Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
24/05/2024, 03:48
Static task
static1
Behavioral task
behavioral1
Sample
a00a362d0ede4a0f562b2cb7d0108bfe02f034abd1be1725296cabc69bdbeef7.exe
Resource
win7-20240508-en
General
-
Target
a00a362d0ede4a0f562b2cb7d0108bfe02f034abd1be1725296cabc69bdbeef7.exe
-
Size
987KB
-
MD5
090ddc651baaee8653778f80c007b1f0
-
SHA1
0e05d84decc88cb21ab5b8a6da519bc4f7bc7983
-
SHA256
a00a362d0ede4a0f562b2cb7d0108bfe02f034abd1be1725296cabc69bdbeef7
-
SHA512
c94c41c72636b89a2382d3b6cb802761423f651c17c8b8181e170bf2dc696fe155807845e078dcbb706a78fe2902ef896fb8fd9aa8f1605f5a8dea55a0d8598d
-
SSDEEP
24576:CAhX8vz3FhHENJyExt2rR8FfBhRJUEbDk1ulUP:CAMbFeeExt2r4PRSEk1ul
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 1620 alg.exe 4740 DiagnosticsHub.StandardCollector.Service.exe 1972 fxssvc.exe 1792 elevation_service.exe 2672 elevation_service.exe 5080 maintenanceservice.exe 3536 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe a00a362d0ede4a0f562b2cb7d0108bfe02f034abd1be1725296cabc69bdbeef7.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\dcd654fab3e2edcd.bin alg.exe File opened for modification C:\Windows\system32\dllhost.exe a00a362d0ede4a0f562b2cb7d0108bfe02f034abd1be1725296cabc69bdbeef7.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe a00a362d0ede4a0f562b2cb7d0108bfe02f034abd1be1725296cabc69bdbeef7.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe a00a362d0ede4a0f562b2cb7d0108bfe02f034abd1be1725296cabc69bdbeef7.exe File opened for modification C:\Windows\system32\fxssvc.exe a00a362d0ede4a0f562b2cb7d0108bfe02f034abd1be1725296cabc69bdbeef7.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe alg.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe a00a362d0ede4a0f562b2cb7d0108bfe02f034abd1be1725296cabc69bdbeef7.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4740 DiagnosticsHub.StandardCollector.Service.exe 4740 DiagnosticsHub.StandardCollector.Service.exe 4740 DiagnosticsHub.StandardCollector.Service.exe 4740 DiagnosticsHub.StandardCollector.Service.exe 4740 DiagnosticsHub.StandardCollector.Service.exe 4740 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 676 Process not Found 676 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4832 a00a362d0ede4a0f562b2cb7d0108bfe02f034abd1be1725296cabc69bdbeef7.exe Token: SeAuditPrivilege 1972 fxssvc.exe Token: SeDebugPrivilege 1620 alg.exe Token: SeDebugPrivilege 1620 alg.exe Token: SeDebugPrivilege 1620 alg.exe Token: SeDebugPrivilege 4740 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a00a362d0ede4a0f562b2cb7d0108bfe02f034abd1be1725296cabc69bdbeef7.exe"C:\Users\Admin\AppData\Local\Temp\a00a362d0ede4a0f562b2cb7d0108bfe02f034abd1be1725296cabc69bdbeef7.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4832
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1620
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4740
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:4180
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1972
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1792
-
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2672
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:5080
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:3536
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3952 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:81⤵PID:4400
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD5827763206b9395833680357038530e3a
SHA1fa397ef9476bd63f5444b29fea854d91322e16ac
SHA256d601d73dadba37a417991420b323c455e607ba0f179ccfc1fa26aa82be2ab9eb
SHA512e5d0241811c08376447c50e14e2319f25714e721d8c420c2d6c76b2f46955d24f04e305baabb9845549d6dd0f4870d5f834639aa300d3c084a48953af3290b7a
-
Filesize
781KB
MD57b10ed30e14823d9f1ab9a818c3f139b
SHA17d447db0abf074033c839f7d444c35791b9b3300
SHA25658f13ccb05c720fe1e863414a58847d782341da3203053fe6d90aac621658be5
SHA512e004795731fa810c6f0e0de637d2222501ef7236d1f3c01eeb035152c444d2956cb389402a65e0b17bcfcbe3dcf324a458ac4702ed05c9e02da6e793fed1ae75
-
Filesize
1.1MB
MD5668cf5f70298170b7798c6eb0e1169cd
SHA1dc998954c92b1b9c3963bf110b68d3a8da9acd4e
SHA25678577188fe85df4c59dad059ac701d30162db7490564aed87b01a2013d09cfa3
SHA5128cd06435bdfe1fe72f1788c5e860c0c7049e6b0eae7a5e6c7f237ae34941132264f32a0a1ef234ee917cd86ff4af41d0d79a659ba6c035a35f75025fa7c57eb0
-
Filesize
1.5MB
MD5064887d08cd5703d749a9666485ca3d8
SHA11644c496b23b265f16ae701f319120c7c29feadc
SHA2566f68c1e9b206ada08d6dac14e62f689e53b4871aaef019b4ca589c0be98cd8ef
SHA512104a247622861ff6000ae73c432bd407008cd99c12844fe1472cc3d134e037aa0492ebbd5bda5a4f413ba4418f0a1c50a01c3ec2a5cff7f7e517deaa9e016636
-
Filesize
1.2MB
MD51f489f5b861c81cd8b6b9c2a7139b70a
SHA19ec07aab2ed12d2c106db64d6d20c80aa33e8769
SHA2568c67d37a37d915d8d7833689bbd6c447f0bc6eb244f61d57d94f0d6b5f4bf85e
SHA5121ed9a7465d804ede3835be6071b9a0252b0a569510960be9b19ae2e5d4e944adcc7b651e24cdf3699e598e387020d34f881dade55c5d4a9665872a773329abe4
-
Filesize
582KB
MD5159f89576ef6164bd7ae15f57f1f68aa
SHA1fec1b6cf9bc198dd2d380f63d0f2aa501557e4db
SHA256961689f528a3532b2084503c58174bfe3bde8b5864b5a28b278e5bd5f1abfd74
SHA512a625c321ef19ac0628ff1c73fcc98b2f76e22c677d8efd53cb85e2cbd11e7014bae284b5cee14c07c2ed4f2bd14a2502e545b0965bb9f5447d80dae9c56b5ee8
-
Filesize
840KB
MD5a689f4106fabae8e13ce54b4cd41b88a
SHA1fa22272a550e1106b99d3e4b7d46e69ada418d89
SHA256153004065e50a7ea0152a7abf66f5026ed9c2834c18d3b89941432a03e94e6c3
SHA5129d8f4ddf1ca5f8f174f51be342ef72da6564c42b1473580a9c7a6968b77accf7f60c1ef41aac96e308df4052024b098ad1c3e9affc5712901eeb9457246ea769
-
Filesize
4.6MB
MD5aec2147d0ac3eccfdb47200cde6e2fa7
SHA154ddf9e7b45ca812ba13070c2f0da5d4f28cc871
SHA256634135a9d70c405fd60ed7f53549be8956f720fe92d192662e8118a78e635985
SHA512a51c676f5a3ed543fcbcb3482da449bf2e9474e5a0190dd301bcb2a2a0643b6067aa725be173f717dc51aa459a6fa2f0eca44c4584ff8a590246439ea581e409
-
Filesize
910KB
MD5ae031acb6f55ec1986780b02c0515757
SHA1b4d9e33836884d5e7df4b6bb02026978b1bef1b8
SHA25656c5c9fee6a0281659e2311e165bb3a4caaf8d2c2e31f15da9bddb495959e271
SHA5124a9096bbf22570890cba574c76500d43bf3acef31c18587ae5efb37411fba0a3ab60c99ca3bbaff7ca343a7cd5867afe93fa62cd5d99164e19192fdd76f693a5
-
Filesize
24.0MB
MD5b5d69ba60853a88878cde22f5545f118
SHA1423c7d2f4d316af379f04a7afe8acf7b85c5c5da
SHA2566d1685d3b027be1330bbedbf4002835b92a12d8b4dac094f0f0959048f80b861
SHA5129f3fd4406dc434fa409187fb949f3dfaecb7b815d45b1af33622df70413341c2c77472c09e016d9c07d0c6b352951b9c61759156ae3c38f9f181a4207a60a4ba
-
Filesize
2.7MB
MD5b154829ef7cbca51d1ec723db946f5c9
SHA18436935c49a4f2e9e4f9b23a1b39940eb582cb21
SHA25682d463c2fa4ba3959cd0593d23ade500227aefd7b818fe697c817e1d19005519
SHA512404631a936eadf6171c57c992b0240a95142afe65cf9f6576c9726b2a115a5b1ababe0f71f112593eefeafb8b4d252dc95aa02fe3e7d511c9abe137d85d5f99b
-
Filesize
1.1MB
MD5fce571b4b7fa0d485be1958a9c6f6fa3
SHA142e52259c14436f5d01feaa078f739073583a5bb
SHA25686a8ee512e5b00bf351bb95feae4e582b2067bcad9e30792cf51da5969eaa039
SHA51260c88815560afed40add554c4229545cfd77979f635cfe8d8a93579fe8764ba75f3a26a72517faad3371a5ebf1d82ff906c54104510f293ad518eba4329fc3db
-
Filesize
805KB
MD5a174f6d7995b0227cdc764ef372dc98f
SHA10211cb40c4917c48ea45ccca9569ea622885cd9e
SHA2561d4dba6c333537ba629e4b8994d622a4a570124bd865b1e1b79bf7decc0c4ddd
SHA5128480081d644b80d50d815b8da436fe42e2c61f7e40291dec0a00b08ed91343d39faab372d514a932a56602b5f0257e5a5ad78eb75cd0c37dfcb20d5da5250a08
-
Filesize
656KB
MD514122cae826cb6bb7041ddf2298b686b
SHA1d0b7c8219c795e9ad84e8d2ee21221455609505e
SHA2564f8e1e7343aa043db95861faed69fa2054de9b02a304117ea10a9bf765ea2417
SHA5129d5a8bb595ea2afb46212d8ce9174d1da2efc5f99184660ee7015a3f7c849a50acd77d2dc122843ac47580ca4ce79c94f60b3806f1472a43f083934835234d96
-
Filesize
4.8MB
MD59ee263c63de19fbc798eda0355bdd6f2
SHA1b78908f7aa40feafcf2fc8e8d42117223b2e02d6
SHA256e7e43916fc43fdb6d045cef56d25be4b46a9aec8e1a9f005d46c3f7b1d0e637d
SHA512e76e663ed96e4284e835f7755d978d908fbc4af18d88e6a1417d1e3799190fd7687ef7678a1835e41b0e57002ecf0e4f4d74e6ddd744beb7a811d22b222490f3
-
Filesize
4.8MB
MD5610a44c664f17181dd98e49c7839621e
SHA1cee86d3ff516b53bdc48d770e67d60c9b8fa1a5d
SHA256bb0846a0d816ecbca6181334941be4125e8d9b7e78375d3030e5c426cc00e374
SHA5124f57ea8ba4d7ee07039ee158cf95928137e22570871e7dc5aa50c4ad1ad8f0a09d2a42fd4519a5a14d3babc5a364cf1b6fa621d02adc8a41815b6c9208eed2bd
-
Filesize
2.2MB
MD561f1d7913c7f9e8e415ef5c8d7bdd35d
SHA1c4391f9b6aa3e8cade14b81eb1b9babb748ad3ea
SHA25654b16861d2c2ef202b924c289698dd268427c06f36e46b17964343061632721a
SHA512e9a685c68a0536c34b629629fef39fafa3b2b06df423c5d59fa45412cfeb68b71ee0d30771ad096d29282e0d323334f934608b96ca40efcef2991516c43b3fbb
-
Filesize
2.1MB
MD5692aea549053e0d65f7b86c51e3578d7
SHA125a613d276a4232373450081c3fddc513e056109
SHA25644d197c3213dbf62da4dd709830e1d291a45f5ed96ce0b9313542694d00a59e2
SHA51274e68e0fc18fa2f23a47cec811dcf002c34df9d6576369e029ea81096e30fb2b5db31450f61b6676e4c12fb26b3bc3af4bd93a60f0b36348507f7f0911d04aa1
-
Filesize
1.8MB
MD5ad6cbba4b7dc6ccdeeaf4baae6281307
SHA1848ed93f09ad165c692a1e76fdaea5b7cb76c4bd
SHA25673b7c7355e2c76cd6ede0de167bb9bf962f919a36faf1f6423a23b217e1e52b6
SHA5124facf64e599d18caa2f6b89005120d229f427ed00d60fd7874315c898f21d0ae37f5923f43ea78fd935379ce62ec1660efd0358c7dea809777c3a90ab0a955f5
-
Filesize
1.5MB
MD5bf73368a2746fee2f9d4c7f22dba5853
SHA1613567e7efd3218016ff79f0e7306fcaf94fa99e
SHA256fef0d2a4a01250dbed6ce5387d617d2a747359e3c3491bb1c38094eee2dc30c4
SHA51221c86cbf3526ab0ec1fee1bcb35d2fc9a404eb5f596971b28a3badefe0a2690888fd378053c17494b7b110d1a192ffd016a894c647fef59b8a391f8794a7507f
-
Filesize
581KB
MD534b50d82b96c28a2cca31591bef88d79
SHA1114559ea85313bf68160f6390a085536098da699
SHA256bef64f0cde127347331ddf4fce9674a59dbd2b7d7048be2ffdbdbb88396f0f25
SHA512cc37eb7dbcbec9aa687f00e01968c36b62e6e0be0021378d5dc22057ba58d1d620bb04cf02d05f59ab8a35127a836b1d6b4ef7a8faddc40246ae65c9c3c03567
-
Filesize
581KB
MD58343907f6eca633b9a45f7fb868deb13
SHA16ef54da954e9a37a4464787c1940845fcfc30688
SHA256dbc4c801239f6b85a745f1885cd1508a5c6811bf3af971c17ae4289ab89dbf7f
SHA5128b89bd6b0bba733b9d5dbb338e73802f8044a596c25d46f52feab84be101277722fe3d9e1db0dbf07eb04c075f49a1f0c1274154c6d586005effdcf2c01a96bb
-
Filesize
581KB
MD5ea5542c122a9d3d98b26742fbb239126
SHA1c184d4a9168d951e31f3a6d9651477f4432190e2
SHA2560780aa0e26f7ce065b92314c3dd45de9e46ad98c58bddae1b2362173d6b7628a
SHA512513221d14cf83fc386be68a6da3f794e1b2354a7152497008855e7179f5f6e163df98e74baefa8b039c3cff4622606582d76b4d6a720af1c77d65853ed480e01
-
Filesize
601KB
MD547ea35cf96b0b00fe343ffb36d13f6af
SHA19a134b938a1004783d22d9436aa4ee9a3e3d5b8a
SHA2563bd923c2cc29d7586f10d6b76668f8fd43b9b001a20c110d62cb0529521692b7
SHA5123453c34bb59401f06a7112fb60ab6022173df456413d08768da4798874722e2e0e8ac76c4a123c6f3ef3d2edf70b139a98ff9aca48f93094f7b8f1f89678b55a
-
Filesize
581KB
MD50a5133850494b8a2175b66347c0c312f
SHA122b923b3da26d69310bd4ef58d12ef615086c9fc
SHA25634b0c2064e838badfc81d18e51b82d899b19e61b349bfe1a501d01af7092d105
SHA5126d2f18027588d16406a08f2e47490cbf61df36768de1289e32d0c7d581cbe11e60e5dff13a0ebfda8820d310726e9117d6b61126e8f6023a0959b1daad43a0f6
-
Filesize
581KB
MD54648b2bf5232260675eb3a50e7c5402f
SHA1f5a919fe0474b85be041a042f767c46d466c2dcf
SHA2562b40a902f6299efda1ff10d6997e9b625c6efa8c1be7851ca7b86b61fef319bb
SHA5126a96e442c89fb1a7fd3075e049dbc15afb75cff62a27bb233a25a4950174f5e835b370d9fd58a0eb0fc54e106473148afb847b2e04faceacaaaea74acfa31e6c
-
Filesize
581KB
MD555494e30523342472e099f8ff7a63cf4
SHA122f335bd5faba78f335afa1f5cc418c6249a3065
SHA2561b190a14a2754595ff988f607023d5cc507a882bcfd34956ec51bb66ce2d8c29
SHA512eeea73b40bd86cea2cf77cb13ee527e60f385faf347e540e681fbc906fdedbac7171fcaba61ffc578eabf36a29babd6fabc3c09b7a7a2a8f6ad26f76a4c350ff
-
Filesize
841KB
MD550304ebd7339f952d6616cbe972b54ee
SHA125494e9acf2c0b1330e77d1a353f38c176c50c92
SHA256525d5d2f2a82afef254367c46ecf27e24202d27abd94a2433f296c1d3be64d28
SHA5122637956d1c090ef84c64c0b1eb3e6288ee4250d596a9ff33892bbef286b0c3ac00c463ab1c2c2735eaba5c94197f78445e1312b3ec22fc212d19f23825594a37
-
Filesize
581KB
MD568df81a64f1ffb82f3907d544a28a2ab
SHA1ecd163b7e404b8ca4d58d66397215b96501f61f3
SHA256ba163576ed81d2cda4f819caf858ea1d562a6d0eb77143dd77ae5de12d616097
SHA5120f3a404cbc907d7bfc47130e95eabbd9ab61feda8874e8b3a26b43d26410a52c6f579d9ee1421d94f7f95050303f945f5d56a932539452291d108649afb627b3
-
Filesize
581KB
MD5920b737e8efe85fcbdcbe3dbdc80d461
SHA1bb64c8a37a3c1fb046992c60e3be5fca1c2688d6
SHA256d3069a2472bc2fd93f6e4a885cc9ead0f77c28dae412e1ad8e898ccbec21c9d7
SHA512813537bb9f04cce64122daf3e8cab45c2165ee4a936c18cb40a34f3c415169abb060c0e6c3a61ad085c5b7ec11d1d7c9a9e00cfdc7a70fed615ac363f8f8a972
-
Filesize
717KB
MD5f00468391eb4a5b0cbec505d17430570
SHA1b7228a7309d02ae8db0e9febede0cf3e8bff9221
SHA256a911fe7c08be4b4f1964bbdfbfcd04a92a5c7d732b11c9358d7517c2cf049927
SHA512f61b23375be86eca0129609900f7635ecf67320f0d497349262d5f82f4bcc6af5d64e8b46e767d77d89839d1f2c4cf135ff1f2c45439a4b8130cde44c8aea1fd
-
Filesize
581KB
MD55651944dea5100eba41b831218aa224c
SHA1959768b22924b718d55829c71c18f6103982fd50
SHA2560badc9f71c94d6a0e5d74238461d5c9d510f6efba18859d9712095a9ea3e8de2
SHA512c1cc99c101f47640df311da5d6b7c34ba5871676593f90b08f47761c53933afcc99a2481190ab4343e42c95eb68f2daea75e703310941c188cd355009cf5980a
-
Filesize
581KB
MD5110563ef9909b8f2316419585f8bec53
SHA164b6573dde2be5bef62b317be9f8e15bfc722c59
SHA25660e395514af7bfde2fba677b95740075d9c42516de1c9df8098f166e675809df
SHA5121f01916b5b2f82a16d578be5f1a8202c7f822a6c91ad960ceb4a956545d127c8919125e93a9a5ba705cc1cf03d1873fac9ca8fe20368f7763c2edfacebd4565f
-
Filesize
717KB
MD553feb7bafab816b2f8f9ebde1485873a
SHA123704c75bb377565089acbbc90e23c6d756e6c6e
SHA25650d529fa457005b02193d11ccf68fae6b0897d68a4e92865e047272e2cf4e929
SHA5129a6a947a9447e2ba5443c6b7d7de6393dae6804b000ecec2c7c17cb7dd46dc655fb08433f2283920a1ac9008265726b8f9e7e9bd4a75edd56b6b4d504ef45dbb
-
Filesize
841KB
MD5908fdd35427a9d4ded61c7b6cc75ea9b
SHA1d6c75a523912b49ffaec9c041efaf39d53cb11d6
SHA256b2a6b432260cc1a9b1ac5e5eff12df7f241177c0d56bac0cd13bdff17668d7a1
SHA51205c81a807f924204eb5f2f966e2f39292b61df219401c7c4c8efd4fef4f446ec7444300a58fc8a50b2a223b510c9501a0b8002cd5b77e177e5ad4af5099e0ab2
-
Filesize
1020KB
MD54551eca2de970e2086ea48210a11af68
SHA19818b3fc88fc601063dad364f35bec2f86144472
SHA256754858f45abb3de56fb3e0ccb5cec7a05cd71fe442f49c89cedb931e616ecd6d
SHA512876bffe99fc65f45eec4fda79dba1419c4671aaa69039e20617705199a3998775b5738c9d139810fe0f045a2515eb4f5e292ce17f42e841d4f86ea5fefb3aea4
-
Filesize
581KB
MD534cd3723e26080820ce6a59a31d27bd8
SHA1dff365bb43a25a0e206d7e2dc9171a0a20db654e
SHA25649cb1787a026bf1162826151d173e912530e70e59e6fc326378e709c3d431d2d
SHA51253e27db7700901e95a162e746126ab297bf30c2f657290b85aa69f5a52230128e8a3888c7731f93eef836135302f142736db282c0263761565d68218b5fe86f9
-
Filesize
581KB
MD5d5da5fdfd422492d6c9a7e38aadf657c
SHA12a3267d2c6535b1758cbbc9927b7515a18ef84ce
SHA2560245dd524f1680baf0e660e71fbed580413cf9c40b0729f0dc352b3714305cb1
SHA5127896f4c43c71af9db54d4d3925219d680c404b0f00c02754074cad0e68f279cb7866902501f1d9dfbad2a355ea3533db055e50073535fa722d6491a92de7e980
-
Filesize
581KB
MD56380ee7c76f1535e4ca74547c4cfe184
SHA1afc630ab574bf553045d2e6af12829a01b43298c
SHA256b3c7a042ea381dd151cf5e4b39670436f8e39afa15055cac01745643f812fe5e
SHA512be223856f02adbdf46fbe2efd33c6b357b01dd781d7ddc8308d9ed87e09e4bc453f2877e0ba6bcdb2f8193d9157d2c5531b2c1c642677d8d94167a573729027e
-
Filesize
581KB
MD5bf1b6be3e35c01c28a0b526466105369
SHA1644b2b3d293cf1cf28f29575760ca0fd7b0c48a3
SHA2560638e4782d40733de17bc8a83a894b8789c7cb4302e01d21e9ad7c1808126d59
SHA51247236dc17af9a6c8288bcca16ce5e33b84c53521d9d5ca107d374e79cfc04b98c48219748373ebde56fa9cc348ac337549a82a7a78b60062df08db55d6603707
-
Filesize
581KB
MD595271007c5265d52f374f886a3e23ab7
SHA127490b85d7df1234eb6541acc32ee576d0927155
SHA256853905bd025fa912fd53a44450f0ba8a94676cc52d855b6b561470a9ff7c5a1b
SHA512292ab189bf72562a904c8cf1610875030b95f52f196850cc5e354ada129c427e9a6f6d997d169bea19733a809ff14c18bcd38bbc803c2c193bde09ad2158383b
-
Filesize
581KB
MD562180d265781bf1bfbfa35d745f0c55c
SHA1aa6a8ee2ea423d95f292cd47394115c058faab1f
SHA2561400a09ee274f3cdcc7e9eeab02db16f12e5c9a6e90b803fc652ad99d23d1dbd
SHA5124d7b22bf19121fd9a624a81cbfa8f20381aaf9239e683da81ad824c0bdf91cb1ef61b0f8b3459b4d5e580a420cd989e0ad830334d457ad5e45f333f0a03bb3d7
-
Filesize
581KB
MD5621be0d23e8b6d0f2b15ac5b9553be40
SHA1a36cd9bf89f8fbbe9edaeed763743b9e8e735bcd
SHA2568fe2f4d6d2a1470e10df7c39f6c1b98c7d94aef5d2880358ee7d03bcb4d1c59a
SHA512d89d710f256dd78079bf2ac5cbc170df53e19b354c1cea106c965b01ddd1d21998c1c14467f34ed91c9f41ecc4ce5fdd2fdd1d83bd6083ab4a3a608cb092110f
-
Filesize
581KB
MD550806e24f0fc78b480ea2e444ec32fae
SHA19594d4c40eff7a3e1cb8a16ef560bfc445801e72
SHA2562368034af9d55e285993b3ef18cc809b24c23a29813f7e0bc1b30a99e3b72351
SHA512575e0410f8b9af37cf35a4f526945e6fdfb1b916c767457abce12f5cd49007b537b879ea706fe9466afc155b29be23c11a6e79d4828c616c25725f88d9dfc2bb
-
Filesize
581KB
MD5b89c083c9941216e51c361760004c14b
SHA1a6a2deb9483f91257d30582fdbe34cfcf26af886
SHA25681d4d83bc28b2908901d008f80fc2d967dd8b36650aecf8d9429818d183f4702
SHA512ce687cf2b2a8d19b0ed1bbd1d8de113ceeed904ffdda699c3407150664b1d3bc19feb73471ee29536f0da45b0abdc697eb5ae23f262e397f60dc724ce73292fe
-
Filesize
581KB
MD5074a853731a4b237afffaee526149b84
SHA1faac2a09852b00d839d3ca6de86ed643c3c8dd2e
SHA2565df4692ad63c5b60423f44bee6aabbdbc20e1bb81e5d86cd5e629459d9a11080
SHA512cdc72c9dda07a655f93858d0d38b38ae2fdf5a6afad563162d92c6bd2ccc5e5960f42c1e439d73573147a76fc4309cb67ebc604bd8d198383f45e3bfb8c6ad9a
-
Filesize
581KB
MD5f00bccbe5c1f84c234463719a118f100
SHA1d856b9c037ccf8f165561b612326c7acd632f37f
SHA2562bc70f93745b81cb61f6ca789675b1a044880624b6f6bc544c2a60ce018842b1
SHA512a1bbf5de1325bbef7ee910a3ec3de2e974298de7798bc032844c60c437f4c6e04702cabe57c2b403c0681d8b9114d5875e53ba39bd7612cfb8f7d5cbe95cdb4b
-
Filesize
581KB
MD5ac84c5613dd39fc577a74151e5326875
SHA18d1a8f69bbe88062fa6d9d6e04e4d10236b5fc4b
SHA2565d0f6b1d7928e8d1a909afc564d1ba12797c9b0f26ee455ec0be4fe4017bc213
SHA512636a98dd4cace09767e35513eecc877c617c2a5b539ad6c430411ba5b08dadc56b4f64625907d66a0aa506f0d9683826b40dadd6bf128ca2cd571d5806b60a9e
-
Filesize
581KB
MD537e3bb6492434fcf7d3008078050ac66
SHA132f95f85d978a1e12fa83b99814289dd3cb9ee78
SHA2568b0546af6cea9898a11e95109931d556901288000e6fcebb0dc969f2bd85f6c4
SHA512a698c1e402d0c71d289cd29ecdf655626e86a36a9cda981f50955bf3024d962fdc94e06d61cc943b60989e4aabcd9a59bde913cc53556f040e1d7d705f233393
-
Filesize
581KB
MD5335cafce8514ece5ee0f621d115854bc
SHA123e6aee167d51081dd084649918ed2d657a70e0f
SHA256daa7a0cf23df8a6cf8839ee66fdd01f5aa273d4d05a80abc91773ac196209e15
SHA51266e36e3c31e0cd0703716a2cbad19a62dd1404ad510fd65d622c9223fe5dc2ae188cafb6b62aaaaf787a36e3732dfd67faf396684afcca9305f69dc99083d299
-
Filesize
581KB
MD5a4fd0e4fdb73db784a238cf299aefbef
SHA1db852e2e954e5d3f35963390829b97858d889f38
SHA2564caa6967493c1395eee6b9d8bfb4c84dca3218c437c29c3cee45aa17d6a955e0
SHA5124a35a88e26116f3eb25af7641225ab58dd8ecb6d2c9f81c51d5acfb21301068cfe5cbf0e7ed2063458ebe95f9aa8276bbb19ff2713b620e59fbae28f075c3e60
-
Filesize
581KB
MD5232831910a3c71409526696a6dfd4386
SHA19480b96aa5baa9f212fa5ec5feb4ca0e4c735aea
SHA2569df6913f026a18f332b42135472fe0ae9780282ef0e22bc90acc578df76dc99c
SHA512fb7564a7261d219fb3afb5ed396e525d4469387f0c778840337a0047da81f14d8c9fe11dc1b15390d53a4b2056bbaa21fa8b17c2a590a853e45f27eae687307c
-
Filesize
581KB
MD54616ed11777637c82214bd06304a5404
SHA1b058655d70c01a8658b652b1bfc8810ddce9b601
SHA256c03676832d6626a57fcf77baf6d9410e0ba21d12fc3d1e4b0690d823333a803a
SHA51207b0572edb1660855361e620eea5d655b609e2fe5439295d4082873bb3f74c488007e7b7f2fc1e90461bd47d6bc9f068f25535a28e8626d2b546d91a2f41927b
-
Filesize
581KB
MD5e6d33604ba4dd15b23f0bdf6a0ba10ea
SHA17e09efa0f81486271765f98267c81709ea53b169
SHA256a20a5f08ded7a94a395f69f570e170c5233bfe53945d62147d8dec535d9d007e
SHA512de0b773f15be3e5e2db43b910ea9780cd12f1dc93d97c38598cfa528b216ae570df0e3514a68b9a56f44edf54b954766ad7d4d2940f5f30371058932bce70cfc
-
Filesize
581KB
MD5a754dbfeedab089694e8738084c6d8ce
SHA1add5090f4e7aa5cdf97c6b4167b2472767af6aac
SHA2561193813dbf7583a6bf75dcc83fad183d6ef58f69dcf92e16878821c6c2380563
SHA512ab18b9b487de910646ba008f9e8cae65966ec683459bead46edf6c15e0c037899a97a1384521ef74de4b9e9b8823e4aac640b146ac67fce675f921b69bb5e9f1
-
Filesize
581KB
MD5fc190b29135ac2ee4ed1c9ed5232b509
SHA177de286dff57bb686df5594dd259aaa750525c3b
SHA2561b035cbfcd75f676e1edf0566380a4effb98ac63f7a3af8fcada413dfe280f3f
SHA5120da09aafd49054eae0f6e57ee39a8ccc3576927cbe50a80077a3812172d894ee4a56a9b2a2bdd9da34a9832e3cec6b957b9cc552d46f88390bc5aa99982489d2
-
Filesize
696KB
MD54214bfd45855ffbccca3c7d565afd703
SHA11367c73317ec6a689f49ef354a90b32ada28657b
SHA2568e603705feba5200d2340fd4dbb0f34d19a5c9257a8668b5ca12f51a71777ba9
SHA51259e403e3f26da23c89cc1296deb5cfd4f5a6e893ab6b386c5e126ad8fdb3c53fd569ae080da5650463386ba1cb1e1757c0f8e71b0e6e704aad6ce887d8769dae
-
Filesize
659KB
MD5b9a25df842fa641db0d84c80507f19d8
SHA1f2ef11d2f85e200495a1aea4bab5ff8bb882c0a1
SHA25690ffaa5b2ed651e63f7819a9f2cea2238ab1377f884547634b028b211e39d938
SHA512d1dec3ab461b8d6d0ad1e49d513776aa11c0577297ad873e0a6f3b9ef9d0d6d85558a9a4028db7868f2265867237c669d70b48a44b411601f51bfa1f91d662f8
-
Filesize
1.2MB
MD50ffe5667feb2b309759a143759028960
SHA1a9a1e682b95f85b7a62ed865d45c290cd09d5012
SHA25694ece8107a98349c0ce4d2a7f6f40cbb771794a239ad165ca92ac5c541efd9a2
SHA512ca70fccf282366a7edfb5b372572453566299a9712d83f825ff67bcda9024de9c94fbb81c213f960b5acc153c6a76ad8fd88f65dc6072216455f6064110fad5a
-
Filesize
661KB
MD5fb4a0ea7e23ab17d05fe214c2a19151b
SHA1d2b3cd94cfa1f5a9d643fd5d402cc60f58fcd799
SHA2569d211026625c60543a4c509359b9acf1b96ddb88fb644c51ade759ea91bcde76
SHA512035ea4a6481baf70d473ebc41379f524e0477298ff955281dbafb1343e42c33caea95e6380bcf9ae0d7b5f2e8d6527a3449330c5d78b4520b7a72e54e3b7d235
-
Filesize
1.3MB
MD5c345517723ba8a28d566040a50d15dde
SHA163a7a646074488f66a829411e0baf40136b7dd09
SHA2568af9cbbeb81f0e6bf0885fb774a4f91d4ae46783c4698453d052081658e96734
SHA5124f2c61561fb0d2cd3852e9809b23d5ca3e7c1a613ecc3f8a1ff37b9d869c172709ed5d71392988b65057d88f3ca6b02731c8dd35e1670b37fab456adbab0c376
-
Filesize
5.6MB
MD549cf9bd29600ed6b5b09372f02cc34ad
SHA1cfc0a0d7793154ef55fa5735358a6f7e98b809c6
SHA25666e1e80b2cc7928697b34a719ec0815606a1f03591534bb89fa56a1e5b8126f7
SHA512fc105e692902defcc3a3beb102ab534c1bef653fa220bc9d8703a98230759036f8124f146e9a252ee1238d868fefc70ccdfc7982c64133c749209e9beed18657