Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
07/07/2024, 04:44
Static task
static1
Behavioral task
behavioral1
Sample
412a0b3434f9aeb49afbe283856289b0N.exe
Resource
win7-20240220-en
General
-
Target
412a0b3434f9aeb49afbe283856289b0N.exe
-
Size
1.6MB
-
MD5
412a0b3434f9aeb49afbe283856289b0
-
SHA1
6827611ce132ba7e6f89b4b599c4823968e5d7bf
-
SHA256
8e3b81250b279226ec37d64961be2912f21654cec721d7a0620f3b97ac91d182
-
SHA512
c7d7d5182bab1237ffef45e56298289e193b6c2b7cc3f9d03f4dd651ba662b9f3a288c493ff2887d8e13b85adcc682747b9e636a4def61ee20be4ff77edbdf27
-
SSDEEP
24576:Td+qBg+L6VMRCPU6CENltmVVdpx7fLrQWd:h+g6ZU6CENlc7dpJLrQWd
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 4392 alg.exe 4880 DiagnosticsHub.StandardCollector.Service.exe 4416 fxssvc.exe 1228 elevation_service.exe 2680 elevation_service.exe 552 maintenanceservice.exe 2816 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 11 IoCs
description ioc Process File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 412a0b3434f9aeb49afbe283856289b0N.exe File opened for modification C:\Windows\system32\fxssvc.exe 412a0b3434f9aeb49afbe283856289b0N.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 412a0b3434f9aeb49afbe283856289b0N.exe File opened for modification C:\Windows\system32\AppVClient.exe 412a0b3434f9aeb49afbe283856289b0N.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\d065cbf477bb1a71.bin alg.exe File opened for modification C:\Windows\system32\dllhost.exe 412a0b3434f9aeb49afbe283856289b0N.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe alg.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe alg.exe File opened for modification C:\Program Files\dotnet\dotnet.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe alg.exe File opened for modification C:\Program Files\dotnet\dotnet.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 412a0b3434f9aeb49afbe283856289b0N.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4880 DiagnosticsHub.StandardCollector.Service.exe 4880 DiagnosticsHub.StandardCollector.Service.exe 4880 DiagnosticsHub.StandardCollector.Service.exe 4880 DiagnosticsHub.StandardCollector.Service.exe 4880 DiagnosticsHub.StandardCollector.Service.exe 4880 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 652 Process not Found 652 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4200 412a0b3434f9aeb49afbe283856289b0N.exe Token: SeAuditPrivilege 4416 fxssvc.exe Token: SeDebugPrivilege 4392 alg.exe Token: SeDebugPrivilege 4392 alg.exe Token: SeDebugPrivilege 4392 alg.exe Token: SeDebugPrivilege 4880 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\412a0b3434f9aeb49afbe283856289b0N.exe"C:\Users\Admin\AppData\Local\Temp\412a0b3434f9aeb49afbe283856289b0N.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4200
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4392
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4880
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:968
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4416
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1228
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2680
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:552
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2816
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD57af41a28b672f065c5db50edcac6a81d
SHA135b15a2ddf576c52700323e21a4bf1fa1ab3289e
SHA25663da7f2237c309edbac6ff597b74d9b050ecda35e2ffc9fce28299b6a2fbe101
SHA512eb24d7c33d8a7081aa77256c2f206dea89cc73ff58078f3bfbc022bb7cf4f9f087327c67f560a5aeba6f882351c95767ed76b55041556d1e3ce6254d0ebb42e7
-
Filesize
1.6MB
MD5e6e5ebd8d6236888e9423672a04fced8
SHA177e4658a7c6826f8012c7d7ecf8e41c590ebcb6c
SHA2562f5526ff283b4c9f85ab7e15996a9bfebae7cd6b71f5c4dd76d4089eb1d276e9
SHA5124c295c651206133976e56c4faa680863a01308eb9a3784fafed02d9dcd0a5f731ddd1cffcc79a34888813bc23920a976f7b502e83134c95549683aa5cc598d06
-
Filesize
2.0MB
MD58c965ebb9d1b3016125a602e1f481fae
SHA1d8d57a520263fcc6211c030a4d4c11864ad2e7b2
SHA256356bd868804881bffa925b8017ebf61fd6339434fa8351e91a06c10e66031e85
SHA512f0d9d006426156a705d446c357116e8b073ce12cdffb9b9cd07303a517ceb0a9a6ae8c33ab62c11c77e2e054ca4b6b65943380aa7ff886b1d87f38a5b9e908d4
-
Filesize
1.5MB
MD58b06b96c8fecb86ea53d0a8838b9d4bb
SHA16c7344f61cdb4f25221a7704e1793aaae8bff226
SHA25652f79cfb85c56653aaadd7f7919d6db8682b8b14277758985a3169fd6f5adc8f
SHA512f08bb5b6a23760af2a4bee6efd8ffb325f5d73dbb167c47a8002b3715fcf69b29e249c30d9d07ac7d37c885b972b629430b74c90071264b4a3af5c14bc6753ba
-
Filesize
1.2MB
MD5ae792d213ec3bc1a55f52fe9d52b3022
SHA16f83e1e1dfd41e6579381b51e5383aa07369ac02
SHA256b7bc2fca481779b960fcb46f14b9b789cb27293dbf53cf5aee596842b2c87f95
SHA5127129d6ad45c13a7ed2f36d06d7a7d56c0673bc00a3d147307232c6975b761c362eaf18e94a06da28f9e2c433133127953e693df3d56c56c9065c293dc722e494
-
Filesize
1.4MB
MD59d16a6cd49190cb35492bcf15da39d6c
SHA1bc60deb6ae052b8bbbb263ac09992b593f9915a3
SHA2561edb63a4257999e68096beff9a60d4056bfe396d7b813d270202a1695ea6337f
SHA512f2e06b42de77f605afd41cb593985035a98400ab4cd7b93be8c1916b2534dd38f4ef82df3079ca4e2f5f5df6e8e0fb0dfadf2073be056827edc43241f924daeb
-
Filesize
1.7MB
MD59548a6a344c79d06cae969540d7732a0
SHA19e7ec44e41effc4dde931e482d79fea48fdb9158
SHA25679db590566f62bb5ddffd4b95dee6dc4f50e7d66a364400e76ad995a98a370bf
SHA512e64eb19b9d3da2574d2488370e978275ec20fa0c3bd3700410f375652477f3395cd4dd52be34f19286c3b7ae7f9721618b43da136631394bbcb90255a48c27d8
-
Filesize
4.6MB
MD52d3bbda961584295172a3dcd0bce7ca8
SHA155553a808bda2811838c24c71419c6a5b5ae3fbc
SHA256de006d5808097df3a7f33580addeeace2880cb5393783d1ca67d1b77d4f230bb
SHA512af798fe6df1737a5e7cfd6d9b60f3fb4a8748bb9b4bde6c32e0d7c10244eabb49a2f659941a8e5e4619d5888065e17b01474683dba845fc96a9c11fe3bd201ac
-
Filesize
1.8MB
MD5dfab8302a59a8dd953fcf2f7ddb6fc75
SHA16c77af1306c69bc53de7930a9058261ba0dd42ee
SHA25697c87b275a6a29381951d636d934df941d10ffae45e8321ab202e7aeb64e3cba
SHA51263da92e062f60856fd6d04c550298e4dca595dd00da7cf047f4514c0627dfc330c00972afdd1190ae8701f890f89948f3a6513259ba70e53991afb217f1e7f1d
-
Filesize
24.0MB
MD56b7160fbca1559e64d7a28c1393f5101
SHA138779e1bc9ece4953aafd39c68be3610d1019d57
SHA2564a019247989b8d0de29f095e0767e4d3ac823a150a441268302b089bb70b9aa1
SHA512fed582ab8dc4af9ac2837d39610fc3eb6d01901e01585304ec6bc146b8cf0a31225ed03890ce3991df3efca4e5ff3c1094519ec615681b71734df5ae52e8f485
-
Filesize
2.7MB
MD5fe04c2007f872f31f4a7797392e99eb9
SHA1c006aa128e6bd3d079f13e5d3e6a082a9aa15285
SHA2566a43eb07944384e8bd3f655cf90cd734af945c3540f0e4bedb6267889e45a120
SHA5125c8b3f9d815f0bcc6a573c79c57b54f3d07f194c51dd69e9c61ba1be72df3f7ecf7364d6b18e1a280c617753ef39fe4dbc4e6041f4d971f0b30f817e3cb17880
-
Filesize
1.1MB
MD52278bdedb55876f3afdbc9d4f980849a
SHA18f806add6b7c4f60ce6384a59c5e519f793d3e9a
SHA256bb912bd15b644f15bab19ce542e55d09a5c486ee7ce473ed3e395e751942ec28
SHA512c73effc99ec4df4d12e235c831c51b80eb9ca4653a5ab0cc5c6bec8e55ca2bb60137eae84cb09c3f431e1e38f40206d3cc062c4405fec2261ae2dd4c266f1077
-
Filesize
1.7MB
MD5c2ff6b65437851ec8d099df1ff6e3f72
SHA147dda836a4a5897a0bdd4ae2067e501c37e619cc
SHA2562125f3acde5f504c1f6e6174c4ca5622c68cfb833613f9c1e35407991d17cea4
SHA512d41f6c3c1d83db94d932affb0573e621f3d2c97e936801dde23ca0d33ad29f016059afb6c61bf1c2e81e3c99f7a6d75d72cf0d8b96d7635e75c21e42451e89c7
-
Filesize
1.5MB
MD5614a0fa95e78cd281fd4627e876443ea
SHA11061bc41075cb945f72f117195dd0ad61a6c64c4
SHA256a4e5c9030545ee33c95c415bea3d29f6464c4f2ae51577be1b7ab5e557a0708f
SHA51213d09b0c25ef044c38a395c2ffad7215170afea8c07bbdcc688d8864f6dcb4d7fe5e510609ad122c34f6766e61a48594ead7658871cdb25512c9a88ae812fbdc
-
Filesize
5.4MB
MD54af1563e974a3aa51cccaa56f79497c7
SHA1178a7330c5a9ec21d60ad9e3fc7cda71af47381c
SHA2563eb02cc14dd16093ebcca8a27156ebf61c921f1cac9fe3027a899dccce442217
SHA5120ba1ed99d981d4fd7932b885985476a3eec2ee69021c7aaa0333788559cfa7183a1ff2689b939948d49833582a4512761edbae64ded553ae4a0739442cff86f1
-
Filesize
5.4MB
MD57953d126cb52441c50e6ccc435c8cdb6
SHA1afaa87d57394953dd80aadfbe543360fa463b77e
SHA256c9728adf6df263bd551e3ace21da5a0ebd014cd23916ba919e20690ce123973c
SHA51288d27b74f406e80e2734507382ffc8162c331c27c1b8f5d39fd8d2d018deba8098f626ed6f83fe8762466b84582a9e0308b668e8160e1037f145579d51864555
-
Filesize
2.0MB
MD55c84dd525146cd1adabd1bdb7a3bb0a0
SHA19d3921d4149cce4c42ebdf6f7da20f537a977194
SHA2561eac73b418f304ef7cfe2a74b7f60aad6c49521756b0b6955362cfde3708adba
SHA512d824ccdb8418fc3776757f292c06829c8589052dce4613cadc74afae2ead49d652fd39a8c11934e4f7fdfbddf2361ead4ae5c76e800773adb17cf814dfb8f392
-
Filesize
2.2MB
MD562fc8e4e2e5e6ee085aa3300976b7430
SHA1fb2248136765de7aea7c15fe1ca03ee4812b4ac7
SHA2567cf528dbc6d7272365a1ce70eb6f9c7d6ec1f226ea76f0e7315ff22393ee1384
SHA51278ad6d20a00611b5ca5f3ffe152f410fdd1437240e7639d6492752db88b8be8152dc24e0c7c77b0ad3f723795283106c1a5718e62427180613ff7e7ff5c66962
-
Filesize
1.8MB
MD5c624f6eb37b92a1b7e5dd336fac03e62
SHA1f5f55f3a126bc72c796fd5d786b9a01e340eeaf3
SHA2568f0f6b2ebbbf05269b8e6b888ec839d66ad8a1479892e3052c31900378ffd11e
SHA512a0838d19419a4f9a9b24620015f105d6b6ad221db02772db1ca4e84a37df9fcff8d420a32a188fcfd6eab4d74dc916d55f9bf4fb0de906969fef37c2c872c294
-
Filesize
1.7MB
MD5aa1673b43f60f385538eddcaa90d20fb
SHA119013420f4d00213f17e2ee34096cdc3e442cf9a
SHA25649ace1102438b8c6828c4c0361aca32c6476b7256c2e5515d9cfd3539797c7ac
SHA512316d76acf1a7c61b3a694eaa6537d034b98f0b5712c6a4fe2cf86105337986d31636223bdbc2ebbb1f2bf7c58453806cb14b8efeb1c6e6647b320bf62a54c83b
-
Filesize
1.4MB
MD5b80df2c994605f3be346a711a9fa0117
SHA154ddc97b935cb10bf42871a34b0e3d0cb7c09cf9
SHA2562e6715efee7ef9dac2b40ad0a45235330920b64b6aa3decf2acb4c04f814901f
SHA51227fafa54f75a6429b8aa27a8245ff13381f2f0867c9cb8706fa10aa39d7e6a3076f927a553ffd9c8deb42383a421e655871a0b653297c22c1569276683ce1b5c
-
Filesize
1.4MB
MD5d794b8f3f0755f769ac003313e610c3c
SHA1230edbcfbc795154354d728dd43a3ff09a45cc5b
SHA256f829170b8d543c51cb7e928273c6c4ea6026c456683558db1af250dfae01f240
SHA512c18b7cad11452ac3d622d1abba54bb85b77f6b743147de95a20f2e615ced54ab12172a4b7c297f9b77d46287be229662ea9cd49ef607ffc5259065ac26fc112b
-
Filesize
1.4MB
MD5ad229e2d5c67cabe4649bedf115f3158
SHA1e2e654d26b32066c35fcdb91603413ce9d7c12af
SHA25634ad2ef1062aac88c5194570d6a879ebf5625bcb59d483fd8af9113917b16190
SHA5122e3960663c5b782b27f9252fec891ac481580325f15ad1d5eccea08cadb8874625d88d6cf01bf48ff92eca8fa3b5d7f26f56bcb193e56f8e3a8249ca18e5a5f8
-
Filesize
1.5MB
MD51138cad143d8cf4af0f968359dec44c3
SHA1c3ad576fa5cb183dff7c4f733d616fe24e428f53
SHA256f4a039a9669ddad6796ac71d0f1fd21711f78b1deb1592f4758b00a72d01b662
SHA512f6840390ace3ff9f59b30609b929c45a10301d0e5ded1d1997ac3a33068233ef747a7806588c8c0dbdfe9a19e178ec158f981a2232739242af7cb7712f690337
-
Filesize
1.4MB
MD5f0b4c8bc7d02af10ff78360dc13436a6
SHA18e8665b08ee5b8b8bd62989ec9e4890be6a998ff
SHA25697237c423fdaa673c3aab61c454f72a7078572eaf68e133c46ee5ce7776b41e5
SHA51258a43d8cfd6c43d7b23f530812921ef1fd4897b289d21abbfd8a1d06f7f530ce88cbb7de6cd30abedc4a42ab7f2c3cc12942589345559a481237ed92a414a980
-
Filesize
1.4MB
MD54f1dec4f2d94ec886c8458089574f464
SHA1e17b82539ed9f7dd32e31e57e891c36a1df476cf
SHA256d99ee5b42320a596769d77db5bd236cc829803fcac628b8bb464006047696643
SHA51270bfd04f225b6bc65a0f2c938d8866aed8d1a15e1091a35ca792a33c835bc6af82a3ef8ca87afe4d0657dfdfb0f75097da862b987ad5f8a4eba53d133d5671f6
-
Filesize
1.4MB
MD52b3eea5020075ed9e18b3fb3e2a8364e
SHA15e71bdb2d0c529cc31e316f5926523e1f6cf7a76
SHA2567dfbdb944a6a01c3adf110f26e93045c22cd7d93fb6858ea49866465a76350f6
SHA512ba0e6fdbee848130327c98c0624e2ea308270c981c6d8147a25a24ac0c67c4761213852a1472efd6ff8ed3d1e558d2cb14001f57eadb5c017ec7635cd2959612
-
Filesize
1.7MB
MD5e281cdb4ca8c5cd2e2ba99fb366ed005
SHA15c1a18a23e37283cfdfced1ce9e5c23c70f4f3c0
SHA256f64eb5d497701a987032be2701151dcb6d9a722f21ca77d8b5d9802ee1ffb3a4
SHA5128a5ffeccd4fdf7a2b514f913cbffbfc7a291874f52db7dcd0230e03ae5b3f05460f1021bcf13067c38823e92aa425ce0e6968f1f79b7d95a7de80601945b2050
-
Filesize
1.4MB
MD5bcf4a106cc0d0f6f9bdd468cca97c4cc
SHA107dda48e5dcad9d898c6520d1c31d196e0a4a194
SHA25681b2b3980a592d474f3e63cf6dbf1fa9fc87f08b3328a27fda16f05fcf0c4b79
SHA51268442cf476d6c1a253241dabd080de37c50f79ed042931de6ca05d36ee6609811405912fcabcafe1382fa6c0c8bc4d70ab53ad318ca5fcb5a9d7f664af71bcf8
-
Filesize
1.4MB
MD553e69c3e610b6be7dff6d39bb7c3bb41
SHA1c9a35b3ef467e7c3e67ad08aaf9e6a83eb60fb4e
SHA2569e7868503c699417f470808cad16907a90f0206c0657736e6dacc284078e4524
SHA512c9b7c9219100b767873bb0e502c7bd47c7867276840cfd5d3cefab58b91ad466549797389e3801dcff655f5cfc87d9dbe347cdf4784e529c594f214009c2cd42
-
Filesize
1.6MB
MD59d3004f84dcdf52ef3601d372698a320
SHA134f15bfcc8590dd39b6b18476590707b98d9dfb2
SHA2564fd4d4c3929cd4950b0092e595788130b31c07808e2dae42da60fb05e1e1ef7b
SHA5127b750673754a8084b2b3dc72bd4bb57f1182af1a2638441894c0e1536356ef338cd5c68017d9fea1c7e43d4944c3e9ddc1fe50634dab5ad3e66da7c5e1d36720
-
Filesize
1.4MB
MD5d1078fa6d930047fbc013f95788bb20c
SHA1ba6f5b4a58834ab6bfb39f96878add0f6c81a648
SHA2566ddc0e6788f01cc9f0c63006ce5a7869747cd89ce9d2dd7a8844b648b3ae0b41
SHA512281b97444bcb4e1e4a931405071300a071fbedc541b3971a4a366e4e1ecf249656c8b6594199eb6cffaa1f0e2b45d7f282d0c2343f98bf714f3b304b0ce5106e
-
Filesize
1.4MB
MD5ce8208568aabb8e730f092b033acb72b
SHA104671ff4fc43c2b778813c02b8cd38a925411ed6
SHA256b735a3edca7d830efa140986ddb8b5832d824d95679db57712a5be9209043cb9
SHA5128b8ce6d0c36c92b8766c84afbeee71a59fcdc220537f84c4b5db0bdd2c42ba006e0aea09635c925db970bf35be4f19f399031b64d0bb9dbb71351951c8174e54
-
Filesize
1.6MB
MD532b288eb29c695cea030e0b72517779e
SHA17c8733de1b7aaede7b13766334ee1b40a6f8637d
SHA2561cf6aeea50d8940bc277bed46637aec0470d52a3fc8bd14cc8ba58e4afc43332
SHA512d4e49a389893005cdb56f02f45c4e445ea703a1006f0b3772d5ae5eaf96552d5ba407f4250e650c8a2849456bc326e2088ea5fbf39b5555895556e47b8f7366e
-
Filesize
1.7MB
MD59a89c57490146b88294bdb0cffe2ad9f
SHA1fb6d3b0788c4893b1cd92e9ec07db193f72a1a0e
SHA256598da216b0f3babe4fa1bfb5f0b1023048c1a6c51d87eab762595df1be096c25
SHA512a00b03a429fb95947206dbde7786bd8f5a988dd2362e8b00f6488a817cdcc5576fbe65ce0d8d422cac0dc4154a11bd7524551406940bb8413ba0e30a1f9a20c0
-
Filesize
1.9MB
MD503b7d84c3ab44f57f105b40eeb64ee12
SHA107ad988df9ef31948bf667bcdd0c67cf55ca3449
SHA2566740c5240bb740963a2d182d94929e40819479a0d3e4c5a049a56962efa32111
SHA5126b6282fc991d6448fe51bbd59a17ead3d01c61be4a27bea84ddb970e39027819e659b02f9bdbaea6f258021fcd170ffd482a45c3c047f483333170f6b0efe748
-
Filesize
1.4MB
MD53d46e7f2256b685feeb792a733d4d134
SHA19474b4b397c0652019b62e6ede35753f9e2dc8e2
SHA2568831c62a55ad87e4e95b9e633e7a189582e371311df078b7bab4561dca566963
SHA512706b1cbadd4e1f5f57d939c761fa550516f3cd45d764d4dd7f6e17921fd8019025e8dc8f7ac7fb82ef631fefaf27cc5c8644f29af9fa03893ac3480f72ce1664
-
Filesize
1.4MB
MD54c5860136f7fd1cfdcc75b586bf4a06c
SHA1c16edaacc81c403035a1e80ceab932f154143a5f
SHA2567292d849e09f0c73d5430769a7dfd388c859cdf4f2444ea8dd0f8d45a3a73bfd
SHA5120c9b5be62612edb34e1b6092b68042b86f8202c1848be9f2ba6b7d3c073aefb2799efbbb36436382608a133b8028a96eea8a42ef266a9921d2fd81b9d80ba88d
-
Filesize
1.4MB
MD577a39393f3c396ff87010ab9c9f15f6e
SHA17af54ed4191ccd0538c76669fb381b41b943a5ad
SHA2566a80b7adf11323d3c6af5cca3bdd130622b717b09b552567d384a491420375a6
SHA512d7c5eba7043a7b4e82fb98d99c4b1c1c5bf72cf3e2bd67971b5753fd398ab4306c800d80c6a3ca9041daa9bb35e3bddca5b2e6a1ee45932470eeba2140926191
-
Filesize
1.4MB
MD5b1773c594940db60938e1eb3b16bb525
SHA186867be19052b365f5baa3622727fb06b5662cf6
SHA256c50a3d04864792b15352f1f40ce0d2568fa1cd7649b4f0f5b55e9e588633f7c8
SHA51255b448114b27a8371dba4a6a923d8b198670e3f23ed215ebbf0ea3691762204b548b887ce4e93960a8f8fba489b04bdc19f3aab778aa21df6a2ac91e6b5f592a
-
Filesize
1.4MB
MD51dea610a05dfd963752652e99d5e12f4
SHA1efc2ea9efce88a1fcb60abb7f7fd7ba7eb1b7672
SHA256ec496a4935dc2983053b4271603e498c44c203e2faf11b53dbe00d540e94e7ff
SHA512a1a49721d1ada088bcf71d7ce89898c98c0da6247d8b836d216cacfa92628551cc9dc881da7fa1fd6100eba27a79ea6efb5e5a186b531bbc1d2dee06fce9e43c
-
Filesize
1.4MB
MD58a00694af47b7a09e617466ff39ab54b
SHA116cbcb282c2353e4f751e051c603e0578b937473
SHA256fcc14b8e12919c146714bf086b60e2736959b30ac9129e80be5927b0037afe93
SHA512b91c6bc86d0be3ce3d8950be4f08d5e5eba3c2200ec4ac6caa62a54208a2e2fca304f29c7f90e6a7203531e13ba2a4d2fe7eabefc3141dd2db720c19ed25c001
-
Filesize
1.4MB
MD57fcd22775e6a455a0786e279aa3df77d
SHA1f34c7ea014957799121fcfbbb925a98855c1b79c
SHA25639a90eccc7c25ec5a96fc3c7f1ac846c26de2f5c379c23a4710f6be93b5ca4e6
SHA5126211e6f3b5b04874ec1821f8e4865432bba58041e500e4ac4b5e0f632b86eb81739ad88faf17ecd2ed0fa7bdc3cad34c64da4f28ca5c6e16c9d4760073fa74e2
-
Filesize
1.4MB
MD5969dedb77ef0e29a835d6bc44fc312ca
SHA1d78b5bd88aca61cc4cd20d7d07a89aea659e083b
SHA2562dfab9ab09d169adfcb1dcd46b9e7b940d6a8d94128646d6afe495d829932f34
SHA51205c2ea79a5f048fb959fab7b129b559a6fd722683cc3430990c7b77d0ee1ae7b78ed2af4ca1813dc64b6e3fb6abc1d8fa265647e259016b6fe8d53298e200d4e
-
Filesize
1.4MB
MD5941f44121dc02f2b3e9ee57be1037ac3
SHA15ff4a123d1f7a62340ade261fd38922653fa5e5e
SHA2569d732d56a2231fafd5c33b38a7f0cc7936c349d0c780d431f3bc303d4ad43b95
SHA51272e265f2b75941968d07e8dafb4c1a33bafa9e20a9603fce1adb45452c58055621b0a1cc9ac6c4e95c4f7ac6e825b9219d6757926e1fd1da706b5e3d6b360c80
-
Filesize
1.4MB
MD54559b88781e2c55c59870cce0b2c57dc
SHA16dda9812709d646e6a788ec0fa3113c86fe6042b
SHA2561d79283ca477c9db29cda36e4e2f302234101682a83addcf6d8fefad5773cae6
SHA51259b8f3923bef7495606058a04f1d98a34dcd57b11faed007a44f598a519d7ec34351d4dbe6fc93b96cad6ca463ae297a1fc22f0fc876e4f2f320df32b5f6d66e
-
Filesize
1.4MB
MD5265de1d5706311a51435cd56b22430fd
SHA1fb4de5f7e0a149c6af3e26778f6691c35200e0c2
SHA256d77aaf684b8913471a19af8bd11071b3f63cbc51ef4e42edd7c5290f2c321f74
SHA51226c335bfc0e01b71efa156c91507bb06ce3a223cc0a87eb4284c567638f9570cae6f6d86a9def9d90d60e52ad932f49bf5215d5f12ca34583558708021f33df5
-
Filesize
1.4MB
MD5fbed0524b6389550b728e1564b8fbfcc
SHA1f5928c36d742738face804ff82fb1ddec788dd81
SHA256f6d80b45045d3a0e0adb9dd6b2ae884cde7b60a6826d34cf54e9e8fbb18680ca
SHA512f1f43c43f785225aee3a2299f36248b2d4222683a38126c28cdac5a0a94fafb559748d8e738b925a675986d22be173692e50003dc228dad758ba2cdb95483145
-
Filesize
1.4MB
MD56f4c4612dde3296a4221ff8d5994770b
SHA107a62379204e2ed4f542b2fb2ce37a4ef6486bb0
SHA2562dbcb66d53030ded575871394d2e8e70b5d9951cbab981953460e740fa1aadce
SHA51230f37458507a47ac2f32fabc7d7befb21b7580bd90433d5fdccd764471a9647538ab6d9e46afe3f7d9860987baa521aa1dddf1694d539dc4ec845b8bc00f0b41
-
Filesize
1.4MB
MD5943606d71397424b10ac749a3964482d
SHA124a9fa78a4ff8345de2877b4e260daed461db385
SHA2563487fdb5ecd50ff2d488f9316f9e9eb55224bfd6abb389fe6e5b57c415cb4306
SHA512fa2e40479457a902d8844e19eb4625a055316eb14df8d1c302c4b9b0a806ac5204e72a28e3c4792f25047b34d8b5de0d47ef3ab5c4fa799e0f443d45b0fb3ddd
-
Filesize
1.4MB
MD583f82aed883dc2f223a6745ce68414ca
SHA18e0515552dfb70049fe2c6ba6cd9886b202a5b73
SHA256e0212c9c700f865eb4b810b86f9924c019da278d56a6d44388d62557c591b440
SHA5123791751463205fedfe7f78dc32347f92f1ddf4082674e10989cd3a8a5ae75b590927f19e7b4fa292ab5d746a2020de0b5dc5fafd084554ee1980f15196f67cd7
-
Filesize
1.4MB
MD59b9100ecbc27832c624fae96039a673b
SHA112daa4a45b0f11717dcbd8a970388aca977f22d2
SHA256b53fb59ffa13bd040eed31fbe79f603d689ab46696d3d738ca3b64e60495f7fd
SHA5123c8a029f11f501540ab88c7e2738806de1d760c11ac61d8630d6094a01af00eb518cd2f283845fbb820ea7c602478e48ceb8f5d508e4e34aeb991f7a97949228
-
Filesize
1.4MB
MD55d413eba8bd975e4c12909935f18de9c
SHA1db99c6decda637dd0abdca93c41df784ada2283d
SHA25618f56dee489183baa89bfec48214b65d4b8cfadad580599a66f7099755799bf1
SHA5123159447ae1f383d409a3a63c04abc298b79fb989e8316bb410f58ea10d144ab7b8439d9e883b9c38e39b42d5dc7af18001e0e7071c101d0f7d467592236a38c4
-
Filesize
1.4MB
MD54aeb5fca0b9d5588294049cd0df556a4
SHA1674ba80655597047710036556582c324453b744e
SHA256764af117d5857f8a45fa4e66099ae2fd2aeb8ce9edcb573684284d04ced9bf1e
SHA512459a502b435d45f7b441ad6b75600ab96234c27977cf9c2249b0cafa3c51afd22bc8ace4deb035f139882f29511b8a9630479fe7bb677e25972d37ca46e89b77
-
Filesize
1.4MB
MD530ac04d02e9622b00c576d1a3b794914
SHA149d7a3e497bbb3b50f5b5447c469c955d342ad5d
SHA2565d4f4e0f09df8b4b504cca991e111018be74040dd94ab12c23bd31fd9eeae8f6
SHA51213c6c72d91069431bdb379191566aef5c65cf6a9b7bcaaaf1a75da6d6a4d23bbc91cdb870804f38b409071829d686de16214e5833baf9015cce094b2f5b18061
-
Filesize
1.4MB
MD504fe041d60057fd59e09eed1d221f0e8
SHA162f786f556ddc9c38d4387902028e520597e7f80
SHA25652ef3a6789de0728f41132308bba4a1c08c7744b38b043a9c0fbf5b9f2e3c482
SHA5122f0962f1286d641746ec8003395374cd72dbaad401e0e8713e5df666f4182c6567980c0a451a181fca7f27a053f21add28e75e56e9b54654808e2ef5c6a90887
-
Filesize
1.4MB
MD5a0ede2aada92bab55a9f812fceeb3360
SHA1f77a221e64b83fc4d5bcb9716d8cd5b7c80dbb1a
SHA25651dbd02ab7b1b2fa2d72b1b11c4cd7f064891920b494f48a52ddb7c7555e542a
SHA512a6a9786335adc7e3a9c96d0ba5388f2ff35da04be3fcd08ede614af89f4a4258a5ef490d795106308273b70ee1e58278a8a80573b419e704df1020cd34d33493
-
Filesize
1.6MB
MD56796a57236e61e555aba0746fb993f79
SHA1eb0dc2499eb63107c767a2c13d8abf068f78ec95
SHA2567d11fb3e48d57e7d92e6c186b93af91de640ba76de4ec56b14aac5d70f5dbdc3
SHA512bc026e360b8f835e927da8c5bddc2b2c9cc2a7bf055cba26b2014accd74271e33164f396fc73bda899c4227d39cdbd335215af984753d2ee2ccc7e6835bec392
-
Filesize
1.5MB
MD56d79a80ce52aab9f5851215475ab61d5
SHA1edfcdbaadc1b2b218a65a100eef6880744d714bb
SHA256f8b6ddeb2cbaf86440c4965e6dc83c4f7b36f6ab886e008b5697fb130d9661da
SHA5128cf6d18a084c676fde7cebb16aa1b2be0413ea488c7382cc7c7f9b5217f3c31a89e03fcb79292d105b108729b731d687988a908e908b3cb5c21e57ec778b9570
-
Filesize
1.2MB
MD5d000fab5c153d79c75c4a8026af84cfe
SHA1dd3b1e99cda889c7db8a3679040b3f6276423bbe
SHA256e57392bd0229519a704e0394f40fc5ac3b66c91be82456c2b452f700b5684aa3
SHA512db76ccf4d91fe6418db7cb783c52a45048d60b6fe2f3b90bf4a40a55a45db18f3d9898faa77066d9caa68c35ebf3ca1baba0fb5ef8bb232010c885c7e351e4ae
-
Filesize
1.5MB
MD57141c4dfa8e1649dab3090a0dcd30170
SHA1665adfa5d7ee1bde9e70d6b73cf9b7488a1fbc04
SHA2565f445e4faf8ca2f124e886cedcb9178ff72c939048e624f0380fae005bb637ce
SHA5122eafede4f934a72ef18729a6b0bede5f18af0f6332e9a3789d1d4228d845a62962471c04f12b5d050a765a6da7f6b4b75df89de6f66665d2dd352c17aa6cac37
-
Filesize
1.3MB
MD54c38f1cd5fba9e978395106aff198aa2
SHA14da2243cbb70dc551cd1cb5b4085e68da4f780cd
SHA2562f6f0b3d256dd0dbcd52f273c4af2cdfbe6cc6b04128b07e251eb9b975fbaaae
SHA51210336a95c011f0c95ca6a9eab2ed7254c166826b9a9a84054220c0e34c1201bb5cf6c6d50c32c4690b5a96509847f28e18705138b9431c05a22110cdcec67dda