Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
83s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
07/07/2024, 02:03
Static task
static1
General
-
Target
aac8819e7f69bb58cfa428a78d4b65c7ea1e31ea32a6936086860a83ee938040.exe
-
Size
883KB
-
MD5
61c8361990b84f7634cee48e0179ca7c
-
SHA1
50e3b4325762889b54744e171628e9aabd78a136
-
SHA256
aac8819e7f69bb58cfa428a78d4b65c7ea1e31ea32a6936086860a83ee938040
-
SHA512
edf796d3302154def5debd28463c6d0ef03e91ede3d9f159fedf230b9f133161d342c767a418bbf445ae2c627dd3126086fe7621954416ca3f75c5732d16741c
-
SSDEEP
24576:pmSrDxKDS8vbymPWKs7mmGZTXg2SvQUTvN/TlQAbf:txK28jymPWKsqD9XQQ4/GAbf
Malware Config
Signatures
-
Executes dropped EXE 9 IoCs
pid Process 3784 alg.exe 2340 elevation_service.exe 4496 elevation_service.exe 4212 maintenanceservice.exe 2036 OSE.EXE 4440 DiagnosticsHub.StandardCollector.Service.exe 3944 fxssvc.exe 2260 msdtc.exe 1324 PerceptionSimulationService.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\System32\alg.exe aac8819e7f69bb58cfa428a78d4b65c7ea1e31ea32a6936086860a83ee938040.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe elevation_service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\f88f8049c9b3195.bin alg.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\fxssvc.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_130421\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe alg.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 660 Process not Found 660 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1132 aac8819e7f69bb58cfa428a78d4b65c7ea1e31ea32a6936086860a83ee938040.exe Token: SeDebugPrivilege 3784 alg.exe Token: SeDebugPrivilege 3784 alg.exe Token: SeDebugPrivilege 3784 alg.exe Token: SeTakeOwnershipPrivilege 2340 elevation_service.exe Token: SeAuditPrivilege 3944 fxssvc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\aac8819e7f69bb58cfa428a78d4b65c7ea1e31ea32a6936086860a83ee938040.exe"C:\Users\Admin\AppData\Local\Temp\aac8819e7f69bb58cfa428a78d4b65c7ea1e31ea32a6936086860a83ee938040.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1132
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3784
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2340
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4496
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4212
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2036
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
PID:4440
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:4684
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3944
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
PID:2260
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:1324
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵PID:4748
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵PID:3272
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵PID:4016
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵PID:4960
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵PID:4168
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵PID:916
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:5040
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵PID:4916
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵PID:3020
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:4852
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:2208
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵PID:4056
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:4992
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵PID:2144
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵PID:4668
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵PID:2560
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5ee5d0b45453cb7f3612e1376fa8339f4
SHA1fc700b05d6e7da08525312803de0915f94c855c7
SHA2563bf276891beeda58bcb3558927520212efd63479c0ce9cf6d02a7495cffa91fd
SHA512c2fb5df0704c47cc3f35726cafe4ab57d1a51ed4bbb21ebc988a5dfd47c3df195b22a64d306fef918c75266f7c6046d46a9bfdd6bafefba609beb92a287fb586
-
Filesize
797KB
MD542f4c53769c9293e6bc0d261c81f9960
SHA18d25488ce16b9efce9d18239e12093f3d4728248
SHA2566c1a5ccf428bcbf846bfc7f89f886e20d697d2c9594d22e6a70751dc40cd78c2
SHA512e5718dcb142bb3a3c4f7719a96402788914e4b21a49f37ce39b587b53583985413ad0f67250a491cb579dc1ca9ac1edb9777d70bb9c0cb5bb1f781e182e2f263
-
Filesize
1.1MB
MD58f49217d54240cca97df25761152fec9
SHA17508fc811124d9b330fb151ead95d30de2bd84b4
SHA256717159f687d3fd1637a432a4a2ae24f4904206c54d4a29e5e1e67bdad8ee8f11
SHA5124e551b3ed42592d15bbb2e108098b7337b7e70e70533809e92d3eee506dfa510ae946c7f91c43ad2269b7ede46fb67b2c785126de6672854766df5c21a1769ff
-
Filesize
1.5MB
MD5d88cdd2412377b6a34eff3e33944b53f
SHA11f09377eef9ecc14bd0990f3862a334927d3eef5
SHA2563e5a04aafcd39009bd8d0c12e44fa78f9da859eced0a19c966f85db6a1a8f5c1
SHA5120ab0aee0ec6c7fd5656783d25cf69f9d4a6e33879bc89a5ac6e80985bfe39b0bbbee55d8a871a4e537e981a26167a642c1b59ddec2394a49b1c3611359dca6d6
-
Filesize
1.2MB
MD5c57453d7e75b84f67e86b0e89ec9b43a
SHA101db17d9f9272dc14109a37c3464e15ca7d5d4d5
SHA256052e92c036a71b853d4856439433e319a8e460717b620b3317d031eec632ea04
SHA51248af324df4aa62ebdca216c5304a5f8fc68b5993075c5eb5c0e3b64b5695a1971df799f74b76eb81ab08a8baa309bd40a5fc8dc6edc8b5495a3b6a96db418621
-
Filesize
582KB
MD5ae5468aec061c9d65e094b6a4945e1c9
SHA130fbaf6538616e9987642937a8c2c650110b3315
SHA2564563013304e1f3fb2034d4e29624219155ad14278bab3f28e29eeeacb3017f95
SHA51258ef2bfcee7b18a357c7233e98ecc23a47b02cc09fddfd04124bd446c1a51da4663ecf02032ec7ddc798181af7d92e319150cbed4c8bdc3b7403faa126075bbe
-
Filesize
840KB
MD57dffa5cb1051483c34acc08f14014cd5
SHA1d9a7859a81578c4717231983123cb2608463c204
SHA256cff0ba9aa9851d3aaadc52f2ff40e504b5d51acb8ef25f312036924a71ef5728
SHA5122a28ef7591382675e6f1043bbdd5bfddea2307d6bed0a517cd065619f6b107259f23335110bd4880b45df8f18d071c0c0cc73a5ef289fbb1c5761f11c7f69b26
-
Filesize
1.8MB
MD59ba1400dcc5ad5778ffe5494ea3270bf
SHA1ab98add90da1d50b63e9801a2e0f9403162abc13
SHA256971326ffb6ac9149f586bba20c410db7913d5fa9ce5787df2379bfc7d20a1f35
SHA512320cdd07bfcd69816884494eae9a5f76bf4fdf475c07128e7779befebc2eb66a75bfb1c411dd43765e28b5c1f68355e50b192825d0e319d3d084e1199264697e
-
Filesize
910KB
MD5151b59cc7d3e94c2fb752583a0dcc7fc
SHA1464b3a80790e3bd6dceb75eb8303d51509c9ec13
SHA25648f79210a430cbdb984f5ac8be0b40a478b280df44d682a16f780764ea22cda9
SHA512b4449d2ffe9c1c1ad40647cee0133638e1f812d8e402853f3221f7fad2e14f8f77a77a94e32815675727883f0db81bb05867a32dcd6872e81ddc044c5eabfed2
-
Filesize
2.4MB
MD544d04c820989ff66ac566c31a25030e3
SHA19b8edf7a4f24ed072e01e750cf8662d317b0254d
SHA256eaeab7c4258098493fd705404a5257201df447d190811236174a2827bcaf0947
SHA5125842583a4fc246c7626b65f52a86547c7c94e970149bbc2c755e9973c0bd40ee21116a1d458850131c04a12bd718f25434e399597ecdd93046cf985744bdf3ac
-
Filesize
2.0MB
MD5cc23415d11b6404b9804adc182a9f0f1
SHA1aa70d4eee8b1bc3f76b5b73e77f7a3f05268a62f
SHA256bdf3b1b62175e0419ec8a04601abc173d7e311cc9475df9d790bc02db29d0a0e
SHA512cb5c7f68c8fb4e62b3319b96136180db800f0e13450ae2f0acee4e40190aad34a4872abc8c6108044273db154c66e498d5354c0485c23db04917545648fc4971
-
Filesize
1.1MB
MD5137ef2bfd1db1ee17be86473d1fe2a8a
SHA14f01caec310bbfafd684abe539f562cd63e70028
SHA25649a468c225c4de42274afb2fe67a2048809b2c0e7dfb7097a166ad1334afc5fc
SHA512e9cb31701249487476109098309a731d5c3435afcf4103e95f641ffbf88e2aa460ff55b6570c3cf6732516bb13a434577f1b12f024f4fa2737dfe78346d32e87
-
Filesize
805KB
MD591c2ea0afc29f7b15fae0a98009d32f6
SHA158d9bf69af9e92f0eb14aa096cda87e1651c382d
SHA256428855d73fadfbca16128b07e30a6e7fa249cc9cdfc42fa777c63ba82e8b782d
SHA512ac1566b31f65b07b16323735ca5473760a2d73f7769c43c0bbffe202be784f693b57e1bc939af3983752cd9ad037662d67375cc740aab5949138073e7d6712ec
-
Filesize
656KB
MD58caff719e97c464bad9b5896ef94f079
SHA1755e2ff1a2254608529de757e5371bbfe3af896b
SHA2561b4d238946b664be2906c74ab662f8a3644cae1cd39362d7299dab31ee001164
SHA51203dde355db1bc20f11bcd09024f1780bc762c8595057e1b1dbba67913aab6f3e0a7b07cad11ba1ba92eb7e861ca189767d5c6dae6554c244d4fce124b060c770
-
Filesize
2.2MB
MD5e5ebec380c4af6723865f9914699c331
SHA1dbadeaa17246f88d8be96e525763b188ff9addaa
SHA256d60997559b07b0e96a205d92d87bf8d5254b69e1e8300dae7c6115c509d1fb04
SHA5122b96a0e57bb7fcef126b06578d77596e34d69917416562b4a3697d8bd63f50501fb78e968f85eaaff41a563b45bf44e5ec1bb1f8d10a48456802c0a14f66895d
-
Filesize
1.8MB
MD500396a7b3458b51bb0708581f17b32ef
SHA141d3fee904f39742543c6ca171be03b3626078ad
SHA25667e106b874b008df04cc012b4ae4903b43c912dc029cab49f2ce1dc16e696c74
SHA512a8ab2ad81ccf8328851f835421a79e322f598fc55680c26d19db59ba9234e39cf1eb2d513bbdbcffa2e67b09db29963868239a532fd71e1ca87dcafe954b0457
-
Filesize
1.8MB
MD5187a95f90029f4fa2acbd9889fc7ced5
SHA1f02f33b7b517b8993569c96ee13c6756df69b310
SHA256cee7777cee84adbc3f7488758aa975e8d4d5630c0277c8737dddd7ae00f496b8
SHA512b336748e6ac87025087d12684f83250c82674681bd031a452468b9de6dd58969cd802b3cd61789c9ae7b17c5abc852a063f911dd38533b526200479ee51f0ef7
-
Filesize
2.2MB
MD535565cd77d3bc1cc29c67cc9e0f48dc8
SHA17769d2bcb29aefaf01630c5e96094b57ad59dbb4
SHA256f254fb60f1864dfe293872f94c0e218ebd4327e5b9d04a2efbfc3de3c6826799
SHA512e109272be039b89ca236440915ecc7b01c2ca27276877467eb8273c778cb5e3f6378fa6fe4b28fdb35ad054310a796914ec29c1e2b7d0293f4c2098743f57891
-
Filesize
1.8MB
MD557554562a3c5087973c176ba588b747c
SHA18e74572974683682b680a4b201d30c75bd58b7a8
SHA25685ffcb6eca7c05f781f8804eb6cec937c9985a42bdbb7fe0fabaf882a55a9cd3
SHA512e75cd490ed2b5ea46a8ecd1e0d72ca8009f944a2b80409e9102c3e94ad0efe85dd7abf62580de152afdc56f4ff342df0b34b11fa8a6376338ba41ca812623d92
-
Filesize
1.7MB
MD5444d3b90be10e2539b836145242fe4ca
SHA1a3a335c5a300862e111a297311c6681d766a8738
SHA2565179544d1907181d57d1102bbd642c2d3c9f8cb34ccacd66f62d645837e7af69
SHA5122296213e9bdb756c32d2902c305c6bac0da5a8d47d6cab6b699f17314f9fb2458d42a606978feebdea7fef66abd04068e6f8bbbb491d55eaadb84ae0ee9d4446
-
Filesize
581KB
MD5df774aef9a14dcf57ae00065729aa657
SHA11d6f4b44269871d22aaaf9df5774e85d7f4862ed
SHA2560a14466f631d679599cf1babf49c7f2ee304987dfbc020b5332777d71ef7e37e
SHA512cd5661977d7ce744e553c22fe3ee0e3759ba2ef738f56be8802e1a7e77cda045d31daf126f065fc985abfc384351029a3d0570d1d2d3dd72f70121f975690e7b
-
Filesize
581KB
MD5c414abce1d22b5a7ce44a40f1a64b63b
SHA1cb3920c38661b2408540486593758e0c95526ed3
SHA25696ce034ac5051db645b2da1ce27342628940c78ea794e226e805162b8d132773
SHA512a63ab51919836d1ab3d3cf7291dd05b2db1d4df10e272b3db77e7301339ceec8c739bf904ff0c6d8e44f95a22a873e5a0a02341db73fae60eba92a4afa058a97
-
Filesize
581KB
MD554a605b24d85f8dbb5bb0459fbf60cba
SHA15cf95b283a57919f957fc829fa5cd34d3869f9e7
SHA256e68fba6881e1f04e3706decb72a8938f1176ebe7f3fa9f9cfd67e19e9b041149
SHA51248ae362dbb80b5be7207f88043cd082d012170ffd50990f6e0e97b3ed898c400a4c04ffd1f92c225980910da7b87d00335975d3152627629ebb3b90d768893ca
-
Filesize
601KB
MD539c406909ae81e436e555d9583b2649e
SHA1d4e6ae31eb8955f97b1f63cec7770545b26ffd40
SHA2564a156ed14ab27394b244714495d772006cac6cd6cb768fb5b305a9a422921200
SHA512dae85b07c6ddc599f1cc7370d82e65fc7f42ef8938dbeebe49c8db5dcd99ccdf38670a0102ef3ebca57155669a73039477a011902c87038e2aa5fb4846f68876
-
Filesize
581KB
MD50271070b6a4d0452c17cd55f142b2dc3
SHA1c1436d1d43ac839d2b9b495ceea6fe6844da58a6
SHA256f8a0740794397819c588dbbdcab923cf9fa440258f962a0b4c96b723a8b394c8
SHA512b1951a8ea83c5c55096c4d5ae484b5b6ed45d87cddeb1e8146cbd395c788c41be5f82274f35d3db7692cf6d27fea1dc11c5c8456421987179feadcf7aa062e83
-
Filesize
581KB
MD5f980815be026e380a3c6dd64c36f0af6
SHA1af59069195b4136b9dce68a76c95d29b311fa319
SHA2560de932d1f51f64430584d95c4d87c5100fb5275d1b4e266e13133afe9ecac190
SHA512d8a53a6115a5d3aa8de32d3cf308554e2c5ab199411929db0c3999e8921ae5de9e4c2cc32ae48f870b6fc76a05f26823d862c848e4437ecbc8949cd71f1062d9
-
Filesize
581KB
MD52428e32489d0b80ee115842851cbecdb
SHA16dab2585c2d15247c3100cdc5781a31c647a7737
SHA2567ae8391d23810bd67950a041aac1b9b8f765e2ac2e9423e5a5ece9c9c78a920f
SHA512991c0bfaf2c7aa3ee4017ebe88076bba65b6d9a15c695e97b6fa413452be9310dfbdb76906fd9a69a9a13045bb47273dc31434deaad1ccb858b0da7c202aa30e
-
Filesize
841KB
MD57a7d68e6a655649a07424ae972ffb986
SHA16f17a2c83781be935d5710416b0ac511be8b4a7f
SHA256d7437dae3b15a0b49b4543159d11481ccfe9b7e319c95c710d9a947c0c3c652b
SHA5128f5b7a6289deab32579272305ad5474e4d82adfefd157d12a3f6ab80086187639e59a7e87588e5798c1388cad46d031a7d39c95ed2a05e6f4248572056a07e63
-
Filesize
581KB
MD5e51e357b57577c4fc13b468d4f84a7bf
SHA1a4aee902ae580a2675e9d201b8cb0b4f249feba3
SHA2567aec4cc6d068a0027c5a3560b434678105b47a31c2adb5fcf7f3d68b0856edff
SHA512e102dcbe20c84e30a95105e2510fd86257e275ddf07075e115380c5543c0a433a1d16c416ac5ebd3d1b8deca1b1cce28352b987828e251809c6bf914e57b0d11
-
Filesize
581KB
MD540d4a1c6388a2699625bb8fd1ff24302
SHA105eb2b88137ab44b59ac15415cff9adc014bb6b0
SHA256847cf68b9a61a13800f030647065a065151c8260e03112f8460fb9abea4f9a94
SHA5128cfd3b8c6a47bb95b3a72ca9faf6aaac3ec57fc1f7f36ef0e7efa96bfa1237e472285979c7efe2ebd5e22fe88dc9d41661b61536acdc740b7d7e41a87432b9f1
-
Filesize
717KB
MD5559fd428eb4ad1024c00bc7dcfd7dc20
SHA14d7a2e84134b0b7bbeaa8960c2e0b30d4827b969
SHA25628fe03fc452be14f42b8fda1de8fd6581889384023c6a7c5a2f73b83de749c3e
SHA51276742ed5ba2687e09256b38451b38cfa358a5c01a3338064a901ede4680db79864e9f26ffcad8a70a9fe5dcbd2b2081381bb198e3af5b26fa479aadf59ff7e2d
-
Filesize
581KB
MD527046411fb8eaf8db134d31fdb4b3675
SHA14fb98113abd96b25672430fe58e522252f9571d9
SHA256eb318b31e1afdf9ceea810209f009e4654307d515da96e4103faa02d0018d219
SHA5128a981a7ac4659285df486fec98bf23acba7720c5838089dec564a3ce915bb60608475254936e5e1968cdda9f60d18bbfcae24dec08e481a5fdd158392c8b9a39
-
Filesize
581KB
MD5ff69b591029aa17cb6121afd75d00799
SHA1aaa983c3ddaec2659c7097c983f0d442ae7867eb
SHA256efa96041c30fdfff74a01620a667ef4f2a6e937d15350b9621785983febbdd3c
SHA512f6943d1b93a7bed409a6c481133dea51b7bb3266ae68461c7e245e6f3fa1c2521b8af3fac496993c5eea81ab66619de91499f18036bf898afd7a5e5e885fa7c8
-
Filesize
717KB
MD5b88262d5f20c35d0b56b378f10aecbff
SHA1587557d7cb367228c232832f6a55a54dea148d25
SHA2565dd220b8ae8b2461b273ab060d09b938bc97aca682b0479e6e7d98443b6138bd
SHA512b5207a945e22f159f5924fd78bd715a9bf46408070c7432af051c77021ef5d9b368e7a770a7ba22c876600e4b18678ff1c6343b8e4edbe43efadd4f58133030a
-
Filesize
841KB
MD5722091513448fe435ca9d7768138b7c4
SHA1cc57fa4c97c050171937a49ccb3d6fb226d42f11
SHA2567facbafaf3e9a70f2965f5a637f15d47f4f18653ca3e8d5caf68aa325421def0
SHA5129ba3bfb956c985edb9b0d6018cb4695fbfe936910727e8f16f43a3b1ab715c5f38d59b31417e3092f21c3b1452e27fdec1308843159fe05260a8589b4e69c977
-
Filesize
1020KB
MD543413380ab26c46e9b0087fcd29a4f99
SHA15268910ad78a6d55af215b413eb0c8838c31b2ff
SHA256f7e8d2e2f484becabcc93ab5eeaf8644d280e45918dc1635ad965f686f7a9655
SHA5127517ca9815811d05a60e8302637c41c2a3d43cc069312fcefd4a3e86aaafc7bb684785b9ecb38eaf466fb82c88831eb1bbeeee987266fb41d25629cec538c800
-
Filesize
581KB
MD50acd7bcfc0e93b8e1e4521c1110d6f8d
SHA172684178cd26366105698fe9c3ee5f399680335a
SHA25670f025b4300c3e3ce40903a8ebf589500b83947e80b23fb24cbb64e1fb25c3d0
SHA512297b1159031baa5681a69586c22cd5c88c9ffa6d6503843b3122cd580e73c102f4e634a78f5ed0a849cf4c6363d299fe82abb91ebe9750bec9573d09e977b3ea
-
Filesize
581KB
MD54da3c677f53bb6e4238cf78bbd878f1c
SHA130bce9d9ba83915b955828e99aa16e22b148df16
SHA256fabfccc4ecb568259bf2cb2cf0eecc66106727bdf1cc182bab71b658eb1b9578
SHA512e6c66831685efeffc6b5864c618a930d56d80a634e20abecbe85806a1a0ec603adab6acd14b7d5b5995dfbd81ea6cbebd74e8fc3c7f1e7fcb860991f6d817c9b
-
Filesize
581KB
MD5386c7c545fde8fb7a97b74778ec9aa2b
SHA1234c9080bb074ad1632203ba6771ee36129606e2
SHA256683c44a96b2fb08a426b646cccb95f5274b930e33bfe512e7ea56aa8dcd54e2f
SHA512ef88900b4674f9d40b4b363ad510060d20a1b86b78560d1ab84a0c4e3f0d4b0046c6cf9fc4a9e6822609af1985961b4b551244e2244e9c325d89031614df3630
-
Filesize
581KB
MD591ceb3b075db4230ec06589bda2dcedf
SHA13b7f7c5042f1d27fd823be28a26dabed8ad7a070
SHA25627c6de7d4211bdc2d9fe3e90a631aa88ed4ac9aa0b85b3ed4fcfe6a971cc6326
SHA512288d1741490202075bfb38e9789f775d0a16bcc09360de205e8437aff3119f2b66a23e584a9cba2069ee9193c07c5e53487ad0a8f9c9ada035c0c5fdce12a5c0
-
Filesize
581KB
MD5abf8ae1d5418b614ce283074bf7627bc
SHA158cfc554f2d8b26fdd4d3592e0df2ed69a69c88e
SHA2561ac3c97497e3295122ada397d5c7bb4e68b50e4d6be823bb3b4dd351dd8ec2f0
SHA5124e49c28dab9812c76dc6531396f94aa9ea341f15654f14bfe4c5bd3fdfd45752e1f2fd53c63807a5190868d39e9f3a1ea346433ead65dd66f9f91ac4216f51ad
-
Filesize
581KB
MD548d2943274e5db3ba29a42ace41cb314
SHA14b2a02bcdc6b48344ea7bb2f380812794a309af0
SHA256f6cca4c4f1764bf1bfaa82aa4c4f3e4f437b3d14b1b5621fd827475acf969087
SHA5124e82cce1dbfe04f3af5687a11f625a25c02726f24f075adf08d644ec762fa41ab80b301e546ba1a06d79ad28558e3cca64c732cb246da64dd4cff6d78dc222a9
-
Filesize
581KB
MD5a754f9a61834da1a3a78add993be0b20
SHA1e1ae4995e307b107da3f62d8b309c953bcdb1789
SHA256c3791d4cbbf1fc5a8761569636942bf3a7ef0875ae1759e80d470f58a5d3db2c
SHA5120e14c3fcf1384b068ca35d2f6fccce22e932a714b1af9ebb287552ac938c8b55a769187904dfd5aa58fc6dd5f85a9131ad5d8c8cba353dd83c12773ba63c998f
-
Filesize
701KB
MD5149fb94bf1f7e982040f9942a65163f5
SHA14b70e6f03f6746c9915fbe2a99e3133aa59f0198
SHA256e174b2ef5e9096c081ad262df4ba2c6f78ebcbb9fb994b8144ed3a5d9bbd839c
SHA5129b623f55864653e3a47e87fca880fbb4443380022d0ff1a51803ffe842e8b0c9e03afa17cfff7b4e2f168e14b0381d5b128ba0deedf233f49407411b39e9db6d
-
Filesize
588KB
MD5b4dd0a9d02cd4468da2de019f01a9ce8
SHA1147e95ddd23e48bf9f9312f15409a6b2b9a61f43
SHA256093581df1fc4fa9d918d4ba02e54650ead864aa274c7770c826e6aa20ec133f7
SHA512043d1e3b061404e65c4faceb232149cad92c309fdcb8d087b5fe617017676bdb144b3426e0a1d6b3f3d57f44bc3d1f7ecdd32baec5efb2a02f48c8c529d539eb
-
Filesize
1.7MB
MD5f0c8d24cc4e7d69ced6b3438a0b8edc3
SHA1b8a6dcbd9c2184039bdee1c03ae0b5c54eae6b08
SHA256d8d8ed65ca4d105f4f3189abaf301da277a2b3d6b7ef3d7ab9e8bf711cdc05b9
SHA512c19cf29c971891bef6dc982381c86ad00a92203d7cbf3787b13c6d796d5d886f9e3f2c2ba11ba7ba790c5175a2a922f634042d4770f3c63efdea296a11db6c9f
-
Filesize
659KB
MD5a03c7cb2dc7eb6a6135a3dc97e098762
SHA16bb71a509bb19d52cf426809978f3a9148a369f4
SHA25670aef536c2c51576a197edca4eed47fae0a156560d29ce08d1ccde11128c64a1
SHA5124ca9cae5f84102f81a1765f431e466c3324cec12b890765f122c990742306fb250baa36916438e02b9fdc72c9038743512ef1a3dec2c453e4363d849ef519fe0
-
Filesize
1.2MB
MD5f04795cb4e0431039e1522234e007c27
SHA1d56497ff17e138714e53dafa850f82f6f03467df
SHA256c453ffb6c9363276c461f0dab28d06d91dd5ff5865f100b0b82724f81a7734a1
SHA512923cbbd4fe20556bde78c36865edacfb4d865e14767093526c22b2eff11acd563bf3a21b24ccbc305cf3469b88a4c13688acc9adcddcdb3c2436321d913430e5
-
Filesize
578KB
MD5458a7cbed2a0ee7dcf358ff829e24243
SHA15a7571dfaba249c6b2008f4c251127886d51c5f1
SHA256ec68e3c74fdbb762c56504f93bf7f2444267de92b6c302984d62ebb9d88669ca
SHA512883b0fbf55d056baf11188d353612c42e5c980dab337ec9c9f010aa3b84f80f6de739009c4d1ef3deaffe25cff4da8789dbbe14b1be2b54e7dd0aac2405cbf99
-
Filesize
940KB
MD53ae8c5e511c7143a9f58914781ae70f6
SHA1d31dee3f6a830a5fce003553420d10ecf1be186d
SHA2569fe37c1ffd6aca097c908d4e22352bbf8e7fd33f1751b81661cf5ba29771557c
SHA512af6f75acad23479bf9741162d7772c34e6eb9ece4369923272a32940fc72b62e7cc31315627c27fe90c380117216fa5f4984ef0578870b0073f56a11f21ac4c5
-
Filesize
671KB
MD5c7b60deb50fca76e8c36e852b6f5b87b
SHA1790b85497b70d36bb4bb4da130a486958fb13c04
SHA2564f28da6afef54f9c93e306bf3c82508dbdd734e698c44e36fbe7d78969d3bd36
SHA512652946bbf4f0d21ef787e984c590827e67a80f3c641d0e2894824a9648cb72d2b6b86f48441d3029583c736129f0210d2326da1bbb3fd53ed60e2a9fb221b626
-
Filesize
1.4MB
MD585381ab5113a707dc56d4887bf8e6d6c
SHA15b419d700c8e670582baa77839fd828561d0c4b5
SHA256bf1eb98dc85d33d0fbdeb062186410cd22e6af212e6846100cb68e25d14b0201
SHA512d21347ade418e0a33a826c2bfb327f40d5939af89d81bedd9ae6764f5ab197b87afb963fdc5480782c73a5d742078c92c579d239aeab64ae4a6e731e22084851
-
Filesize
1.8MB
MD5a7e12a0b79bd249b175965d4b681d225
SHA181a9ff213e0082be1efa06dd53ad2e9f90adde36
SHA256224c2bc54acea35d21771bdd760bf3153ff3ec0204ce7d3570662fc5e44717d1
SHA512b0be5d6658c188601787938cf4d796abebc7fe25875fc29e966d7893b38d4cd9e706a24955df7b138c3933b117a3c7050f17a88ccce24f1710ef9ff074aae6b1
-
Filesize
1.4MB
MD526280d6a05cfe55281513ccb8fcf5ff4
SHA176b58fd3aa876fa90221d733fdd0a974b5fb57e2
SHA256e6e13a8c1523a27d668925675ab9cae36eb9835f5fa6e35960fef4e060fe9388
SHA512673b07cd531891f18dfb223d424b0b157ddbd54d92a0890904c3584284f77719da899d70f41b9886aa78ece6e5a25a9f328094547b147c70c7389ed4a64f2026
-
Filesize
885KB
MD55d3ec32c22ffea5da591620c4ac1edb0
SHA15baefe73c6d9801943b150075871cd3f01e4320f
SHA256f3b5c6302d9ce4824ed2e5707b82c2c51c7e8ad794932e32e0591d8e6550b280
SHA5122d3408899b04c2bb01d4953ae56aba5faf566c5ae98317d175cb80d26a1562ab5007a1ed75643d952515910b6f427d02a0e64cea6ce0dfd9e50eaee4d8c51afd
-
Filesize
2.0MB
MD5dda64e0b5c491300bb010fb36f8a3aab
SHA1cd4ae1f1c240973391090db902870c9bafcb7266
SHA256530a32981a745a4309777d2d490b4e3203d9fa4a1d7f60a5577f4e71dbf5e17a
SHA51263d8a8e22e080014567e346a99e895767bb0cff370285d7de0b49eb227977b804cc036ef3c14f3312654d7643bb6cb5f2aa32f2e15941937bd82df04c3e53156
-
Filesize
661KB
MD5b1f59e942732f462b2be9c6684809df8
SHA13addaf48863785a369c1089ec78cb5da003d6ead
SHA256b06758d7899c966a0d016fb3b0d216ae21135a70eef6ee30c79cb22bac0e192d
SHA5126641931e2289fadc7b8d36f959e87e2cdbc08fccf7dcf25ff183381dffccaef6fea314cf95e30f4b930266fe28f969ba23d834920ec4282ea04d7a6fc39a93bd
-
Filesize
712KB
MD55db3c872eeb8f30756f4a8ce40d4fde9
SHA1715997c184bcfbc28317e7804c23353008964a34
SHA2564c066b2cc4eaad9bf213b2129190eb45a5c2ed6abcf7dd47f64a234ffbcab026
SHA512333e9227dcc6fb99f9971576efe1eebbb772249a9c66d41d41fcca00e3c4703d9af3e45963512ad7104c0e94563af357defdbb0638516f3b2625dd7778fda597
-
Filesize
584KB
MD51797c453de4d47b9db1a872c2707595a
SHA1aeb62395bedbe982b82459e77f92ac71b198b274
SHA256595e4d1aa18a566e1f7d057e23b3e38c0cd639bdcae847ca7fcec6e816b5b1e9
SHA5124675a5e5ede2867217f535edef83c6070d94ee143c7a0972adedac076cd92e3300e6901f82d111369d00aa752fd01ae6c8595070e712c4667d68205be4bd17a5
-
Filesize
1.3MB
MD59b522ed442c94a341abd5f57800bfe92
SHA151088ca346208553090554e8add54468d22969e2
SHA256e6054bff0f3d6345d05a474304d38fa76081be77e6680295d53a3be7299f285c
SHA51290ff384a85f1f668a8ff2a16fe286ba744e3c1ae99cea1886361a45626fc768215bbc2bd3b6cb2869666c912f69d88b40754ed99cabc51e82aed60b7a0528c2a
-
Filesize
772KB
MD554a8e30cf5064a34eaceb33b281a4a2c
SHA16e3c2212889040e8f2816ff60b12da5cacd7b0e9
SHA256ed5ea4c65ca2f0cc815cbcf8633cff529c4db93ad903dd2d9a8a952ede7145e0
SHA512a140df243848746817d5adf054b169b0a9d68d4f0b9a8b181c45f153cae45a0a4777e4948a9e9f9a551b278b159bfe0f3896b11c727046bb2578ca359c9b0ad2
-
Filesize
2.1MB
MD571a111a66ec5f8f179b8101a5ed5c188
SHA1910119277a61b1804fe71a44fa1d4bfa4f5d4cf4
SHA25623fb9357cf3810776b773109c738913184cb112aae27e9267994f9c2284745e8
SHA51282a0df8bcbf0ceee0a9b0824da248f9722fa3bf44dcd6042033f049c8d2bfd8cab5fcc1e8f5a1826f05c7082358708e663b73e1bf4c73f2b2733ad6c7ff9a135