Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26/07/2024, 10:14
Static task
static1
Behavioral task
behavioral1
Sample
bf87db38fc3f93349ba8454677595850N.exe
Resource
win7-20240708-en
General
-
Target
bf87db38fc3f93349ba8454677595850N.exe
-
Size
1.3MB
-
MD5
bf87db38fc3f93349ba8454677595850
-
SHA1
ae7d7e9e97f2a386bd3b8f9e6a77d9b67f75cfa9
-
SHA256
8ad8b587546a08afa9d7b34196f6bb6602fdc109a45fae44c4ce08cb37b099e8
-
SHA512
5d6b81ce01ee6a5eba4889618fb8283810ecd2fe127b7206b30fc06a114a5b792af6b9b99800d65d007b5adab1cee992fa2fabb0bf7fb6ab06c1cdf0d5087711
-
SSDEEP
12288:/BMjCVYIKxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:5zexVirnlBUKZ408vTZrX+lgdW
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 4676 alg.exe 4632 DiagnosticsHub.StandardCollector.Service.exe 3452 fxssvc.exe 4596 elevation_service.exe 3932 maintenanceservice.exe 4980 OSE.EXE 4292 elevation_service.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\system32\dllhost.exe bf87db38fc3f93349ba8454677595850N.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe bf87db38fc3f93349ba8454677595850N.exe File opened for modification C:\Windows\system32\fxssvc.exe bf87db38fc3f93349ba8454677595850N.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\System32\alg.exe bf87db38fc3f93349ba8454677595850N.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\5e74ae8dc056941a.bin alg.exe File opened for modification C:\Windows\system32\AppVClient.exe bf87db38fc3f93349ba8454677595850N.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_77531\javaw.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{CE3D9DE6-FFCE-454D-B2FF-D9D6C166ADFA}\chrome_installer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe alg.exe File opened for modification C:\Program Files\dotnet\dotnet.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler64.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateOnDemand.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE alg.exe File opened for modification C:\Program Files\dotnet\dotnet.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe alg.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe alg.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe bf87db38fc3f93349ba8454677595850N.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4632 DiagnosticsHub.StandardCollector.Service.exe 4632 DiagnosticsHub.StandardCollector.Service.exe 4632 DiagnosticsHub.StandardCollector.Service.exe 4632 DiagnosticsHub.StandardCollector.Service.exe 4632 DiagnosticsHub.StandardCollector.Service.exe 4632 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 660 Process not Found 660 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1352 bf87db38fc3f93349ba8454677595850N.exe Token: SeAuditPrivilege 3452 fxssvc.exe Token: SeDebugPrivilege 4676 alg.exe Token: SeDebugPrivilege 4676 alg.exe Token: SeDebugPrivilege 4676 alg.exe Token: SeDebugPrivilege 4632 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bf87db38fc3f93349ba8454677595850N.exe"C:\Users\Admin\AppData\Local\Temp\bf87db38fc3f93349ba8454677595850N.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1352
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4676
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4632
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:1772
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3452
-
C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4596
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:3932
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4980
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4292
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5cad56c6bf8eac74243dcadb366de1faa
SHA139c47b43c228fea4896021842e0639a999f923c0
SHA256d24ad45d770cadca7cdc91e5a97a881b44ca5f5440c075d650777fbc12c91cbf
SHA512aa645a357e16b9d9023de043ca77011541d1458a1c950563a761588ec3bb33be9d334522e711c8f3def1a692932ad79bc571d5c8ce478f4b3dfae609c9a44d40
-
Filesize
1.4MB
MD5de79eff73bcc6c00245873bb55b50fc9
SHA118624ed6fd555d07a17bb782816d2bc0e94ec62d
SHA256ed4cf9a3870331ddcaa2e3221c4e1360a42555394b1542d71be7809d55db8585
SHA512254e86c9cc0bf05e40d5ae1626c72d359e76d9816fe556b04133d3d659d4efaa4e1a3dc15933ab9d86b21075a88ff2741bf21843819167299612ca1e0a25a8d4
-
Filesize
1.7MB
MD548a8fe51385a883dd79f0f6f25de26d6
SHA1b2aeb5c7ab05b5852ea1cbd6785a98dc14d2c123
SHA256acf752706bf5ff6d3b87b5a52480ac37f22755592c2451779357ed5900620a01
SHA5121f38427a1c7607c934e59597419142f39190be98bb6c41ab45b9685d20a018cebb0539e3198013e47fd13a55a2e1576d800681f8d912c8d167528c9ce72bb8e8
-
Filesize
1.5MB
MD53247dd24563f2c79257f999c38a6d1db
SHA177adf6feaa90c3ad3ef09fa886cc2381041238fd
SHA256c25c9c595d852ca426eb8f4318559d1a68d1a83f2ba64a5b89e8520691d58df0
SHA512677764fa2054a8a283af5a983d7c39b8a9c2d5a50c985d3d7f94fd38c7b230e628de5d29119f430f396cb7a249a0ed17708771804469ca59c565f88acc6f63e4
-
Filesize
1.2MB
MD530c5371429b85e547181179974ba0a3a
SHA1a263c909b0ac5b0f9c8adcec8e5c3ef056f0a150
SHA25616ebc7a089e0fec3d8b9295e27c37133412192f4c18c27b65f6f530e98e65d25
SHA5128b85cebacac129c0f945dfe6f88adfb6978c737db41c0837662cf390a17f294c745700fbb0047cc8031dd068f8c1c8661a6b0f97058b70a65d7047ff1c459578
-
Filesize
1.2MB
MD563ec2924397ce55b9a13da1a5900952a
SHA1c594c417370f3847d3580feaa2ff4ff5c4041da5
SHA256a8cf983bf6b43c5fa550d8ac72a22d202454341f3a4279bb93004f53a7223465
SHA512e9f2589842a9b6cad5ba406a92aa965b96bc95738a2455d62e4296d746b95fc2f4bd6b6b5e041674d7f39884c23491918a10d891df3ed0596b656e071aedf0ce
-
Filesize
1.4MB
MD5a0ee08f6edbf445d7b4520352c092aea
SHA161986d47d57f5595f6040bcf439496f7ea7d3ef7
SHA256c00d17447b54569d4ead37c38bbba6633da84325d6b0238867d9c9dec1fe8b19
SHA512fb70e7cc24632e7c64529032057802cc4d6384ecc49932f2ba77e93f45fb0f4e32b9a7da998e76511c1a99820b333acc294f61ec3456f24716f8221a486dfd8d
-
Filesize
4.6MB
MD5ad33170c50eb3e1cbaf5a20cb3b6639b
SHA1db164f267169531d80316ee1d5384d4024721bde
SHA25687d9db275b2b545c10cee4c8b1888497fd642b683a863cd0a38a184a834a1eb1
SHA51237f912d60a872eb35835aeaa7956a18a355ec01cf502b32a65ed6956c9e0b8480d53bbf5bcc92fd39eb061ea34097b0a39ef9e3bbcd12e16598ee5b3e58632c6
-
Filesize
1.5MB
MD51fffb3775a2dadb853ba2000cdbe3cc8
SHA195102033598706bf362f07ecb7e9371dc360085f
SHA256591d26cac95ff4a998f0b12a6f670997a177b95008739b695aef8a8a33e776be
SHA512eb4af1523e4581aaba93d16d31a4f9b5287ce578194de1de42f01fa1d79a8ecbe8f9775c7482146ef72477c8883fd2eb24627f5b5f3a914eae111357855ed901
-
Filesize
24.0MB
MD52a4dc81eeb5b69744a51eb5e2cbc11a1
SHA17dce023f85a53e9cfdddc4bb7155cf2270f6bad7
SHA25607b0c8073b5ac5c621c9a7afad19919223231ad614e62ad63ee938c252f99a37
SHA512e723dd47ba01d0355d5d88fb3664bc89f58d2bbc61ad3b823885589cd679797cc5ef01d2ee05237a6cd677f8b293756eae0ec8ef1a533f1f21f4b94af034707a
-
Filesize
2.7MB
MD5354babc7aa226a08deddf026081b9718
SHA11a02870c97fad42ee94eb987450f096eab82b9bb
SHA2567414d18cd5eb0bca7dbb8286f23ee435730acd607e87b2a291e6e1379d213ad7
SHA51282f36764da487a5dc93a1232111d1254dadbcc7beee2c726f68da4f7d496d05cbceb0cc4a3a72f356f49ecf83445db39641fbdb97bdfbb4bcecdcdfcf8d70711
-
Filesize
1.1MB
MD5445f28dd876ece2204f4770391f92e10
SHA13caf88db3b6747a8608e60322a397a43b0a0aab3
SHA2561826088dd7355927f13b3d5c33ea0e472ac1833c69014039e06500ecd490b2af
SHA5123e900810b4ea427e3e50a4b6e885bb6aad5d00d3fad0f65c32608fe1f1ef92178f35499a625fce0a17d729e700221eaa513af4b8c8fbe4618c3c00d1e0c4dd2f
-
Filesize
1.4MB
MD57f06ed277fce611b7c3682e8a0ae67a8
SHA1f100b2c3c77e315d0053904556b4d1b4d0422852
SHA256794779cb50d36aade4dc81d453989a844baa62e19edec96a22ab1ebd0e17606b
SHA512c34d2290972486c9d941fcad0a5c6e558211065b7963facea7a571b0aea1bcd51bb3a049fdd31c5214ce1203322c30edeaa00cd4ca72f6f3b18fc3388eef8ece
-
Filesize
1.3MB
MD5e7906938951fd28fa6004df22ef0c6ed
SHA1859a710d494a20e3cbeacdd58040492cbd72c40d
SHA256c40c76a763007c1e0ce41b93687fdcf86263b93fc5c4071a20b3eebd3044e3be
SHA51212596692f1bef2497aca425556a40396f06bca2477d05205238b332036c33e6df0d0e57158dd826b0a69219c0c37a74bddee8e0f1b986eab81e6db22a3ae8338
-
Filesize
4.6MB
MD52d373ac2b84c9c12b26467de810b9ed9
SHA1b43bd9e52956b64875eadc805f9c0658caa8deb4
SHA256e47e6bbb6e100122e9fcbe2e7dbd4183de75370b4191fc782cc414a124d3af8f
SHA512c05eab36625b9c20d2d870302ad56ede5656f5ace1c208d904eb8c16483578c628c34adbcdfd30eaf325ee2269f540595e98ff9e44fb78439080a8d832d632a7
-
Filesize
4.6MB
MD57376cde658670939318653ab396f8854
SHA13147320c4e77ad22105a71ad3fdcc7496be88b6e
SHA25676605bb6abe344ed669750c6ad324c5d6d9acad673332aa315a2829a70348262
SHA51225df63c59f489441b1ae45bdc7f73153aa720efb64d7a4294a7942e18a11d881d29b66f365223184a9f32546cff7846d1ccaf18333311552ed40a3b833af28e4
-
Filesize
1.9MB
MD5b3185ad01ae1a895b811e821964da8d0
SHA192d8530fcd4dd5f9f4acfa02e9e0ba6c685d4a70
SHA2565bcf0ad82919ab27209b4903fff534cbcf04af3a266754e51adc819c27e4329c
SHA512a73abc56cbd843206e7d702ee502f11503c934272ff25a3d72bdf29c7614563fcc33dbb6bee3712c3135fe4cd989035aeb3cf00389090fa2ab033351fe203ec9
-
Filesize
2.1MB
MD566c0e586ba9e684f8f00ccdde47bfcc0
SHA1e2c37e1bc66d0eabfddc73f1cfc97bb29e0630a5
SHA2561b8719526f6e420311cd833a011a411f2264a1ed393bc9a4a4c24b08b2518261
SHA5126947ff21471304157215afb5d5ef5e729a19847fcaa9340d712b195d958564903c080494306af010a8d11b17f5ea41299be434aaff16b25e7a1688bfdfebfc19
-
Filesize
1.8MB
MD56c395ff813b907662c64348b59fc061d
SHA1140e4bc3b5fa172815eed760a20629b1d6b58f16
SHA25658fde2363941d8b42170dd347985c4df9a3f25df02f5e7520c7472d8b4133959
SHA5126ba0187c8cc195570f99cda4f826c8666f715a569d25b1b5a7c0e0b8182dd07d1d9e770d8e67c8ca53010f2fd12297df359f9304a3770eff764a41de43839203
-
Filesize
1.6MB
MD5b31c855c442406b98fafd34547df4336
SHA12ee25200fde91d2e773a5de55fe35f55160752d6
SHA256b4ed8fff07c0d90a2c11f5a6dbdb513c2a7e13c7ef029528daec50eef926136d
SHA51233f7b04e2ca5ccdfc48e88af1a4080d85c0b83e0d720e77b8dfb0c075d57498764f702da5fde734e5727d9f571f6e7c0e8c3d1f9fa2434bafd4ebd917443ffd3
-
Filesize
1.2MB
MD53293198d334a7a0de2f5b24104eba361
SHA138a71f6f5fd2ad22bd90fad1c5f51f7e80fbc27e
SHA25685d7ef96091a0cefa6690d26451843ffb809aa17f86fbe9462168b99f935ac6e
SHA5125467437da21e96b12c2d20c3c70ffe0151f2a2977e903a6b05d538263c8767d8f08f5dbe9c0d1714b77acdc4fa980c3fee60191dc5829e39d222f0b2e213102c
-
Filesize
1.2MB
MD563cd51098ee96c5f0e71527b99e7fc97
SHA1e676da930437e7efbcdbb29a45a216047b2e2cf5
SHA2560b26d95259f28d6f30bfd5a39c928d846def689d0b0f43a02c68563e07cccab9
SHA512c71b68c67dab4e107e490c3446dcafcceb3727f50aafd98bfe41ff57207ebce1630a2db18ff9ec1a861c65ae1092e243d9b0dd5a8680b29eadb4c928d96a95a4
-
Filesize
1.2MB
MD5b88259636c1c2377a07e83e6bb75b512
SHA1948793503ec3f13fdb8cbe2c40888de29dbbfb9d
SHA2567b7c40beb1d973ea8317699941265a7f3d8a48cb305cb88aeb13521b37b03464
SHA5128a5dfd7bac7ef4a75d5341942769d8a5a00b0a2b8ecd255b0627fc229301be84d7c83e3df6cc45d014a63c8d3b61cf5c049f2ee4eae921af68dfa28efbebbe89
-
Filesize
1.2MB
MD56f54e6ac7b180ef58e2522e95d920868
SHA1836fffbc1884a38de562243499b30e95edb6f4cd
SHA2563909a512e3a96acc9e01040d386a4a47d5725933515e1ba2dfb2400b7b4a6ea2
SHA51252c1a65facda8e1977fd3b7fc8c07557cc2de2933e1ebf374cb5e8f1dc99528e822ab6222d56c3534e7e8506e05b736a98881a1be7b41b81f1fce4f6c5412239
-
Filesize
1.2MB
MD5ccf21847db533d3cdd4a6626c7b18726
SHA1cef76a7e1434704bc7feb96a443b062b03966871
SHA256a6954413b3bb3189afb22430087782b6679df1ed381e1839cdb34cc1e11cd18d
SHA512653b46c103c2e77e804602ccd2c92321a4cd5e8e9b8a375bf66994529fd1ffcf3307c8ab8c78906f29c6cd37b05b3d4a02beaf8668cf1f6ccf9fa195430361c6
-
Filesize
1.2MB
MD57aa58c3375c5fa35d7082678d8506fe5
SHA1e3e8b437534a32052717426ec9b1ab22bb12d78f
SHA256405cc0861412d22d3764ba0e0e06d83668275cacce896e0f57de164a4c18ee7f
SHA5121b19919145c2915a875646c671b7d42c3e227aa6dd08b3d7d0ed1abe068663f1410118830b6b74cf32b90417a88729103b577625542d46815f6ee0a845d1a198
-
Filesize
1.2MB
MD555e7a72d644ce78fba2fab56735d8714
SHA178f7a126bd5a3a446adf7eab16d7697d9369951a
SHA25697f8b72b60b67a81e2e8abd45f3fb74e425230513ac34a9e64087c15dc1fdddd
SHA512ad1f0c8272cb2b48a256fe61d7b8ae880f083ea40f8d1c852e8e08a5fe93a0f87e118c83733743fd88a419ca4ee1a97c699b14920781a8cfdf7f060d3f8c727f
-
Filesize
1.4MB
MD5c5f77e6d06dd91125619b1124e49504b
SHA17f28a91f7fb91d81bb5a44f84848b5779be46a99
SHA256367be778a5665d881d80fa590f233ba6bc5133909c1049fcdabed62f9e21961e
SHA512b185b605ba24ef4b8343dd4987994c3f088ac7baad6f4f7edca9e2264d4e18c000a91e80e5ab6498ec1412d2926adc66e72032daa29c7ff3e037c9798841c20e
-
Filesize
1.2MB
MD5f58b3fa00a55cc67b272c4fe6ceb6d98
SHA1107ef8a9a9837d0951515b554a02958dc11cab53
SHA2564d436a22e97be747fb192b51504ea054bf759661c064a1936332c35e1dca3637
SHA5121804c309dac78dbd32a81b645343ada9aee284020845a09abc355feb182b638158665c3143aa895471c17ff02fe9163c66a66e451b394351943e99be5886be59
-
Filesize
1.2MB
MD55afc9658d893784e943337d44ac3e96c
SHA1d7be7cdfdfc37b736c0094b871236a8850a8dc33
SHA256e6c6768106e29551a99c7b2155bc31f3386fe8087efcdfeeba87f5a263ee4ae6
SHA512b24069dbdc1ad99ba2a8e5837cfb71281f681be8530fe14db48278f08955bc00bc656636226733ff187d1f07f6bdd49eb8c91e856c2137ca39ecd7df6adc45df
-
Filesize
1.3MB
MD5c1aecf7bae633591e8136acdb8fe73f7
SHA10a29ef517c0181948d3c2fd8f5fa37f93ea9481f
SHA2566c93a425b019020a5afd0949a65068091d342d5b5676d7a78d871e7d06e9ddc2
SHA512a2a42f43f5fe9004391e04a9c1b4c6563f4e2e3006a2808af4678ffcd930f19c0af6bdc85461f9df7127e135cee7a9d1c143309d493bce63297b695627208730
-
Filesize
1.2MB
MD5657b0f9d06c84fbbd3d7370e40aecdc4
SHA161567010a2982f9c8bdea05a093028bcf865f424
SHA256ac25f800e395aedb848491fcc621ba827beacc3ee07e008981f0c81e0cf7f5a9
SHA512e8cce50085360cc232d43dc9d200be1353189c7cc8a6296df6a433fdb9ef3720d9c4e62101bf9d8b2879592ac82541ca152b61fcba4b7ff7dfe0db763406f2b8
-
Filesize
1.2MB
MD529fa7c73c5e8fe0a9366956495b6f610
SHA153845838d00abcaecd692941393ca5d08c4419f5
SHA256373ab5f6523d79a975d0e8972e71d14b261659f2d33a129cecdb145d03121b85
SHA51246f8bc5c464e6095d48752ba94af93bcec26aee57e42c622764ca5a60675d228384a80be5d93b8e7db4712f95a43fa6a8efd4e6cabd2bdc8ef25d9d1f9d2fdf0
-
Filesize
1.3MB
MD57d3c8ca581855d12a95a033d8e038acc
SHA1b50f442415208fcfa4e2fd6f155d02e984414d13
SHA25618aa35246f6c73355b5a4f513d82a5669f3b71f5ba976f8a20a1f08957efe38d
SHA512e8982f732bb39a5263e3ce95aa503e01e8b488ea49d3166f92d4609bcb9ac1a683bf23112849178f4618485195e9943b9d699bcfe6867b4465f6b3027907811f
-
Filesize
1.4MB
MD504f13ef5d00aa051b905759077a761e1
SHA122ab1443a05a4ce284adaf88c4b2326597059a1e
SHA256a70fdde7aff6bcefb48ff0ba32e27c620a0baa85f41064bbe4516e865a9feedd
SHA51272dd324c8a971f72c0aa21a3db7fb11182aac0dc1967fb77276d0820cc6bdb698cf83cc0915bf11dfc4c98c20dfa0228460d9880f7006eb3fdb3d75721f8129e
-
Filesize
1.6MB
MD55e8ffd422480c122bc3092d3b6d627f5
SHA1f7cd415f011601be35cd671bc84e3e1bc502447a
SHA256903aa3d7ec321d20db1f6d538e60a02e373f36bfba5f6a6be38b90de4274cfdc
SHA5122ea95ecede6df6aff82473bfe3128ab019a20c3f9d42cf547f2e242730c135fbf9a5161b6be2983308df75daff30f3e6fb385cb20a67082ff53e84a50b1cc046
-
Filesize
1.2MB
MD5530e0dc795a467f38a53d648fba426d4
SHA1c5c018fea0b8d511913707a04f66eba0356d1021
SHA25654f1b58c14c006d7262e0c5877fcaa94debe6a1006a76c239cfac5245eb85a56
SHA5125ffc827a237a241161141844b643061efce50659a6e7c2cfd3be9b92aa7315ce3bc9b59bdcc17bfa2e5b908d6a11afa6e664367a85d80a17fb7215e54670ef62
-
Filesize
1.2MB
MD5b3c02e0edcdaae7ae870c29d2bf62a4c
SHA181bf8452ea7021657ca5cf2c89235c8556c06f41
SHA2568366f467ea2fb2674f8aa482e75f76d4241b9cf5c1b065496ef65d033dde9ddd
SHA51227e5ce6d28cf40c2ee9d13c2678975e24e1cad50c1a2a53e5f9491327abfb1311f88d0fa3c6506513b66e793fef417b75d8de75e86711cbb95c77bc406db586d
-
Filesize
1.2MB
MD53e3ea4cea9ce4218c311b09ca7511a51
SHA1693028d2ee3389d8489ac080d6a5aa77ea9d91d3
SHA25638412d28b68d7b7a1b39a24098fd58348160e9a00d773fc698dfabc4dffbdef8
SHA512cb901ecaee9af29bc6ebde54422c8beeddf28a1b46125a9d00a4da317d53a5bec228c5f79753afeb7242c1c3d99b33680a8ac866d71d93ba8a3e5c5ab0c7455c
-
Filesize
1.2MB
MD5fa1cdaa75c7a57c11288f14f4b66fadb
SHA1dd9fcd703104273178c534b3c140f9a01baf55be
SHA256c279424d96d0bb48ade4226eec6d33bd21685cbe290c18b1eafc47c9d80dc26d
SHA51274a2d6db28a41354641f13ea318a8b3725c1284bf2e2b7c82e42c0d5cc4a531e3c63fb4e06d9fb1d97b8bd01288180ea0689901130e995e9d6e5579aacb78bbc
-
Filesize
1.2MB
MD52c3c7c9ee94b848080808b4fa30d68bf
SHA1a57716a67c379ef849ad634a8c7e400d74c36089
SHA2565d6e8ff121a52e2eb7cfd1f6b3b0665ddb78b14b5942c2b8ccd9adee70e23a09
SHA512e7a1c040f151b75647fb2affbba4df3bd12aa8e85713d4e84db84fccc0611f631a0dc6519d4f234ab60ea262626f38e674381690e18da0aac017dd2a6f9b5412
-
Filesize
1.2MB
MD532655c195a969b9747f7d8144d305bdc
SHA1fa850951a965bebdd7f0c0e68e315ccc4dedeabe
SHA2561063c4a62903cabe6a7f0fdc33276778b91df39a1790834f639110cb4beb96d7
SHA5127d933f73921cd8277bbe03735ea839d6665d77dc3dcf922604a8869a643b53ce5b38bb4e4e987a94e0b511ae50ba1f005a2023c31d0ab4a3da261ab5c8420367
-
Filesize
1.2MB
MD5dc558336d4db7d54a0cfd5466675d2f3
SHA1428410955f46a617b816d80a880ff749d15fe052
SHA2565722417e8b2edee4a81f5e96eb99d1694c89332426add19614026144c08fd107
SHA51287540511238a5c321ffe246eed35ad73d2e8c632c464f0785ef1609a8c177cf1b0d6185c51f11b72cba59e3d9a3b1a48228dbb5a1ccfe4c501547adafe24f132
-
Filesize
1.2MB
MD5c27b8db181aed48c18524737b95bb1f3
SHA16fd8ab8dbb70b328aec53095297800a68d08330b
SHA2565377e1c28154f1a2924262640f387c555117a2d46a6dd1b0e1424aa8d9212df0
SHA5124f00867a9f4948661a2bbebb5fd3bcc121f4d39c38be13fe64ae7fa674f08f01798500aa752dbf036e0f12dc80bdd793ba90cfcf8abc6b2f334d177c59eb5263
-
Filesize
1.2MB
MD5e0765591b44e485a5109137551c829a5
SHA145b87ba8f1e07db8f09335341c0193dea9169499
SHA256e0eefff639e9795ac3fffc3f8bcdc52ca2567dd7a02f030f692af93764649504
SHA51217ab989ee81f4d9e7386513d5aa43956ad198b787a08aca573c61ace21d668dd1690f54c4132b7bd111948fe45ff9fa95c9d0ce2d0bcdeb8dd798ac10a05680c
-
Filesize
1.2MB
MD504898b228f6e89176c4212a5694e6adb
SHA1afb457caf052329b10a92bed98d7eda495ca69e7
SHA256da2620466f0baefcb23e4bfc1eafde902655eebf2a993c7d41137a738c67d951
SHA5126effd023d83c09d107d3533abb551fc91fce4229145068efc53158f4e6fdf99ecb0673b94c8cd7886b8c6a45deeb5319c45cad82486f6e653714a2e054ad4345
-
Filesize
1.2MB
MD5cc9940891fa9e6943f4300f8914d593b
SHA1fe87923a4a411a57344503dc7aa060c77b571889
SHA256fbb392495adc91c17f6ad954d5610982bc644ea19bbfd6f12167956d9be73e7a
SHA512de4310fe35ffb556bfa9c30763d51772260906d75539e62ef45064dc4d9c40c9a70a592db49d26ca397c1f225a9da7b9f05079b82951876eb0390524b6f0814d
-
Filesize
1.2MB
MD5eaabb48efd449308a61d94078865abf4
SHA12472ea7ba1d326b600ddb7f6c92d1bd0756b3d75
SHA2567e709e6b67f55301d2f5908e0eed92fd9ade8bb9630cf0eabb834cbbf5015447
SHA51243f2aa24aadf3445b62e703f3999d6d72fbe0413a707e4b31f785b190fd782809cbdd20932aceb5af6eb0f0e6cc7cc1560985e49643b8473e9e09e6f48b14cd3
-
Filesize
1.2MB
MD5377c69f42cbdd4bfb38a80e60e637629
SHA1821ea0326d817cef24dc942b553eea0acbbe10eb
SHA2560e2c8ede958ce476a54f6920b97216e9cfa2f6b12177563263ca3e7f7468fead
SHA512626eb7d36805ff3f6109fc32ffdbe7f42ef47f83e6ad9c51f324d6e71dc9e3aaea712537aebb4334af8c374dc5d72f0b3d3ef687a0c59db3487621eda600284a
-
Filesize
1.2MB
MD54a94b300f0c3a9ef14f2b3b83068b8e4
SHA1131603032675936b448ae5acc363b2c8bcb7e3b3
SHA256709d8fbea7e08026bd76cf8b4016a0dae2625762f4fa0090974023f777d3bcf0
SHA5123663950859eee34344fb381a8fc41225b312427fd5c93fec6b65302a3ba9dfbdf164eb5de9a85a7343d8d1ce01fc99f655556927c6e01eed66212053b9928dde
-
Filesize
1.2MB
MD55d8d7d044c2325442aebcfae4ae61c24
SHA14bfb37d5124f658e612f5d202b00ecee0e213e77
SHA2568ac4df0fcf4440d156ce84fda2216a2ec82da931ec7d64e502739e5a314ebb25
SHA512953efda2b96b08a0ea29d1c58e3272a0560602f6581c5ed9db974d25b4b01fd8f6ea0327cdb494e0ebca2a594834b70ed8c7cdca98e7a6b9ec4ac5212b4deac1
-
Filesize
1.2MB
MD58de3a3eba4133eb3ef35da871af6f6e9
SHA1bbfdf05e9c68051dbd49172f16dcf7e8d7346108
SHA256a9c98b4211fb525fc9c1b7f7ef643676754ff965c977bb81386f88625f7426ed
SHA512ec77cf9bffdad976117e8043e9ac26ee092fb7dda8ec0d08c144e3bcd6b9a91800cec25fcf52ce7c71ede3b927396c8130053f9c568df3db981664b4039fa5a7
-
Filesize
1.2MB
MD5162e1c49fad928992edee73052956fb3
SHA1802cda3d5c45851429aebec2e26ff0e2b83d8474
SHA25687b08e8b0c4d756d2126c83b6462256515f3b6aa3b6617c43d43a36c4becede3
SHA51203641069bc3dde83861882c0f36589c512817b71ff3ab85b20ed7e0ccf7d6b09c50d1f3851f41f493bd3bfc33fc029fd56086ea523bba57b34a669a2007f0ea7
-
Filesize
1.2MB
MD5c2b8defcb443556ef14431045715c347
SHA192c8392ccce8356978180bb844fd4329000955bd
SHA2560698e8a42f46ca3f690fd54616927a5568996243ef9de30a0f01f38c1cd74ab5
SHA5125b82485f2028adf6ab10b373ee0ee464cdf21721cdc401fc27061349f4df8b23405248ccf51fc2581e82a7f23af00f6c0063798f26c401301c2b102d27aa4854
-
Filesize
1.2MB
MD5a3d66b9bbcfc58ee1a5994d7f04bb4bf
SHA1df0ece52a6779e83675cca3c53bf393b381e9dc0
SHA256e9ebea573464533cad492a6979e62474027fa183cd540642e560f2e92116ebab
SHA5123d0479b44b4543b798072a899c40772241b7bd57a9edeba35a53c061636b055868f6a21a83d565a48b55f994af96c6238d7cb7c17e275d8cfed94027966e44e6
-
Filesize
1.2MB
MD565d6d2d010bf64fb94820cfe7d73b887
SHA1e0b622aefa93f81b0c576b9ab5dde6eae49572e8
SHA256b63ff151272d66c99ea808704bed988762d4929817813a008916d589494aefd7
SHA512b9fddc54d023b0d972cb9e5d5c6819e4c7d9fbbb0ba2dad6415058b339cc0ff379e9c255b6826acba62cf49ca16069f601628480243e390033e8b123b40dcc33
-
Filesize
1.2MB
MD55cabc95cace370137f77ff0c703af180
SHA17c3a3170366f30514aced6139e22f6f3403ee158
SHA2568013ed99e9d4433f8e5a4ebf13a0b570c15a3a1dbf7b60c70fe1411d5a7f5fec
SHA5126b7324cafc34246cdc71e504edf5ff0cab124548638657185b0d8ee05062125467d9092b2c063d1cac1f60a5a43ed0a88cd27c80553dad6029ca97704efcd060
-
Filesize
1.3MB
MD5e9e621c2a4e04ccea18f319b2963142b
SHA13bd23d25517663af3e67a1f35f99df681fa90a32
SHA2563a22d9f774918f442577eeef6e86b8f0dd800e7ac92cd4a7dd5839cb668f3882
SHA512ed2d30bbd94da0821789c19be6cfae24d6b1d4890f18274d6c8185df433a8af93d2b4616791f98654afd23a78871f3acca0fb84a60da03ccababd50d4b136495
-
Filesize
1.3MB
MD5aececb65082486183bdf114ed5820daa
SHA1717ff32dbfee8220eab4bc696f1aee357f30b75b
SHA25685bcde03dc6ab14eda09d959a4cee9237f40c24ad45b0c4d1640fec3bee538ab
SHA512c9bb44a39196eeb9d2c531a49b6e2390f5b5b7c5331cedafcdcaf720450711d949db8139b404caef3fc476f31acbecac36cc662c161f2794a3ee3461fcfeba1e
-
Filesize
1.2MB
MD596d3f53e9e952c6ac46d172263253bd7
SHA16317e42c73faa7169fc6e2f9d136fd5e715ec27d
SHA256e4f80dfa09f80ea8d97ad00b51a9ad45d253bb23523cd9f59eee13378bf59215
SHA512ca4db83cff6929cb2d225a1c05b83d7118945668ecb504abb25dbbda38fb58688b76c4c827694a3846c20de716bfcc50fc26bd9d2d192137b9bf4821ec3fcc45
-
Filesize
1.3MB
MD5b2a82c6983552462f7acb964ba360f70
SHA159b44c77aeb548e92a70863d9ebd71fb47ab4cd7
SHA256343f0a0bc979f3ccd2f5d6fecdb5e1cf0786df37190be2849e2262bcff91812f
SHA5124082a8432bc5d636a8427b186f161f4e54f90167dda872e40701094e1f56c5931d7474e411814fdb43b321eea6f9feb81d81345405de8d9768845f9d1d55d646
-
Filesize
1.3MB
MD5bd202c250bb4ea2e2e8ff3553032572a
SHA125529cc58b9be71b305203219fb8253fb5f1a9bd
SHA25639bb49b054adae9c13b18ee1874cde950ce1f25a69510efdd073d89ceb003830
SHA51215dea4fdcc8b0736493af83b6121e90d3903186ba783e773eb1f8f12df4236ee9b9f92921ea5a507f778688109ebe9c11ad65be10251e6cab57e85d8b008cd52