e1c78bf6a5c9925b1347ec07dac2bac32d98d79c9dd227ec3d97ce730b2c679f8870131982e
-
Filesize
1.6MB
MD568980c4b16324788048a223ab3188e6f
SHA1b9e89ca4ca3d2f72e867d36dcad8d45f98807692
SHA25626fc204fc1d643e0d0dbc47f08d365b5c1d0cbe3b96f7c3025bbdc2e2bb486e7
SHA5122b4631a4f899efc6881800268bf40e727f30b81f4368036389165a5f6d1e700c8c45394b47f13a0ba37a8fc2fb6414303f2bfd2b98935f71a2898b267ee64268
-
Filesize
2.0MB
MD54f7f90947d2f65557897a324c5c4213c
SHA1a5fde55d06226a4784574645402237ab699a6470
SHA2568eafa36197b07d8bf249ab815f9d70622a6b224bb73fbac3bd382f8729dfe230
SHA5127fd7fdd69831994ff386c5f831e7d0ac774625b8722bc64e452156debdeef6a17d925fa26fe625657d98a806980db2f609469803c7cff2f8c5d427c361f1d5a1
-
Filesize
1.5MB
MD5247bb153b7eeb75e7ab102d41fec6dc7
SHA1d045029a34106912c1ddae86cc96e4c988b1c365
SHA2568dd30186ca9cb31c9489dd073f9b45a9817158d3de90ca15cb7dba610b3de30f
SHA5122277e70ee18664a4f391f444f708ef9ecf019c0f5ecb37262dee7e4c156e83359971cd240c10493030fa6be4ff6609877e4680ce8caa13247fecb142a836714c
-
Filesize
1.2MB
MD5256e203a347ebcd7068858f1a4ab0399
SHA177e58bb28c3747acd6bd62cc142c30cbf900c38e
SHA2564297a8b479f2a3810c6da37cc0159c3e9786dea737f0abc939f3c8c5e89d5af5
SHA5126fd5f6913bfc2c5d39793409693de2495dc42c8d94970d738b3f3f4ccf7b1a6c3402bb12d793b226c0bfb4309ee044835a43d9b025196b43a7ab444880bc51f4
-
Filesize
1.4MB
MD59fef486a4b605b045028352355fcc276
SHA1c1c2db6e86a98a647e5b945f2fcb36c09059ebec
SHA256bfe547358b80cce05f39b5f8a60d1000af7c652a49f5627f8d22e4bb7a0f9eb4
SHA51243dc41f024e7df5bb877e4f53eab9ec255938f37bb14af8fbf11f6aa70a86d590518da382c5e360309c618a064f93df8c9e3b42ece67471a9cd40fe7e2d16745
-
Filesize
1.7MB
MD5577bb74d0e6d2faf1b0bf4abf08a66ce
SHA1338aee2d7522a6a831b73bc921f89828feb1c226
SHA2561783bd69f69de9f378455dab844c0847c8d5835289c2a0e48d0ae3c9db1a034f
SHA5123d363633b0da04be4163ade307918f2bee45e8194dc85e228b856ebcb34ca82d054fa74f4b2c9750c4d5da8d344a09841e163bec1b453a6476e4d2b19d4c8c26
-
Filesize
4.6MB
MD5bd4fec06b7e97992031687566cf153ed
SHA1ceb362ea895e1f161d007833286a42f67b275b22
SHA2563f0c34d654ef022c758a7986b2e400078e45127f94b8cff7d734d12a462216e0
SHA5127e19f255a11d010e6aa3f3285e1aa5978cb503c157a3f394dc98d03a21ecdf931c80ee0a316f8e8d84f3aebc3841140b49a2e18b5333f12858bfad2fbdca62c1
-
Filesize
1.8MB
MD5ed596f5820914ec432b10ab7b8dd78c1
SHA1add7e8b320097abea9d567c5335ddcdf22b8a15b
SHA256927c0b984c4882278ae79bc2219077464a6965bd0bc8c95f1a6fbf61350fe23d
SHA512aa22242d40b44703aada5dfe297697cf076e378411aaa4fdb5fc16a891f7e529be97ab9f8adcd0f559fa788307b4ef972c5d397f41c7c843bd6f54e8852d8894
-
Filesize
24.0MB
MD52f9ed375d6b18cc82470328d893197ad
SHA12257945e7a37ce675469db9041ff9456fbbcf28a
SHA2567ad7a74e5995a5a680df6b0454333fb1197b2ce439933ef5978ef33d6b25e14d
SHA512d91b962562b7f7d19a0f42365e6d53abee6941fdb5c9e0f48d9fb5689925f38e35925dd839869320b10bcfaa4a156d20ab1036f086659a3f7086259a5e9b5c8c
-
Filesize
2.7MB
MD5470fe111acced7f4c9fb74cc86a9d464
SHA183246827703b6bf149af72dcbf2d2ed555ede36c
SHA256e8a25c47118e00b5c31ff8724c08e82cb23f476f2016f9e6e25a75b645c64b14
SHA512dd8307b4c7c2534e99c1c6761a351b5428b768e846ebe7d493dbabf37559d869eef4f66d80b0bd899c3608bcbf04fb4b9a38c7b98a20b552eddc459cd7f4b522
-
Filesize
1.1MB
MD550f755d6b506c654fbaf421839e00176
SHA17053a41aaa8d8e09c0239c8728905ef8b4d91800
SHA2566e1edfb8a8645a1c8eebf9cfaf7655d135b6642c3d7860b88e3ede38a5992e7b
SHA5129ed865bad6d8fa8a1839cc4e08f5b7ce0099a79e69ba5b282ece5e9ae41f334f6800b1100366808deeeeea0bafb4a2e775cac1c3b0111fcde1633a5e3ab6824a
-
Filesize
1.7MB
MD5aed9fe2ce395efdaa00befb1940ecb1f
SHA1957b6fda278a2e4720a76a32504a8152e0536112
SHA256bb528940f81c4108d1c2e936e65ebcbdbc36908fe3539513924bc8f0d1a8a256
SHA512900a4af3ef7f3209d713cefe10bcd67cc1d55c9cb2adef0f772de5e5695c6c29ad8838ab9dccbea8f7540c20f0e3276c59beb24c4dc0565825ea43935c5a7a5b
-
Filesize
1.5MB
MD583b7773f68372c4238ba6668a788f6d0
SHA14daa016cbdb953ac469e6cca6508b20ef60bc37d
SHA256bd9e9b9501bace8162a6e1c7d1d9e5eaf6514d038912217366762c878cd1843c
SHA512e847f416a601a9eba389063f9ef8f3e94d836f7d726fd1824618b9bc2bde58a82561cc052323c94fb22e61884316bb1d5650f343eba8455f44a2049943b66d21
-
Filesize
4.8MB
MD54bd6bb5311011b2a32802a08019d1b41
SHA13a7a94d2d9a0780dcee20e2fb616128c125f7c21
SHA256f513bbc9f928f7c8795b176189c99b549f3a0298d48d5969560494ae595f99ed
SHA512bf3f68108e1b3db2e96866c208f3457db7d7dd022131e47b8180660542c19accdae1f56ad8ffbbfc991982fcb67b30ac365ac185ff920ec85c5f84f532f3ab06
-
Filesize
4.8MB
MD543863bc25ac345990ef564baf75727e3
SHA185a6d6c7bb6be8131d8d657eaf0481ea43d95f5f
SHA25665e74ca85aa78b0b74c01f01bd7df4153011606d9d17c2f23f120cac5cbc9f00
SHA512d9f377d2cec73b68d9ae4a9f037249fbb6bdbdad1ee203b1edbdbf494d304efdab322a621861da8001e63c494f11e70e5dea193e06c50ce96e903dadae04e8ef
-
Filesize
2.2MB
MD5c313972042520f9951fb680172c4b351
SHA1417b3d8ad7ad8be82e2ea1a1ec243d1e06ebb79a
SHA2561462e62aa8e660905f3d369015cc1700fa43a3441fc41e05fece84d3138c0888
SHA512f3491e32143fd60c65d1bfda5d6969eb94ce19f0ee93d3a882485fbfe3911af6aef9b327636be108a1093c20cda7501c69acfc552ae96f75a2a8ae9bc5ae4e75
-
Filesize
2.1MB
MD5f3a413917804528b75831e8094698004
SHA16dea5256428eff4bc524c9c828617dc70e3a2f9e
SHA2563834a4bac18b72196e1ebe8c9e6224c0f77e5f00f51e42f2853a7bc06d0dd7b0
SHA512342922ddc89f2f13daa52c4e3b478b3374e483b7f311e0dd096b4dc5b67748ef4e8c31369e373343fe5fad9c6c3fe3faa75547ff50736a19c8cf49e4defcbf51
-
Filesize
1.8MB
MD5c2e4e4948e6e9dbf9d527938a2e20865
SHA1af3f0886a96bb463e3dcb6b4344eb5c2ca07fff0
SHA2561e33e2ce9983a194e0fac1331392131fe50a62384944ca3bd861d9710861b55f
SHA5122db94d65df2d828b31aa704e608f1b21cc6fc48330a3e1a213ccef5e46bc9a96769e17d2754af9dc171eaa5983010bc3889c7d756d3159aaab60ba00a90859cd
-
Filesize
1.5MB
MD5070931a58e7017769a934643a2547d73
SHA102607e11ac64b5e9cf405058b55abc6b96bad767
SHA2566eddc95657e435cf7ceed81706a432b7caeaf594eb1065f0516c5f4c1540f72f
SHA512ecceeb07d110f5e54f278dfb13c089a8a2627833452d3e8f5cfc52ced9a6edb28fc5cb98d3f74fa13fc735b4baaf82b94df3cb9c3063eea21102254344914baf
-
Filesize
1.4MB
MD57ddf6db8993ddf82034301c99d1443e2
SHA13fc83bfdcf0a7305ec98e6fad06583f0fb2b0e6c
SHA2567d6caf8b4b1ae8f4b8bb8f0176fd677437244e1a05a096c008ca6f2dac14ce11
SHA51260375dedf865ca1b88d7fd68d622ad523b14aacef503047bcf2ddde4c19f46c8fea380229dd1a3a66b526ef28f9b88b971cea3c021c3d6e358bf4b31c021ca86
-
Filesize
1.4MB
MD5f753d98438b03a00b90b0954e039bd82
SHA12b7fa3994ad4f6dc25f59d8583f753a2eab950aa
SHA2567b4a524a8ef1a10c105050b358e04a45e250af16f173482b5fb612000224eb89
SHA51253d332076f85f4b4b0191e2fefcfb5869be103ae2e0b1932ce32eadaa80dbb76ded2eff05b454a6626e6f14535fe8ac349bcff6db16917e8314e8f54e1c98539
-
Filesize
1.4MB
MD5a7d71475a7772960effd52437ac4c3ff
SHA1ae4355da5b59c277b5e025f0e7a348c36fd35a79
SHA2562b559aa78f67610073963fe09d55ec80f40bfb32e0dd4f69bf80f0e8fa853bfe
SHA512c3def56f2a1d86978194a14223ebbe930a5f36c5ef822831da6e33d33142f89776c1d085d2a3ca866800d7f90d1b1a5d091ca0ede3df7252385e013d9e2965e8
-
Filesize
1.5MB
MD567b518f5361ea5b2c8bdf2060f1eaafd
SHA10080a7ce5669dd967bdaf8b94b05b3e1cb74c25c
SHA2565232712f9387251aa6e104a038b5f931434c57659ca17763b6cbb9f6950a3269
SHA5121e5dd118584dbc4769f51d2969d27df408892a4c088c69d8be08e1a275226da7695a3a683c431a0fe0858425f5d2f1adcb0958c6f7673cb6bf036e21bd72414c
-
Filesize
1.4MB
MD570ad503514ea18f859739eb11ee1c7a4
SHA183c87ce38c9871bb9a3eda6cc4760f40717ca95b
SHA256b59ded43752d35526173cb2d232221db19fbf527bf86bb6688c909a28768d454
SHA51233d8ba063613934698381116a468aa6e51f1243a5100e87139202977957a25f0c13768b7fe63f6e67f2e337967bd0349cd90d1c8bcc3be3db355b7d5b3b5f001
-
Filesize
1.4MB
MD5a87485824f6fe9c34a2097eea6183ec6
SHA187561205b0c4ef0dc96b23076fc57dd86e397396
SHA256f5a09220fb9689a9b257ab1fda462d6e31b626bb926795cbfae5b4a35c54be69
SHA5129b3e1ef82baf209fdface9f57b4e28f486e045c18a0e4b96b5ac789c610dc66cf4eca569243ec94d8d001512409a847d077d0baa2bf3112e449fd98b70381484
-
Filesize
1.4MB
MD5b089aa7a7e8decdb69e44d621935ed5f
SHA1d7ed99d0c39e244b8227fce6465db0377a7aa4e4
SHA2568accceecb2d840d4ff092899650fc59c0601ebf71f2df9dde328c354d10392f5
SHA512fc1966f8da1760356bb1fadecaf850720575f43a073d5151cacba7b3e3b10461a896756f142ebcf92ea106f3e7804bfff7b69ad1d57b7f31a924a26003f077fa
-
Filesize
1.7MB
MD5568a144212ef8771ff1362134bfdd3fd
SHA195eca0e9a22066bf79a6db4f9237f84ac5c343c4
SHA25648d6299fc15d1c27f93764a41fa2985e4fcfa4f114a0ef39de3927699ed2794d
SHA5129ed7147af69777649e8f251b674a34cd7ab07b1355f174347c443ec4e5c1f01ec8e7035d3217edb177403e71cc9e89811212a1db414149ba0ab7b446b2ec5898
-
Filesize
1.4MB
MD5fab199404edda15d5dddb4367462cc6b
SHA168916758703fca5cc30fcd99b2a85357aa35178e
SHA2568b855cbb226961549009b4603d932f287369dc3daaa3f45fb98f2f088e5204aa
SHA5120d1432c781f53bb2eefed628d35ce99e22098686d6fad2d1ed03617a95ed575274aa50e4799320db5fc40a78c311b4a496ea3ca1d315281f04c78c913518c1a9
-
Filesize
1.4MB
MD5ef47bdc36527bd1ecc07f740dfe30b0f
SHA1cf3e6ed7d1b9c79768bf34dba6e4c230ce99d41e
SHA25607932cb5d7c46ae49b032d54561d9009ebcc74377de0c5eae46c09041cdd0e46
SHA512352c2d36337421bdae18703dba45cbb43b11f580f5e95a0ab4b57a2f041f63afd2b13b72f2f246e52bcdfbe5ee3491fa05d8711f9adfaabc7ccf4fe40ab97b91
-
Filesize
1.6MB
MD568b3fd963ac5181ebc4e6b84e29b3498
SHA1cfc0ffddad85f47ae4dae2d5d575990237762a4f
SHA256a192cc4bb8fabae5c63c6d1456c8fc852c7d9a165e917f9365332c81a2164daa
SHA512b27c0438290f9bc0ce03c3750401ddc32ea5750629736252fd75007cf240e27d6e6a4cea9a775ee51d2a9eaa5af09d9183fa6b5f4fcd6eb56e8bb082c59bfed5
-
Filesize
1.4MB
MD525f966c331953a82fc6a8a89b2be9bd2
SHA1db8fbb51c86c6a389ce062bf85f56554fb5b62e4
SHA256b072b034a4a67ed7ca181606b1313ef85a5e4bfb2b39c49ab7312ecbd5a55c13
SHA512d17f16b5c3b27e474a9215f4caff96637035a55086428708b96e405d1346b1ce47ec8d01cb83b2ae51bb799e589ea55d38bd12f53c3c8bc57566fde7a98e3725
-
Filesize
1.4MB
MD5dfcc6881a0cacf741ea0c143930aac4a
SHA131d0cf2dcc08ec51acb3c3039eaf2325017dcb5a
SHA256d1bdb5e8b5734852d5084985aeef2f6b7448a7514f0533b9807905c4515d1d1c
SHA51278e06f001870c6a70f76b771c286ec7fec728a18a6cae8278d2f6b69c9df0f36811b7f5523a2d02ca23da1b65f91ce7fb70e8950f36ac48c7f294b5ad1ca0165
-
Filesize
1.6MB
MD553fc5033a7e14904d3256d032f9b530f
SHA1122a441cfa7f5e8b35092ec5444959083b54b160
SHA2563f2416b12717a5f54e3e258f473dea1f1d5705b0ad7fc7bdace4022bebb09c84
SHA5127c40a2735e478c9595e9f9f84ce9ee416ca801fabc235b6b9c66cebf518a8058d0657b4697d129f75a1b4e62171bde3ad46b29085cf7d5a855cce7a7920c8b14
-
Filesize
1.7MB
MD5309c0336abcc96a27a1d0bff235f9286
SHA19ddf97f9f153ecfd0b3b1deb68a29950bb4f2f00
SHA2562072b9bf2a3cdf01bccf2ea75cc62e7dc6f89e63d004323325510d3af95f1b7c
SHA512af51777779e6d44d8d5897b6eb75fa57549f9501082581cc71a4189cff059443d5298199a40440947759910ed28a5d088c143b8475c4e6ceb24b1f129f974c7e
-
Filesize
1.9MB
MD51056b27ee1003263aa719c10ee70a830
SHA12cdade6c416aaab237049343dbc0738813ee731a
SHA2561233d1446220c9e08933eb4fee80bc26ee3ea3327fdb05455b636ecf878c52f5
SHA51224a785e9ce0fcd80b8f4851ea7a47438eae473a1d75e2d7edb0153f9257ac8e3e66542dbd5b86b2094ec631a67d8091392fc18df40df57794fe3185868d05f18
-
Filesize
1.4MB
MD5f1dacbc3970aeb9f610a70a47471d644
SHA17fcec7b8352caaca897d48309c06582bcb2f0527
SHA256092cbafb196a00d18bbfc6614cd92c447729b7ed66731cd08b3ce7602ac3d0d5
SHA512e6b1e7661e9e546d78da7a7b650fb2e2772e58d8f00850dcf5e0741be90f6764cecf7a8f55a1cb70375c448f5a2af1199c70a571c713b81f7a965bdb2f540747
-
Filesize
1.4MB
MD5d63556ab6532bf5bb5e39c1c944f0028
SHA1ff7ebff196661996aaf51b4d22269d9546f39c8c
SHA25688b6eb6b00c9ad579a139f7357df09a6685370ee044dec14f387d7ed576be486
SHA512638fc107d2a16614d43268d7978b26e907b1b39dc3d38abc275f5e20257e641c265b7f1245cacf45abb3835ba872cb5e858f9147692a92c7bab8de0488932263
-
Filesize
1.4MB
MD556ce46e24bce76efc3c994d3fe8c0fb2
SHA1276372a51ba6c46b9aa06c45c2b6c222f53ee365
SHA256b3640aaddb09dc640047e30b53630b56864a5725bd75ab64ca780866f19e20e1
SHA5127f2bf10f030975289cb90948e1cd3c23da55567f7873654f413eda116c6e9648c3fba843b2f0027037de6212a2003cdaa9361bf5da419cdccdc6450f4c34a9e4
-
Filesize
1.4MB
MD59f1c3651a13c0b2d92118f6ec8c1ce6e
SHA1e3446d0d7edb9c964d7cb4796ab25cc9e60e4a0c
SHA2560f19ed5df45d2ecb754dbb85802ad4a3c5223cfad1aab7d6a7ae99ead7081c26
SHA512ecd3b81fc2045d20198b4280b92d8e1f250a0506358b2384bb07e0df51ae473b67e2df8fbe9dc46c79b861a8438a0a50ffcc011dc7c72395163cf2dbbb95b5e2
-
Filesize
1.4MB
MD5fdd240c6879687fc9f461b4cb00f4c5b
SHA134b1f54055a647af5113540214c70304a420410c
SHA256cd15d8cf6d004b7dcf41443bf42995d571f6bdeda6ff8454ce70de0d22f301db
SHA512727f211c54e3f439aa68107e4b1a36adb4f44aa9a1120c75908e050d3ffbe893d91d5ea9dadb50479f6554742dda1853bbc496b2b35f06b742050ea75d1b67ec
-
Filesize
1.4MB
MD57e8b07df1be4ec36506a5cc59b0db475
SHA13daef3f01c96d1b81af51b838fc2e2d25cac7ec8
SHA256c8c93b732dd4abe020d056bbaa4c5d3a3f87144140b699e4f478d80cbb542fc8
SHA512251be65118e4595a7eb01259dcdac7a537b55212df1b1ff6ba09fa913ffb10c0cdb170f5cd2e79dd09a2c8731911f6971e8b051a686b7714a2945905798e4da1
-
Filesize
1.4MB
MD5176bacdb11217e5082be358775c2d5fa
SHA1bb44ab94380a1186f5773a8fc270073d9952dda9
SHA25616c429bf711273c3cf7a16258f365ed791b6ea39756c7cb1cbf3605b1e771c07
SHA5129d7299174dab11ad4d80e130c3a78f966d94de3505815cce54df6152e594a660eb43644ea5f7d9bc73ed7513ac4ccf8d894964cf3dd6b9f28b1710133b505fe7
-
Filesize
1.4MB
MD596e80a7eb53f0a848f206f876bfe5383
SHA142ea19ed1c8fe8a389ab277cf659009c1e59722e
SHA25688e5349874db7cc2ebbe512a2c394e8946ea09aaf2b6cb48df0e49acbed32858
SHA512cd551e4f57e1abe5db657d37b9917bd8d76bc3890a09ca4c9d91f4dc2463b8524dcf1f9b91915265cc93dfd7832dd6e2e5eee10f093e1d96218ab39cb38fae8e
-
Filesize
1.4MB
MD56d81ef0457a8c2dc72c27820a3447768
SHA14557fbac618baaf1f9a414375ceee124cbaef7a2
SHA25637bf6f639d71aa748cbb87f56f5d05ab707cd382eee4c51e6e0d90949745223d
SHA5121b2201abd00a94fe7e02eeb3a13e7669a68d0af51d28bf60df189fc10874adc8f913cc7fbcbce39a252cddb34da450528cabc541ac077ce62f52f1ddbe8d656b
-
Filesize
1.4MB
MD586191639755f90b4f17c28b508e3f993
SHA1dcbab44bcd0c6980b468217e63b4e674f25a54c1
SHA2563d9a99a63af53839540d7e8a64a2f8c6960ceb5bf7f7b3ec158cb30b567532d6
SHA512016dfcf3f41a06879983984fce24a61eba545814fceebf4dbdb88ddff8b22fc8ee16632f30b1e2e5bcf43ae8ac5a1482df5b19bcb15ec29eeab3f4e0b6e8cb96
-
Filesize
1.4MB
MD57ac37f1c646c7bb848d77ed5d86bd26b
SHA13c6ba26bb1cc9d2cc87f93a5c13f2c726bd6da6b
SHA2561bb17bb6542366af16c7407cddd47d577e13914c54e608a12caea76b0db08dbf
SHA51226d35a508c2b0fd73419d2b466f08ace1557a6d5d363a9dd3db5db004bee8c638736386de8eee2b05cecfccebe29426d0d634ecbb0fdf3d152ee96218755eaa2
-
Filesize
1.4MB
MD507ab6e0518e6cdff8b3b9cd1d0a5ddf8
SHA199124be7d3d23134b655a6457b8a9b2683807221
SHA25624f577374d6995251c9e3be3cafa7f220bb9e36857031086f5358e8e0e09cf3e
SHA51235162a67d89c055a9650229430de906b3727262d9410315f42cf729ed31303ec521996896de02c7afebe5b9b485b81c07e0e3f136db8074601073ca3c49e4bf6
-
Filesize
1.4MB
MD5c199661c4d7b1f7c3d645a963a5a9810
SHA15fb38ec576b990dbecab2e46d01c15eab0d58601
SHA2566bf5f1a76ff6822d93563d27e25c0a4d2bd8e8088db84ef8bb03306e084e94c8
SHA512c75dffecf6764d9a2b9a7bb55119cf061b6b729dcb93a02e4bd810469847abf09607fcf17022f10c7c32bf96a9dff42096e2edf65135b795a7efb6646a090d27
-
Filesize
1.4MB
MD530a80ad7f53165622949d05cb2627c11
SHA17750b0b7fbdc031a6629e5daf15a6480864fa277
SHA256eb03d86e2a4b6a37c41aba6c4fc4d11cc9429c4eca13e92df9a421167b6ee69c
SHA51246532cd91b55835d526248d3a7fcc1d95378e613dcafe3ef30700f7f49ffa07468f2557778488bf2262662d2806afdf28748197315172e16b1ac6c5614de2966
-
Filesize
1.4MB
MD50909fe9d3be08bca304eb0a08da15717
SHA1ed1b1663bcc580c72f7f892ed2c9df4532dcbf3e
SHA256cddc2d1c5768e223cb6c0bbb261707f521462fad55f38f03b9c4ae9840f77abe
SHA512c68443677c12d21dba08d628c33b2b79d07a10c74fc9e2ccd0947a0175a9278e9d57aaac51770b07e316088b8faa74ebcc2e54a14b2e8c4495343b0f6bf93b26
-
Filesize
1.4MB
MD5241cad7c8ec4d5f0d430bb3264c05dcb
SHA1aac7fdcaba3dc1376c7bf355f5320e704e622089
SHA2564644f7ccb9386e215b753a578035c893aa9e0dabe98ffef816c6940026c6c9c2
SHA51244f68caf2dfbb62dd0382e5de2262653b6a90bfb526b2c9aa015c2923c511e6e5f81658bc8e3f497de96d394871ed1a03e23164a9de58aec5fec5db01b4518a4
-
Filesize
1.4MB
MD58bc7b107497e76ca6345ec24da925bbf
SHA156510b06083013caa62c33fd9eb1484212ca8c2f
SHA256194d6fd8f4f6ab9b9794d822f28561c2d558b95b4c29e23e97bcefd68e569fde
SHA512cdfdc001defaea5f537960a936d864b3889328f70ac3e03e4868e05e8411da30432bc076e14027092ba7e2dc385f1bb85da2773a35199e7b3b9af2a19aa16c66
-
Filesize
1.4MB
MD50d51b465932f92a9c5aa4300cc5e253e
SHA1b9adc0e56753ccad7a6ae7ef5e3a1eebcc3b78c4
SHA2569dca2145d424789e7cbc8fc45ee87bdae52c07b81dde42f04301757de8cb62e6
SHA51250ba8d223a9749d0c8efcc81c89b52cbf5f5596e790f7624900579e2cd7679842a9ab02f3c6049c281773142bcb0185c118579e51ac8887b6f2c0aec781d1690
-
Filesize
1.4MB
MD5befdf68b83066759706b19756072876e
SHA1b952c9a518a449d00a273c5981e2e14da935d606
SHA2566a8bfa7533a38547d550c1ed109c69437f326bf4151ae82a908ea54df3203401
SHA512c9c3a266d6618167b92642518701941af9ace00ea5de68972f154543b42776949f3177fcb18f57f9a570346ba6a46161ac9d7c8fff0013c669f06d2aaa387979
-
Filesize
1.4MB
MD508cc68ce39a5f937a0a524e06764eb55
SHA1881a3a740e1471f554bd1fdfb91113efa192fc0a
SHA256872731b890ead771029f15dea9470e9a5a4aa8b46e805f80eb6023e8cf7b86de
SHA512b6fe14f67de159dd309e4ceab06d9ca027e027bfbbe59f529dddcb728919ba9251cebe343e01aa860afb2a348ea692ce3b8128250975c5d2ac3b7bd79efd03a8
-
Filesize
1.6MB
MD5fd07bb186d0cac6e08d21d857ce295ed
SHA1b46227acf09f8a5913acb3c444909dd861ca7050
SHA2560375dae5dec259a2abf6a796c5c59cf8b28fe01a6b634c10a5bc5007e6efbc49
SHA5120b0679c124120900a17196cfe69546ae7e33dddf8764265a1b4f8adcb5e3101c654720e5c6b92f7112b80cb88e1ad21688993e179cdaf49c0654653df63d5dfc
-
Filesize
1.5MB
MD5b03c2b74e984a593b110df7ee67644d5
SHA1dc3f16f4cde1bd1c2703489f582f7a8794fe4caf
SHA2567a8365a3f57fe8b4a003540dbab6c1af4d71fe90456535c59063886dbd04873c
SHA512e13d8053d3b21adf2c1844ec65aa1327b44635159a4486377fe6a601767bca21ef492c5193ff99a851f6afebc8992c92d74ff385540e06d76961bd9c44c5d35e
-
Filesize
1.2MB
MD59ba731eba23309dfb22b809b85c97195
SHA1c11bd54622de60578d9f743cc8984946f2f62c41
SHA256b0967fabe4d2e49b3f8c6bd59dd5cf225bb30b934cda39e7f3c63bad8e3ab8bd
SHA5123671a3c3555d83f8e97f3aa2cf4c0d60fc58f81e4e8d39a989410410f063693f72f5d408b86d31433799e974708a071e4584d5eb03b5c0e3369bb6f79d2ae470
-
Filesize
1.5MB
MD5c201cae2b79a8949b1b4d98f5809ba13
SHA11a44b6cd731b9565d7fafb7505923dc78342d3a3
SHA2564ca20f0a72e3aa02b3c3230f7f27dc641e1fd14ecb1bec9aaf3243a47c62e79f
SHA51217495ee9f697e2e8abc9efd665f8bc89cf89b1b082279623ea3b99418ed9928f0c003defb5a72d5926c94a843e4747fcecc1e92e036ef0525d72697970073efa
-
Filesize
1.3MB
MD5e234b2d19312fe6f6384a033c67b7669
SHA134584b308d1a0e9089398ba2e2e2b93451706632
SHA256e3528483e4591c717c031c067caf13377f860351797802f951946806ee932fa8
SHA512c1c5ace7b87c69dabc977a151db3dcac10f2e0a135652ba0a5664211ee6c35c5f878e2011a0d1f34470760f9347f731506b45b3e4a65c54dc6670175de5a21ba
-
Filesize
5.6MB
MD59407b47252f603df832c1d7ff8a506aa
SHA1b12b88dd2788e13d10056f8047614185eb00c397
SHA256a11d9af01caff5e01999b31bb2fcef8138f67eb29ed9faf0f7cfbcb64c3b2f56
SHA5121cf3b8299e5e000cb79203cf05e7615f3224bec7c4a7813164b944579ecbcf302e3ad8a8fb296f74354b100af4bb916137fd51e184858bc0f9c50024c1c6aece