Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
11/07/2024, 03:03
Static task
static1
Behavioral task
behavioral1
Sample
a01e16dfe72cb9c91de7011208cb0a16b7b2cb331fcc4583753c239cad6abdc6.exe
Resource
win7-20240708-en
General
-
Target
a01e16dfe72cb9c91de7011208cb0a16b7b2cb331fcc4583753c239cad6abdc6.exe
-
Size
1.4MB
-
MD5
bd367eb2741334f2abb96e5d7be1fcbd
-
SHA1
8e147238e994926fa02a5b4c927578293a571ed4
-
SHA256
a01e16dfe72cb9c91de7011208cb0a16b7b2cb331fcc4583753c239cad6abdc6
-
SHA512
a9d351bb4259a9e07f12243dbd5e184a5c92767bf6bdf1c7aa9e2d3e769c35d606beba2ed2c3cc252f15f7317ae79997f137dca02d410b8f44e1a9716c79fec1
-
SSDEEP
24576:HU3zv/TaTeatr0zAiX90z/F0jsFB3SQk:HUDnT9aB0zj0yjoB2
Malware Config
Signatures
-
Executes dropped EXE 6 IoCs
pid Process 5056 alg.exe 1700 DiagnosticsHub.StandardCollector.Service.exe 1276 fxssvc.exe 3304 elevation_service.exe 5008 maintenanceservice.exe 2220 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 11 IoCs
description ioc Process File opened for modification C:\Windows\System32\alg.exe a01e16dfe72cb9c91de7011208cb0a16b7b2cb331fcc4583753c239cad6abdc6.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe a01e16dfe72cb9c91de7011208cb0a16b7b2cb331fcc4583753c239cad6abdc6.exe File opened for modification C:\Windows\system32\fxssvc.exe a01e16dfe72cb9c91de7011208cb0a16b7b2cb331fcc4583753c239cad6abdc6.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\d7cabe6390c504c9.bin alg.exe File opened for modification C:\Windows\system32\AppVClient.exe a01e16dfe72cb9c91de7011208cb0a16b7b2cb331fcc4583753c239cad6abdc6.exe File opened for modification C:\Windows\system32\dllhost.exe a01e16dfe72cb9c91de7011208cb0a16b7b2cb331fcc4583753c239cad6abdc6.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7z.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.106\Installer\chrmstp.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe a01e16dfe72cb9c91de7011208cb0a16b7b2cb331fcc4583753c239cad6abdc6.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{81C44847-CFD4-4467-BC43-4620F6C2BDBD}\chrome_installer.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe a01e16dfe72cb9c91de7011208cb0a16b7b2cb331fcc4583753c239cad6abdc6.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1700 DiagnosticsHub.StandardCollector.Service.exe 1700 DiagnosticsHub.StandardCollector.Service.exe 1700 DiagnosticsHub.StandardCollector.Service.exe 1700 DiagnosticsHub.StandardCollector.Service.exe 1700 DiagnosticsHub.StandardCollector.Service.exe 1700 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 660 Process not Found 660 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4732 a01e16dfe72cb9c91de7011208cb0a16b7b2cb331fcc4583753c239cad6abdc6.exe Token: SeAuditPrivilege 1276 fxssvc.exe Token: SeDebugPrivilege 5056 alg.exe Token: SeDebugPrivilege 5056 alg.exe Token: SeDebugPrivilege 5056 alg.exe Token: SeDebugPrivilege 1700 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a01e16dfe72cb9c91de7011208cb0a16b7b2cb331fcc4583753c239cad6abdc6.exe"C:\Users\Admin\AppData\Local\Temp\a01e16dfe72cb9c91de7011208cb0a16b7b2cb331fcc4583753c239cad6abdc6.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4732
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5056
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1700
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:3528
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1276
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3304
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:5008
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2220
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD502bab04384a88054e2e0dbcb84a30f27
SHA1525f04f731741074bf08eeaaa917bbf61de33d38
SHA25621fbce47f7d3b63d7752f4f1aed7d5f95dc7867ba2f370b3697fa4bb5e0f38b0
SHA5122d2d902e449e24b9e075a2e01d03c296c47f3733b50d5050050f7ccc33b4ff4f8b8bf9d7695a4cbe532608b4cf2f2a13ea519f3d1cb24c6aa1465042bf1abea8
-
Filesize
1.4MB
MD589c0bcc8dbfed2764ab1345afa77ccb7
SHA11f3d55e48028368caa16fe9a7e9266d7875d57d3
SHA25680322e2b06add57e923c6c51064f60e504e788a2d4bf59fd83dd9186c083f685
SHA5122d780a6cb181ea03d6963721fea0d879107357fd18b21dda148eb51a103c039e8670ab4a37f04e37246ba45ec6ea36153a90323a8546fbd93b721252dbe679d2
-
Filesize
1.7MB
MD56c37905207a1b83f59b65cb4f6fe3dfd
SHA16e1b56ee2ffc205cca73bb220ce60e005016ab38
SHA256988b5232ab8e20265902a3d3bba5b3f2c4ae34d7f2f6307a887f5f85f9ac7f77
SHA512af25aa8def13f0a1c0991a41063af130504c5265744f7499da31e6e38e9910640b319eaa58ebbad287412eb0cec58d65fb2b49cc63f1b2a3191b24b9cf03d47c
-
Filesize
1.5MB
MD5e26a949022e665c30e36ccd966e33ab4
SHA18ee05b35ae853cb84d8fa7e2aa8c8d0ef1f0573f
SHA2560ec1116703760f97b5bf45e7aa49fcd5ab55d0aa8f93f249d15294448405fcfc
SHA51259f5c0494d5a7de6ebc004f902fb756951d20e0b14e9a1057ce1676fcdb81d986932f1da860231ff2baf8fa4980a7edfa76ced1f199954b94e51319a63957161
-
Filesize
1.2MB
MD5e31ade4eb402a78bd8dfa4c0e6cbf024
SHA1a5a1dd0aacee5d4592f6b90e6bc21a83bd1ec448
SHA256d026d9efe6cf0cf914a795642cab7e8c5b693494da1ec5001e1f4202bedb4c42
SHA51258b8330729ed0545892c1ea57801910a84a8d4b3f974c21dc09a312afffcea0ad0226b1eb73d008c386f79e77393a98849c72cca7ebf8f01c852050526d31c9e
-
Filesize
1.2MB
MD5445469de42938a8066d3da2caa91c5bc
SHA1d5a78f9b9dcbf977acd753b7a6ba5d7404f50803
SHA2561d2992d4b7ffb15ef406c9dbd13bbbfd9f0fd37c0948c2e1b8bf65c383216d4b
SHA51245f28364a8918752188cb291817b5463cd8b0bbed41a1e976d139e2307c8ed4d554cc77e39cbeea6e98da8e276814f1d90c4e2053f59dd677ad3d179115de5b6
-
Filesize
1.4MB
MD5d95d6238e813070365c34801a67b21d3
SHA1d84360ddf76189677e12bc374eedc5821e0c2be7
SHA2567e79ad3528fc2d0e17d0b49a36ee495f2c9d8212f455470654bebe21d7c653c5
SHA5120cfe385cae5d2ca7dbdd85f07ba03468d96ce62920a107dd3d9f3919d4b57612517f0f1be558f997eae3b1d17ba16d726204a35e0e9d17e64eca530646f48717
-
Filesize
4.6MB
MD5c004856eb00a5b66fbbd5a86467cb8e9
SHA1e7b6b4fe706ff6a669c9d0d30fd0f6c254143857
SHA256f499e7bdb5315e43806b7b55ee27cc919e1d8f56a2939263bb8b398faa5d14c7
SHA51238b49c3a3b78dc0f6371741c37d133df7dc9752f71a47ac247f1bcd2dfaa854b9efd81d6a9336d8a994e98e79c8188056d90871b6beb1aa283bbc389e60c241f
-
Filesize
1.5MB
MD579797d1eee10fc2b202370ed877db74b
SHA127b1fe0e58ea3f4d1eb6f9e060c45483390fb589
SHA2560b4dac7b5ba41f44202d71dda2df4cbd2a1bc4b193554646856abab2a1889dd8
SHA5121d55dbed9d5b713ba343aae87c64059f13dc374df948f96329e5ff616e1aa90d63b2c3d9813590f4a97784e506a4f91241b046445ba7848bdac22fbd37b75d28
-
Filesize
24.0MB
MD5be92cd56ce6bb77814242b285ca343b2
SHA1adffbfc6386c7e47f7c4f9f9d09b7f2fa1f7b93a
SHA2569c5df1b6707a9af28214122cdd596d2fe74986be77f433b33479a208d1a4a2d9
SHA512d9ca2b30eee3cbfb0cfbcc5064d85075b775a7170c87bbccb10b52abd5fce3221bce9dc58534f08aebcef90b5f091a91e820bed10e07497f2ebb591eed0debff
-
Filesize
2.7MB
MD55c350ed1f6df6cbf09f382314e1f7e22
SHA1adcd80c2f2adb413564c1161abf031811aedf9e3
SHA2569f03a829d66c68d60b9cb861919ae996805d2afbb7d9fd4ba6bb074908b4fe85
SHA512837600ea86cdcc28b9f658695c920940c01c50a9ebea07fabe0a7965c9c6016ea5afd0e407a41ea0234158c857936ceba4e24a58f9a50ee0b3b83b9eab12d75d
-
Filesize
1.1MB
MD584fc4f4e2b35338296330eb2f766cb31
SHA17f3b195a7f294e92267a859eab93b2d7401722ad
SHA256600f6ff5ba02b33751ad1e27fec5fc86a05d55b5685500162783d43c8a8e8c9f
SHA5123904c3ae16637cdc22d303979b431bf82eca1d1acb17fe4dd27b9c641774bb1b2e9b13d0ed469597a38294307fcfc80b80a3050e7b16f2cac1558bf5458fa379
-
Filesize
1.4MB
MD5ede16c6301969f6fd0e831174b3b5ad0
SHA1e87d5eb41fc9981e605b3c660d13df22d12d8614
SHA2569e33d0500bb62cd6ba19d1010bf989b00178b0d0cfe1866c6d7e566f35c0b560
SHA512249af9d0db2537eb630eefcd682c8977a7c1fa01b439948b9be0131903b517ba1c3abfb70132e1bf05fd247e010000e1276e0fe7470da6962a0fdb51e833e2c0
-
Filesize
1.3MB
MD523dc91911b24f3303eeec0a0a994a795
SHA1b6a289aac03cb6c891f298cc7c1d068d87aef460
SHA2569b68e897677f79fc1312d3a9b2d1ab53f0ff04054328d39300cfc9e92d7a3c88
SHA5121f14ad486a1a90d8af88ce7d19064cf78ab8295c2461cf1513f006c08e0202cbc17f1c3e0a3da12890284e45f80398909ad739c884fde70be8934510b01f881c
-
Filesize
4.6MB
MD5225d89fcc67efd434d6f42b206d861d4
SHA14b3c7b25653066fe21be849d4eae735a12acd5c0
SHA2568525387ab9de74c226a854a674091402497375c3e9f09aaf4900ef3a382c252f
SHA51255f891237dc65acf3a52c8f355c6f18fced51c118f614fa04a36fdf8ba0d5339f2424309b9bab89b5ad6c68705338170eb0c7f7166691727c8a066f8823692d1
-
Filesize
4.6MB
MD56ae0d559f5b08a5a726c86eb1ae97431
SHA171e718b1b8a91640f8b3035b302cccab5ad39d26
SHA25682f23ece83d45f466bc3b54e56186311e4823d48bfaae7e53b5f2a399ade301d
SHA512e9400a97ac6946282f21b7d2fb72ada666881e8a0531e2bc30ab0fbeaec39929d2afeafc46f677bf2f44d780d78d66bafc899ae2c507def0c3859ea85af19061
-
Filesize
1.9MB
MD54e60d930801a70935552a3e5ec1b4fe5
SHA16d08edbd0f3ebeb49b1501b2496f8188a8fcbdaa
SHA256510e511f060a4b01781016aeaf903720bb698fa80de54770072b391f44a7dee4
SHA512bc5f8ba03fd7ea0ffe3d382e7baad10dbf063ce2e5a4d957df330cdf55e50e981e37b2d344c3442adcf9051ba639a0b5f28c3f46c68f55d8ef8888a17caa39f4
-
Filesize
2.1MB
MD56eacf0250c5cb81dbc25267d576f7292
SHA1cce06be7cc4dc4dfb21fcde44d7cbfbda2f5e9d7
SHA256f0b5a0f7569c823bcda2a4840819e944292ee722fe11f729bf407e7ab69226b0
SHA512acbbd65355fbc3c1777c105a154e161681bfb0f3f9ed961a840017d2dc21a5b94eb2eb84f08d9cf0d12ab8a4fc0a81851e8df072c416179ea3eaa355b4f9af83
-
Filesize
1.8MB
MD51708589571bd3d729570eae01c6970eb
SHA1e6cb52450f516fa74ac0761aea082187f15a64c2
SHA2561fe6f495dc69442fe52f174e735efb2c45492e84a81509b9a1a00cf9c2bc1aa8
SHA512e253043279d8eccb42b6cf43be0a4113b00843c0b98686ba9d93a7cf6194a3ef3fd19acdce1fb6520be063189dbe7e376928340255ac268b9f5703f39417b151
-
Filesize
1.6MB
MD5261d75b4c3d84889e8b9ab4aff30493b
SHA1c004e1fb6ba8af71ae3dd57eac8ab09fefebcfa3
SHA256b2a9815760e490d0833631e1873a0b1994944ea3b56ea3e03b23bddb88af9093
SHA5120cd6a1542fee1aef41997421dd6d2d531dd30896f3d50b00a912ff04becd642cbe89274a52c26ef68d7ca83d9eb5a4c3b931ba2d0758197982d0f44fd4400128
-
Filesize
1.2MB
MD5f4e6b5647934780dd1f731dbb193d54c
SHA15a73b298faa87a6404f3f15dcbe2f9c4a1e68ea1
SHA2563597520d224d44a80422919cf47c1ad63edfffd73a46476a2618f206224cfe3f
SHA5121a11b7649339427652f32a3473669aefa17c6c754da554d09c6a05d05f0cdbcd989ff302585d0b2bc5df1a1f451bd82551e63e7c26b2ae1db3ce8d3d277ccca1
-
Filesize
1.2MB
MD5f0abe7f74535b44774609cb8d4822af3
SHA1e63daebeaa33a9adf4cd427fca77239244ef9557
SHA2567d806d8415bca7c1c9048d65335bca6e7c76b55d3ebd6c9c2a62679553fead89
SHA512d58d310d8603f62a04d14c70271719e8c7ef10d4ecd529c314b4e600df1a98b6785550d717641a78c5045da6c14e92f079741f6b10ca395c47cca1e32f6c3057
-
Filesize
1.2MB
MD5aab4cb72170de8e564ffa65341a52c4a
SHA17bc41cc585a706ca6c8ec7ec59a4266399afaa8c
SHA2560f36efabfbac1f7afe7c3c748792ddc60050e65fdacbe04a7570e85e64a7362c
SHA51216e54080be3c3057b1be362840cfbf221b0c24c0d26ee4954def19244c28e815ecf1557679433e90436864d21caa6c45a67acf5a8fa156ad65ad84e805c219e4
-
Filesize
1.2MB
MD5c4241b20df04b190505d25881f8d83e2
SHA128b502ea61a179451d91366e8aac4c0cc48c0287
SHA2562460f41c2fd0aea3ddae07bdae8b99c2ad446d3a665d4eda1d8be8ad41b3dbe2
SHA5121b4f26d1b7bda81778b13376ac98f984dded2a57da41085f10eff8f83c2ed651b79e2364c526f38d0945ad5eee23178db467f0433fccaaddd4af1ab2d1516959
-
Filesize
1.2MB
MD5eec233e5efee3342060a0c8e9d3c825b
SHA1fdfd09195004497a7960ba6c5973e90845580b43
SHA2566a98f97a8062f43e7ede509c08c84e3962d9224c700d35552cc36936d849098a
SHA512f6243f5fdd8040a72ce9c73dc96eebbb94908495f46cadf6bca07a1b9dc20eb3a531ba39edd8745290c16c3c764424b35b7dcbcc77832064b6a39753ec689fe7
-
Filesize
1.2MB
MD51cd6f02450927830c580b49d2c608456
SHA1ca0517eb579123e72089f9060795b0c8274228e0
SHA25627aa00ec17cafbcf3df7aa23df7850cefef20b00ad596ea83612946f39f0b212
SHA512bfff28a9cf7820a8d125a562f8ad782a803c986a733658e5e7603f76cb7564d7009f55dd96e2b27e7e02d33fe7aa7982fcac5f43d3a0bec8384645a8f1974ed9
-
Filesize
1.2MB
MD5e5c0f285eac121a46280ebd6e2768c58
SHA1d2ffd16a2df40551f3cc29e62d75b64be9a639c2
SHA2564c33a7d8eb4f6c935f44e0980ca41d78fec120ef62abf13d16ba6f9454ab7580
SHA51263c000abed19b72c6de8c3e5283da2b28f3cf86479b8bdceb98a05f7ce5fac6fe6fb7b434f6168adf586aff81954b9e14fe52ca4f1a25171e2727938bc5692ec
-
Filesize
1.5MB
MD5390df8741245b7d7e207dce0137a7b3e
SHA1097224f6eb44667df22971acafb02c882db66101
SHA256b78793cfab2cdd9dca4eea3448199faf4603ee2c07322b7ea35d814a08a83b6a
SHA51227d9a4c0e57f1914cf5e6211e790da366aca79f535c9d1d1e54d020fd8dc9b6b953989588e3f71ad5f0a168cab9641cca6782c2e097d824f41cb27d5b8d62f79
-
Filesize
1.2MB
MD530a7cc483ba2a3f6e613e13ffa9320a5
SHA1026b7fdf00bfb14c7f64ef485810d1bf64700d61
SHA25611794015b2e6315c0e449165e3d3971f38dcc02497aa82631cefc15fc7ca3e7a
SHA5121e0bc7892ae0771917f248eeea92506635ae69e9816e2d8da459fa4bc8a19b55151f647f6e9734701ad170151cc69d366a531183f655cdab6c809c4ba4c7e2f7
-
Filesize
1.2MB
MD53a828370a960e3b4c1458170ca52810f
SHA16c5c2e6c53b3174c60864c10a26c5183a7705197
SHA2561ba3344c1e4b8d1a09e75a67f2cc81d990c934cab844f794db144442c0d6f181
SHA51268b93afec9370dfbc390bfb42bf4c1983c97897b7f29c4a562f9976e61c3d337735473f0a9960ac8ec4faaf14b69a73c1d2cc0466419cdc98f64da42edc52f8b
-
Filesize
1.3MB
MD557b07995a1e5bb7772ee759426f58871
SHA126a9d8a4f434027f62393185be401dfba9c3461b
SHA256de9a02746102e9599f974475eaccdee1145a21895562d8b2ce25d258cf75a27f
SHA5123219d3714949b129f5fc202672505bde1bbd759aa4d267bb6aae3ac298cdfc231051c2265f91d16edc94d4809811ab804e15d328d598628430201ae8912ffcad
-
Filesize
1.2MB
MD530ad4c2a362b753262c9a8f0f7eda959
SHA1e96682ac4f2e83a8901a841df70be8cb8472b65f
SHA25643e823fb2bc7e4a8b03eac83273e9c60085b6fa4d7a2872885720ef164ed9887
SHA512f298a832c95275eb54e6a7a5b4160b40ed6b3202d1e96259c0e37209981198095511cdb0919e23c9d3b48a0b409640b599c10a84f32aa8d71e8ccd8b1c9df67e
-
Filesize
1.2MB
MD5cf6fee0ee4cb09b543729773f8b3277e
SHA1e894bccd8668a2977bd4dad3795305acd1de9124
SHA2562ce7a74e18cdb294db7d508c7741f7f0bbbec4534660fea63563585f7baeeb80
SHA51221ac7282f66392f662d7d1eb7979974018629356c0da611250903d4513cd8353f6e38fd2ea40a646c8811dad243e5b5eda64c99711c9ab308b746a5c47dd7e9d
-
Filesize
1.3MB
MD540c38021f81c2913a7f378851b6fec1f
SHA1c3cc067c6c48dbb5bb88135cd3bf99dc3a6aadd0
SHA256f173319bc193430da831dd350568242e982c2b1fae27c5a2d2718ad558d413dc
SHA512ba90af31e4eeda0e4b1494f4b0e1a7c425e4a6833234c03ffa9c1bfa5122171f3700d0d5a89159887a0c2bceca241799a29f965decda3ceef29cd7af9dc529b5
-
Filesize
1.5MB
MD5d23e58e071a1c319f56f1afcdd959e20
SHA100240d9b9946365ba0c152a6294244f356479da9
SHA2568759b2505cb5363991a0f5e59d93bea50db2fa1a482f4465f3511de30ff3b8c8
SHA512c13ae355bed2e7ab01e42d9da5f3d509c80b6720ba30d545afd4d9662b2dbd1edfe0b5e5a2892b1ad6ef6e67f2dbba758186651a3f58960e6ca586454f8239c5
-
Filesize
1.6MB
MD5edc4f21c0827fffbd66df0b611ffa5e6
SHA19b4db6a2f3f5b2b2d34f425c0e1e2b8aaf5cf0f8
SHA25671da1606dc21164e9c778dfb663344b8bb255f3bcec7d33309a5695a574b572c
SHA51247e8cf5e9c1f1d6233db731a535ab850fb85d1987197fdf4c22d7a80aadba92bf4882aa7b9a118382e3394c6517da72f385e6470d06855d187d46ac5956c79bb
-
Filesize
1.2MB
MD5a19831dd43be7d452f9e0ad750e30d4e
SHA1ca2ae5ba4a15bcebaa1a963d0026aded94315277
SHA256ab9ef535826e2033b538c6463c8b9fd2cc148cd0e098ea2e533ef075d356b7bd
SHA512b11451fd13382c2179e57dbda717e35a9a9028455d82cfd59e2ffaf90bf6245de98dccd2788f3a86feb6bddb7ac8caf4b2bd6c8621fafc505af73685a2c46f91
-
Filesize
1.2MB
MD55bc76e40e082fdfdd4146d0ef6327b0f
SHA1484c92a2e79c48a68ca4a0215dd6ad000597dd5e
SHA256513f2aff6156a8c36626d58b43fb11585b318fbbb0d45de7df422546a78b9c4e
SHA512afb987e19ea4520d4caadbbd5a5597e0475726eb24994a1da1634db9e0fada74d7b7ffe526703a5277e5f31907249f49a38787bf4c4d9491eaeb1b11f10da6af
-
Filesize
1.2MB
MD5ac95c8b90f087d5c86c640e9a7f7780e
SHA1bff016163c60188f0d257b394fdd75313565c2f6
SHA2563ea0b34db1b53799648711f3f354ab97a4d444d82dc58fc7c3904aed62b695af
SHA5129faf0cf93eb623e78175e41a4448d28fed739ff615b1eb814e6c35f4a932abee1a11995cda0927cd2f323580687221ede21c0b4cecd3a39de364c35d77d584c8
-
Filesize
1.2MB
MD521f8619b6aa8b66e183d0611ed90d99d
SHA18841062c6a9ccf845cb86a1d43ffbddddb0480b8
SHA25678b9a3cb298c6520246e85a36c6691884bbc24daa24fc30a3399913c15f5f306
SHA512e04c2fefd26a0a9faf919a70e8741cee235b776b82d29216c0633f428ae0196c9281f6c7c43e9ff47a1bbe797b39d1fec977620a10a7c687d71bc4f96c22b3bd
-
Filesize
1.2MB
MD5cc148c7e02ea95ea24ff315bc920834c
SHA118b1205d0c30bdeb6dd915058a2f898c9415c144
SHA256e153ac2959f2c274f3fc4419b38925b6219c6b1f0b8687f0747a19fabfd9a7fc
SHA51299e67969ccb97df93c8d0d7ab7ee7c3d3622846728be59af95bb1b8563d4cbaa270cd629975f9d1fa9506c9166d37fd9efc4fc2c9eccdd0cc4c9452526e8ed6b
-
Filesize
1.2MB
MD501105b0cbfed4566afb07a511a1b4b26
SHA14f165cbd6c0f87c45d83eb1f9319d4ac1a7b9522
SHA256afce238951688ae9e0f5fa57d67a9eb1af7c39f5a605e3c469978a5a93b76183
SHA5121151861ff3abb7cd46bf9fe14907a9e04797093f40d812a469edcc759bf96eb1e9242aed69cf0936bb5b92f381a88b4b4116d793e612277844e8e6cab28382da
-
Filesize
1.2MB
MD5118e50f136a71e5f40a3d34d458b61e7
SHA1a16c434d8e5fb9e27d4ad07837437ade1c22c8a2
SHA2569bd35c592d44c2c732a6046b494c5118474ed9b8deabfbbcece4680708f0d228
SHA512029f243bd961c5ef257f44192d7776f36e101ed1dc6d1ace9c8319b0e2b4f51669383ad050b05d7f631e20afe425450cb4218d406e6b1ad02a1d0e6895d28716
-
Filesize
1.2MB
MD507099458c96505403ccbca0ac2c5ebbc
SHA187b78d7e6d579d2cb3764db14ad0d4dab8eef147
SHA256f142a4ba32d5f7815cf111f3817b1aa48233aeec62fba9b8dcdd88456e55348d
SHA512c44060c320e7fd0c6119071d15634441e384ac6d7abec6bd24f8c4d93a00a595f03b9b5208e2f7fcf7b5b3ef1605a37efc41058f10e5eb6c62b5c72ce62121e1
-
Filesize
1.2MB
MD5de00f6b96f30110e404ae508f2506e37
SHA19d2b5eb8770579555c97f211b5188eb10e1dde7f
SHA2566229f96005ce1c4198fac0f906861e993052358233346175b14602ce6d911465
SHA5125bf9a2272c886ab13d53505f813e6e95f098dfb7efe74bd5e0d6428dbda43d8cc60f84dd08daa25490bcd3d1ea170359d6b98826198bca1b186c1a0bc99dd4a5
-
Filesize
1.2MB
MD59d07c0423688f1dcba19d0b453ed611c
SHA15e113b6a9884cf5570200a74d19e43b1fedcdc41
SHA256b4015c80974dce7efee6394638bcfbe43445509f27a25382e32ae288476d851c
SHA5122b4aa2fc29b9c690ee5c12c8ddadbc566fb20c596f1fe7f3b477023d5900fbdec6c1c6a5c75cbeb66b96fbd0eeffe342e8376c9e480835a6509c9ba81b2635c3
-
Filesize
1.2MB
MD574d459be3552912c560ba01656083aed
SHA14843fa5607f1a95126d01a2051c351b64727ccc9
SHA2566b62fa680940b4ccbc968a81a0bccc1c9c343ca71088748ce8ff51e208475b67
SHA51276ad38f882cb4a85b38783984eef11ffcce48f62c85146540181b9d311fabc45f612919a706c2777eb5c532cc87c6833b8f0af668a8cb461b48623e90abcc310
-
Filesize
1.2MB
MD588d95df90e3a18fbc3262d71ba60c1a3
SHA1de7a027c1d23e8696fddaf5469d6ae20c11ccc12
SHA256aba5ad4cb3f0033e117ce500d4f94a2a1ba78923171cfc93654250731bde7ce0
SHA512fddc8e398bd7478d246079579f55eb671df52a9ec93a06a5552a52b1f786efadc9bd387513e676c1390dbdf03b3dfed5d5f0068e29f011b59f7f617ca0168e30
-
Filesize
1.2MB
MD532d5dfc6321678ddb62c6bd814c3d4d7
SHA17cbc132de93bb10ef958bda8fb13d0bcd8f97bc7
SHA25618eea9b17945a922a049afdbbdba1acf1558556ff7b41e9ab1d8d91429971bbf
SHA512460b4a78513eed57acfe09c7eb3b00d314cef8b84d3ae46f33a9550dde0cf11a14d69d218ed68fa1e6e709d4ff2ffc06c41388eb68df9823373f76ffa8e0cae8
-
Filesize
1.2MB
MD5d059cb4b706b12f12126e8f043da683e
SHA1b8e45df6a6d9125ad642cf045dc9efea3795a0f7
SHA2568b4818b28663ddc0a1645bb417b5f21da35f135f0e8792db6d0c11a11c8eaee7
SHA51231d0da6253715d31a72f6ce98a0042a70278c705ccab44dac2dbdaea06f1a285dd7b85ee906daa45ec817410d8f2c6211e7a55641938b928cf0d255cbb115cb9
-
Filesize
1.2MB
MD5e1f4c14457f2f197683d52be97632ea1
SHA165d11ac844fd893ee827676e4054cff1bd277e01
SHA25697f6c9a4a8409da59d89f5826122a941cf99e3747f67d462a3b643f2ff2a2e50
SHA51244351c5787c40a782b67570e94b92558c12a401ef8baa9143b95108566c4947e14eaa74caa882cb758123e3460c68f6e6f345e18a903e6743dce45c7a14e5a46
-
Filesize
1.2MB
MD5dcec895feeadb3b6a7a5f482fd6030f2
SHA1ea1c803da99890940e675bb1b5a24cfcd1bd1f6f
SHA256404dfecf10de636c4b1798d249e26d401a795b34369d828758bde7d7cf36ec2a
SHA5121d238dbd4a5897383030883ae453060fc3d3ebc0e5d6b85bfba3a7f44186e886b7aee26cb1dacc53435c7faf1baff9645a54d38f8ed998861cf1bf72369d9e1f
-
Filesize
1.2MB
MD5674d138de42c282290e54fb51ec247be
SHA19d42a1417f9875d005290ecbaa29994074c3e3f9
SHA256749b2cffa5d021d1f9d33b3bcc3ffca3a008d0d545006643630120570ff314ab
SHA51247311dd339443bc3d9a8fd6ab960a0560472bbdce73956a039259f8a26ed114d4b8530e8d450f0aa80f34c86c1a6bbcd2baf0ea88957d5f9055e31a26979e2d4
-
Filesize
1.2MB
MD54d04de4f52138a2eb000ae4d85050e12
SHA18a8ab5cfdf6cb5e3d50b1d1165fdd07d884046c5
SHA2564dc20b2306037ee9e5ff602f5f03dc31715be4a81c71dde74d21fa3f1d47d895
SHA51241c3f8b259d226e4e140b02600581394a3eb37abc17262228718cae76e85672247d7d31b1ee523c91f2ff2af56aa4e6f381bec1e8436d689d6cea250fed6a38e
-
Filesize
1.2MB
MD5915dd1d4c37d42aab7c5c83fd24868ff
SHA15a679a4d3c07657b34dfb5757ec320b45f23db0e
SHA256a140c15d9802c9b1089b65f0a26a6ef979e87a46db7f5c4d8dd3bda353c7db86
SHA512041ce85f6ead3d2d05724e2737c280d2b672597ffec626efe0884b5e05ad68a8bba2d18a6921a4a442421146b51684f01705717cc4a0d0f15de76402a2a9c7ee
-
Filesize
1.2MB
MD56fe3a7d020eaa85329ad327f86bb06a1
SHA1f3ae77257f7278d3cf748ff50ca2cad4a838277f
SHA2562be7c054359d0929989ef17054bce078bc0b7fe842f9af9600188ee3c6a0e7db
SHA512c609adb992c025217022545e9388908c2dd66222dbc282c736de2fb6f9e3d28f305228467aa919a171e1c32270e37972634f6b580471e37e3c7655b7cb8aee18
-
Filesize
1.2MB
MD524cbe3466c4e9414af9c66031bdcea8e
SHA1858f8a0323fc62180219e0a08cd479d38d5547dc
SHA256bfd2ae2447b264e9a56a50fd8385313529541ac0b654676c7d2ad5e55f2e4ec9
SHA512e16788b963f666c21c04bd8bd5b56b34e30b14eb21221bbb9f6a8da9113ed04951e1998fe26115e14607575d62fce50848cb1b4d6a865b3b640b0e12c20c5c92
-
Filesize
1.3MB
MD5cc93d424ea97977e21b40933b55fcfae
SHA1bffd124a4f30f05346022d41aa0293ac32417b40
SHA256febeb5cc52030607541df4333b7403e2e6865c67aa56deb4bfba1722c1d078d8
SHA51239bbe67fd4ac9b74128cda6cc2e362ad3be1ced283505e05ad50fafd08a9cad08cfd23efaa21ae72afa947e75e21e4b2c74258345e1cb87adea903d490a2e78e
-
Filesize
1.3MB
MD524f5aa944097e731067f41bbafec5c15
SHA1f57cd4f11c06fd8d6499a7a254903715c98c89d6
SHA2562583d1d15043a9eec0e7a672dc63d4a3805618f892276157b46e40794ec6b3e9
SHA51204bab0311c32e96cc44660c9fb527d156efdd4e24024a5e143c0a2e5aef085eac4c0026571b09d8d929aba48e630b0b1a13f855551d6cd96b8035cbbb89d8493
-
Filesize
1.2MB
MD594aa856b16bd47ec41fdce0549593995
SHA1fadeb60b7d7d92aded745c7bfc5efc5e457f50f3
SHA25698228e7e67ddfb46e1e9c93a08ee3417bc850876faf0990d39585b4f1514e359
SHA51271b9d67f007360787ab8c041ac677c5c94d9db395c591f9b805924129f999927fa6e05fada13596461e44519d16645271373c31fb5978569766751fb25995f0c
-
Filesize
1.3MB
MD56fb9d23da8d273750dc548df5e67db7d
SHA183b9d10c702a56a8edd88b2514de58fc32341879
SHA25620368498e588e5ab67f61fa7618540bac3b0a10771da2de1d85f13af180cbde7
SHA5122203b800e6e667456c3af12d93456bdc80f457d1eecb8e86c43a1ee574b7c07789ebf227aee9ce79069788ca060e3ad25606c441fa525d70be3d2a93c17fbc86
-
Filesize
1.3MB
MD585d13d8ae6138490afd514751b1d8f2d
SHA126539b023dfcd9bc442097f108134e4473549fc0
SHA256e233e8b6a06fb240e2ed04c50d1a84bd84146b7aef8c5cacf6c57c4a1abe627f
SHA5120ed369537e65e9e05035e891873e3b51468dbc4a86afcfed5d22af96d173756f28c7b8f8bd26a4e16750fad775cedd5eca4fbef7d7228cddaca41e1fb6b9b213