Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
27/07/2024, 21:24
Static task
static1
Behavioral task
behavioral1
Sample
fc822b2fec9051fa2311f9972a0135d2a6a8e199ca48f4ea51f0dfbe3f9669a7.exe
Resource
win7-20240705-en
General
-
Target
fc822b2fec9051fa2311f9972a0135d2a6a8e199ca48f4ea51f0dfbe3f9669a7.exe
-
Size
705KB
-
MD5
c8b27e8470cbd97c829d07bb59236bf3
-
SHA1
3685625acb76159e27e9957f7fd6305e675e9ed2
-
SHA256
fc822b2fec9051fa2311f9972a0135d2a6a8e199ca48f4ea51f0dfbe3f9669a7
-
SHA512
f4753d3d3a21ea04d02c55d50ad4a84b9648fe056ba8889ccd33eb9ac8677620da2757e8d11de6afd59f9691b7c67756921d3dc10909ac3cd89b9a46aefa8da3
-
SSDEEP
12288:dW9B+VpUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8B:dW9BGatr0zAiX90z/F0jsFB3SQkO
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 2964 alg.exe 3088 DiagnosticsHub.StandardCollector.Service.exe 3936 elevation_service.exe 1768 fxssvc.exe 1204 elevation_service.exe 868 maintenanceservice.exe 1212 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\System32\alg.exe fc822b2fec9051fa2311f9972a0135d2a6a8e199ca48f4ea51f0dfbe3f9669a7.exe File opened for modification C:\Windows\system32\AppVClient.exe fc822b2fec9051fa2311f9972a0135d2a6a8e199ca48f4ea51f0dfbe3f9669a7.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\a8a1e8ba16be280c.bin alg.exe File opened for modification C:\Windows\system32\fxssvc.exe fc822b2fec9051fa2311f9972a0135d2a6a8e199ca48f4ea51f0dfbe3f9669a7.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe fc822b2fec9051fa2311f9972a0135d2a6a8e199ca48f4ea51f0dfbe3f9669a7.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe fc822b2fec9051fa2311f9972a0135d2a6a8e199ca48f4ea51f0dfbe3f9669a7.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_94843\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe alg.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fc822b2fec9051fa2311f9972a0135d2a6a8e199ca48f4ea51f0dfbe3f9669a7.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3088 DiagnosticsHub.StandardCollector.Service.exe 3088 DiagnosticsHub.StandardCollector.Service.exe 3088 DiagnosticsHub.StandardCollector.Service.exe 3088 DiagnosticsHub.StandardCollector.Service.exe 3088 DiagnosticsHub.StandardCollector.Service.exe 3088 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 648 Process not Found 648 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4968 fc822b2fec9051fa2311f9972a0135d2a6a8e199ca48f4ea51f0dfbe3f9669a7.exe Token: SeAuditPrivilege 1768 fxssvc.exe Token: SeDebugPrivilege 2964 alg.exe Token: SeDebugPrivilege 2964 alg.exe Token: SeDebugPrivilege 2964 alg.exe Token: SeDebugPrivilege 3088 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc822b2fec9051fa2311f9972a0135d2a6a8e199ca48f4ea51f0dfbe3f9669a7.exe"C:\Users\Admin\AppData\Local\Temp\fc822b2fec9051fa2311f9972a0135d2a6a8e199ca48f4ea51f0dfbe3f9669a7.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4968
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2964
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3088
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:4292
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3936
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1768
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1204
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:868
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:1212
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5de1e8dfe5066020a1fd80ee8b79a79a2
SHA1872b6ee4368f87bd233c0f0ae1e90e5d9898d8dc
SHA256299bca3e9ebe8a11b89b96588cb7899456b48ecec21f55453f13195cce327c49
SHA512f0320f6084c6801781cea3c848448b9bac4e8336b630d3c96a52f64336a2aeaaa2928901fcddd29f3b1b02d2e521df8a98f31d2c18bf73de959a6fcb7d14ffdc
-
Filesize
797KB
MD5701811b9d27b06ac927cb744b4c4e537
SHA17a1b8126f30b64e4cc596980d1fd7820d7f8395d
SHA25622ac6f8ecb837c86375be5ddbc1af093a7c7842dceadcda31e2c394851a9ee5c
SHA51246b9f7011469eb994546756482ee41e51a86ad53ec0f15d378773bff068e29be3fae974b39b3346ae04f6dcbd35d7fdd501274fee8843cfd1c885007b831022b
-
Filesize
1.1MB
MD556f56fc3efa6ea57938c90b0a5bca100
SHA1eeca65697322749e47da3f9fe1f8daedaa44db66
SHA256caf30914687d1f33cf219a974a817fff7f941346b444eac53ba4fe066de6866f
SHA5124c1f7b6d2096442a8b11d92efa2f2739a944b79325424bb138ca4874562c8e4a040fd6d62d8f5cd852c926e7fd5938d9e3cfa43b3f04aa5900ef64e45523bdda
-
Filesize
1.5MB
MD53c5413f4678650466a0d73bd5ddfae8c
SHA1ed00dea1e5b40d2fc9b389363c69e25fa9c01b28
SHA2562b3a3582a83fbca7eb87bc4b4bc88ff5b38de44dd5f7320d11bba9f17783bc8e
SHA5127fdc66d7d5de8330a7d6f45656e4efa305a018e71e8d18a03615b1cdedd261321e4cef9adadbd2bfc1fcf18016c8158dbb69e0409a4a37d454bae09828723de3
-
Filesize
1.2MB
MD5b4bf44b2ea5e97a14ccae7d90c15b8c6
SHA1d72a4d5077e834f28ecc305c649d814436f758e5
SHA256c1d68051cd975e8f36678014b0092da074a4333c03901b799f9dfa1a8a5c5b5c
SHA5124185c2e913d4cd21cc569acdf3e80ad9d8077a7e25d84a53d66f22f80cd525716be6cf4ddcacbb101e4a3476b7b185f105e4f3b92fb511d3d13fc691cde16ae2
-
Filesize
582KB
MD5d9c24a404f3c851a02ffdad1a4596e60
SHA12fe7b6eef826b30659b1a12f79ff4ea3816e2c14
SHA256c43166a1ba51e326002c456fc914a4f0e345ac7240bbe7dfec39cdece204e27a
SHA512991e14ed5a594fc7fd01cf140fd73f09155ce43a360ebfa6dcd64bb7624f23ba9fecf50da4ef965aa6dea1cc6fef516c9014f38f9e4f1739114fcea33cc25efb
-
Filesize
840KB
MD542297c31ac0da7738a2726275d3e7c28
SHA1c8f6c84943e464285c2ff9e4e0263eabdc698551
SHA25683f8535624db126ad55b1a83e9fa473676d4182e523fa4a070ad0909b3d71792
SHA512e1a058e175b9f5ebe1c4be899e33be11ea9271601e4f8878b1d1511e374bc9159fadb4ccc029a067f86dc25cd7e0e428a5d5d8627093a4a5575a1fe2ba74fe9c
-
Filesize
4.6MB
MD549ccd0bb864f62fce7ba38e1316dddd5
SHA1ac23b6f9e1817fb82ef6d4e85ec69d582fee389f
SHA256c86d9e45c2db8f99ec3d5500b96f07574f2c9a69ed8fbdf00ad2267b445bbfe2
SHA5125720739bed9515041269920480383d0188fd06f026db21e15d6878d637c4d992e2aceff8ff420d250a4a2f59bc3ee267088d5a97b86fb310595c102a350fbb80
-
Filesize
910KB
MD52374c5be5d19f09fba9a17646f4c6683
SHA11efb89b02118931d6941564692160a84edb68ce2
SHA2565816d200f2371e32766d339b9f1a48df2ec1a50b16546afd0e11da26e04af077
SHA51210dd59e404955049c64bfa04cd7d6eedc36bae2ba891ef998831251c192ce5d1cf0a3ef7945a40b7f1fefc2894b55d4e93a317e25bb7c9de48ee79fe6d900692
-
Filesize
24.0MB
MD5780a2c39c95a1572f87f93e8fbae5abb
SHA1133d1d1d085890033d1b9fd5a5f914879652e320
SHA2561dc8239e18947b007d52f60a8d12d8e3edbca6aec0522b74776a6e4f3885c21c
SHA512ca4d4233c9fac3239831c8cd82176a407c69afb6c1016015474045d4ac8fff18f21edda11cfbe896df67ba568faa20d466315265ac95b6aaeb229c5b5bb1e7fa
-
Filesize
2.7MB
MD519de61c6076afe1f0042e3a9f7cc0760
SHA1feb833a43a03842b85ed56589c50748f67c121a6
SHA25614b8bc4661ce0fecd8c64650cace2888ddc30900b0417974d355e3403214841a
SHA512b059637a61e36bef54efafee2dd6760643a2a6e150d3c518cd4d57cff57f2eaf4a54b166465e58a7919b6dadc9cbdaa684ea4969d28a5e1535a677714df3f89e
-
Filesize
1.1MB
MD5deadc25b0733b3e03d8ba2f461009530
SHA11cd92b954a7314e384bbb5d11d06af7cf3d67d9c
SHA2562c332729ea85c74f63adf64c1b0f0118d663bb6cdfdb8ace6a372495067770ba
SHA512a051e278f9d6b618c9f63d3ccec59bf3f2ee338842b33b47fefdb6c5ce6c4bd7b5829bf325ecaf9eabe3b90876ae49810801aea08f8726308f5e9e5f1fe430dd
-
Filesize
805KB
MD5c20a78f3a6702f1ca46b2d291ca9c720
SHA1d98a7d9460ceaf237dd0dad31c78381b0cc39d4b
SHA2564380e634fc8f20b251e13098aaf3c84095268114a60478716a8a5bd7d9c999f3
SHA512ee50b0f8f6c168ea931711040c98f534f66aad91b9f2372944b7ad180c5e947ff43e130cbd1eb69a1b51ac6ec86b28b6b12cadd757aefe6cda66035712d0d356
-
Filesize
656KB
MD54016d2761d316f74a8f7c31b8f90a674
SHA1a467e374cc7faf285796aac04ed141ce051686bc
SHA256e7a2e8d77ff91131947dcc200ec2e15c7aeebc99c86e046b1763a37c39963303
SHA512c3cd361c05599f5ca05c1e349ff8ac06067b8028a5ca8066d32411627fdf9574e58e5709a4c78560766dc86f1957cfc9de78e0a9b86849dde88703090c390316
-
Filesize
5.4MB
MD59dd459d89a315535a0f5061867d678de
SHA122fb5bfafa6b661b98c3ccf154e1dfee8b21bb29
SHA256c36aace770c5b493385a79391a616aadba05ac9ea9bcd57e19f5f3e69f0ff8be
SHA512c49ec0f1335adef79a9d5f981f7cad78d28c7e3f73bec86b27f79255921060d41c91f6f50beaffa5625fa769e3fbf9b4544ff7578dea5049cc217bfd1daa368a
-
Filesize
5.4MB
MD5029e9a55941c3f6f45f6d8f416f027f6
SHA1c9e7b52591e971e906629f7e97e5f72a4b3b5ffb
SHA256059c727dbf6d34d732f15aad11df35fb2ec44559590602cb14c8932b361d4167
SHA512fa776d9bbedb4ce57249779b87cc5bfda522551936eb70bd8e4ec8ee8183073564725cf2bf333ab5c9a62018e2992078475194d6262a01ef46062e6e06882d3d
-
Filesize
2.0MB
MD51708f87fedfb353ad7148af979b63239
SHA12c9778118a6855b0c690973bd07380bbb24bcd3f
SHA25647d9de754f4f2c5873b2739eccee018db672b4bf9867e684f38b2bc867d367d9
SHA51241394b6a6c895681ffa24df5f5aaa7c6b6c977ec8d532ed42d35e93f2c3448a8615ec6963eb71ca9da17ebfe4bf763d6d948e52e6e6a650d9e34dfcb193b4636
-
Filesize
2.2MB
MD50e6e2d2da65023677a637ff1cb82064a
SHA18bd02023d204eba27277a73938eb061102b5fe57
SHA256f86aed8abd137e71053cee852ada07fce43ddab08231305de63bbe826e30eab9
SHA5123c375b3ec6b129533c5b65029e02ab34c07efbac47061a34fec81e76f68a88e103e8c94659523ad90c37bd8dd1e1854d66fa683132f496fcfad6c2e583364987
-
Filesize
1.8MB
MD5123c7ab0c8c8e2a9c138d3d7ea571518
SHA174bf1d78c36d46b963cd54e1f5c17a99389579bf
SHA2569082ba21da31df1612be5142bbb2eeab0f1e2c4a3ef664f507daf227f0a49e0c
SHA512dcb6aa9cb75584ed856bebfadccabad08fb51178576a5de868734a434cf73056ff4cf8074149be9f19e873f50a8fac7db201ffd72cd8d26fd213271586ca2853
-
Filesize
1.7MB
MD5eb6f70a616fe4a4c9887fcb93ca7b768
SHA18edda059d9359556cd2af2e8a8abec3ae5213f43
SHA2562374deb67a087931d4f39bdf1bc908e20cc1dccfef028312a3ef059555ca3aa6
SHA51261dd4e8ee72c9d8276b1d5c8852cd6ef555b01594095ccb388fd67518cf7ee59b70cb7f7625eb15e30bd92eae65df90f01f746ca778927bab833e9ff765dc0d3
-
Filesize
581KB
MD58d08e6e020813d879e81b9916f053bf6
SHA14683184dd0be1464cd74c23ca3b148a78afe041c
SHA256352def30efa0f7048069c91b844e023e0da52450a27646d27e2043345eafda13
SHA512c64638a34a9a9af691e586ee0d6d915acf52b39f7f35a966d8e76a41c63fd320ca5ffc158a947f80c50572a9c1c45f11f0f68e6ef39b57cc206cd28e3fb1c98e
-
Filesize
581KB
MD58a2f44eacbb94ac385dc4291da6ad7e8
SHA124ad0efc28f2ab4385822820689cddb5c750c3c8
SHA256c605477a014460dbc0a52290c925130c1906b076186f6e3ad6961c89827a88e9
SHA512d85a56321c209821166fa723dbf47dc051f262d677e7cdb8d561a602aee332dafcb422734daf9c6f11bfc440bd5318d410f0a893bb71448080f9c7aa0a428e1f
-
Filesize
581KB
MD536cb9c9a597ccedb21d3b29c65c5694a
SHA132564984d7be7cae947aaa12152924fe6e8f2497
SHA25653965199de58199e8b6158869bc5847f9ab96659ed47b0769d0ab697461d0442
SHA512df118888c32799d20ef45f6e34dae432097ba750b9e1e65d86aaa57b6a7ea2a3f62302dde3f21db74691cc66bdcdbfa191f41360305168c9291da540849f3833
-
Filesize
601KB
MD5ca0500c76584cae0335bc7d93336df74
SHA12332b34422ef0874e2aa2a6fe6760548201f8c31
SHA256a26ec68a5f284e047895e5555f555e7e55758b0546669ab4a296e24b72288e0f
SHA512a97ce486d420b40afbf334adbb390973e1673fe51042a311663b9bdd17261088a718c0ed3bf5a9eaa0de7eaa61b87712eab7cd88f7db86a1112e54f13618ffa9
-
Filesize
581KB
MD55504102bfbd7d25689fd58f546aa8713
SHA1f9046876ef602bb3acd1779d3b90a3a6b69babb4
SHA2560b783867f53ca1f93a8daff69de412e63b1aa66f5cf7863e62a8e36e0a06ce66
SHA51271ef2525336429c11e1bb8b306827e5e41d1e26b65ecc239ecc3c76791adb1dcf61a82379ecaea77066f86c3b83d74606d4b7dca30a8996283b0f35bc3b28d34
-
Filesize
581KB
MD539d8e23c4da0a001687cd75d7beb17c8
SHA18a17023afce482dc5c877a19aa4c5e60a58cab7f
SHA256d8a20d2b575251b6b7dae832bd31db9437020fd926a7aa2d084887d79264a925
SHA5121297e357e343c01c58f8b504de2da23f431edec41b7c04614957ce0a68bd3e67a0d559d3ef15630679c2af3e5bcd038e97e7350080b521fd2c6ef1f61ff0a711
-
Filesize
581KB
MD51f2db2eb8c0255b9562bf685eec55fc8
SHA186be1224921e186ed222269d4d0a6fe7a775136d
SHA2564c35922f9c96f0e5d0e04e06360301e62e4b9f0edfc26e887d9d66dfd807ddbf
SHA512088b602347c1bf87db3cc0c851350d5a099cff188cab1882723bf6a68a94ed327a80184650170468aad08de723940f77e69867b921f2e99604090e194975cabe
-
Filesize
841KB
MD59ea618c26735220a4cb5da65b41fcdb9
SHA10c97687031a2108ec87bc20d5352980b0761d3aa
SHA25672949033829d25f445a0a4ae128b2038f49f1877a057504cb4fb898da1d0effb
SHA51228f46e21edfc859b92b9183e89b8de4a31ab7c4a860f1b05405b17337510f7abb191cd1fa96a4cdd01b19f83b2ad951ae41bac5e59a55f91bfb1a2fa1bf4e54e
-
Filesize
581KB
MD5ebcf856a4742dc1dd60fa8945db677d3
SHA1e81fe3677e972708fb31e0413159240657488d30
SHA256c7169ab3efbca9ea13f3e74675eb9664279b4b4564a33863777bb876102151f4
SHA512afa36e2846a4354629a6574eb6abd6ee206df9caa4092bcc52942fd8de19966a64827989b5aee7ff3d5a5c7e98f1403572d30acf8ed3511e2bc52e2958ff34bb
-
Filesize
581KB
MD5912151cc3ce0c4702e8aa5bebd9bf49d
SHA1d1a55459f62bf398acaa9ecb7ac286e62e8abb55
SHA256cb4b6764087b1c56e970aaa13fb2deec04d3c248a019ec484ac357d45d7c8d29
SHA512c0afec9e6d65f7e8d23279ea8491ddb5c76c43a3ed787350fc336804fc75bbc04846eabf099a8b14d6b1d0024da4341690ea7426dc45123ac0224c4ccd20b584
-
Filesize
717KB
MD528c7b6677347f01631f04764b689455e
SHA1bf554deb3806396a8ba7bafa67e7e1475d11d79b
SHA256e9ad81fd0a133b1c0aa17b8f343103ff0720d0d875e293be8ee0706d13e40118
SHA512595d9863542743ef1fb2133950606fda4f2dc5ca6cd74d03e5d20107b179502b4ed257c4a2f7504e2d8d9ac4f5300b91ce7497bdad8236f533d0b62606ea7b3c
-
Filesize
581KB
MD585c165cc147220d484343ee347938d92
SHA1a86141ffcb7b550da4715cee84e8b764474b32ca
SHA2565ce8f54eaf5551eb0b42e84ee97392a82451e2d4100c491ef719b25eeee9d861
SHA51264a3d36bf900fa740a48abaa07b8b69cb27d1c9e29564b4a06fdff49f3d5661c2d4e8eaf0ecc07d34d76e8d82b4abd9e6acd0403abea1381c40d42e272c76425
-
Filesize
581KB
MD586bba2d9cf07aa7f4ec3f7af337b232e
SHA1f31039b20bb5b2ab3db064c55fde916d1011da64
SHA2564dce124b30895a79f6f75647a2cdefb5039464e10398ba23e0432841992e4300
SHA5126e83434e19f06a6a231862fa5f8c6111bf4f20a7b1d5fc8299b953ee48e0a07b2f5d1247bef6fca27714af7dc89ad7b3b8dfacccb15c14636585949a813e9b20
-
Filesize
717KB
MD537688a8ab3cab9a3e0ba56c91c94c5e8
SHA1b299e9a8142ea7a12f1e91d7a17c77da1ccdbca3
SHA256766fa6d416493817cce83cd97ab0d554b778e8833b17cb8dd92d9a847c3a6f57
SHA51216435d84a47a47ac2b2d1dce48fd0af3bdb66d075ff179c829d6d802b4dd50075e5970a8ab31bd33bffc17677bf58b1ccb59524e2a598c13de20f4549b6d4055
-
Filesize
841KB
MD5d6524ad5758a98fa50e832bef26c1093
SHA1427b3fd86611bd9c7dd96a54e5343b7918b64e9b
SHA256d60042d37658424c246bfa1a8339b7ef3074328d4b4b575d5d2f67f542ee0e82
SHA512283edc6125f0393f4b4354a41981edfd3a07c59beac59494e52b57228f50b9bdd0d7a8017b192ba42eed1f88f6ac9913480c890d9a434a1e048d750e8f6caff5
-
Filesize
1020KB
MD5b111c4a15f9cdbd5e4ba2600f3271787
SHA153573793190641f27153ca041c983b1d6fb51d26
SHA25646c75912c4f6735b0cf0b19bc436b7976618cbfe90b4745db2f195ba7850ad2c
SHA51270a7f6747aa96cec7d2b880c494d624e9b990e7b872110e3cf04b4f8f93fb0b6ca4c51dd758801136f65aa7e854580b80645123ae33ffe4dc622f07c257b202d
-
Filesize
581KB
MD59a7404c2c0f24be297c9f194cdcb34fd
SHA1225429beb24f392ef310777e2625a13414efb9b0
SHA256823b8be1f315036775b4085b59ebb7fd7458883df820eb31b876d49eca933148
SHA51219e3a95c6faccb7cef57f6713a8d449cb28fb6f65c05ed2ca3f9ac980f855d608f778bd721a2c3fbace651843fadd0f239626a9ead94ae5bfd87d193696a6977
-
Filesize
581KB
MD5cb230d81b9b6ad3b6754545204a5e6f7
SHA125f2d360482d69bd6f1f074068877f626969206d
SHA2565eeae1b93bb43f0644673d7ea206b6610f067dd2bc9cafc3ee59c4c79adf8a65
SHA51241bbb2014a37777fd6f731846888473b97893c895413dfea26dd660da23e6c2342a5e34af5004245c72b0f52df4a9afcd8b1124141ecd6f5f4b664592e267769
-
Filesize
581KB
MD5a9343059ce91c7348304c8dd25ccd069
SHA11823e932635286c65d9c97b2f7a4831a1f523a10
SHA256ac0f2489be487602c5b25e6b434dd0bc4ad8959e7c795ff27e02add473dba2a7
SHA51229d5c11a837a1891168ff84818660f3335b7c3a1d6fad12c19da2ddcff11786a73a37562137aae1ffca898e908e916b90a407a0a02b27d6d42378216a01cda6e
-
Filesize
581KB
MD569780b8dd1ace974e917b6a6248f2f4a
SHA1ba1f5251b7f6932f755535247f59a2854a265d97
SHA2565f4e4f567a0a905dba10be2f64fa364b9d8870b457c6cdee64e901541cd3782b
SHA5121cf1629bd7bdf1742e9d7eece6a480c9ef74bec4de2ac06c680a2b177fc8eadd5dc2af36f0efabfc6eec1c9e2a7692eb5e65939e8259cec3ba6c4ffd58dd62f3
-
Filesize
581KB
MD50af5dc14a9531e5bb07035f6d3a05477
SHA1bac01340683aef216e0c9d6289e1f5ad9857ddd4
SHA256bcc94c34324c73ca0a2799df5e35161b2882eac52fa1f6a83ef3385ce1bb14cb
SHA512be71426e4a23d9efd69ada6a0c0905a0b4701f2b6b336b51419fd46855d407c80c96e53dc6ba695b422fecd33e6ac48e1908185d722e24509c25a2d1d77b32c7
-
Filesize
581KB
MD57d694b058334a61226eee58a30432204
SHA1dc371dfbc2fa6a2adf230b1a4138d9daa7b8c98d
SHA256b959e2ae87a2bcbfc916d714d5f9da2eb21f2f04ff5163474631f0dd2e3e3056
SHA5123b92a89f69b78afb2100e3a75531d4c5338ec27821edd300834b8a364d1ba611adfc7853a3c0d40792f5d72a0689f27b9fdcf5e783a548a5220672f45953f437
-
Filesize
581KB
MD587a69456927697edb7decaed92b8dbf4
SHA1bf2890ad23222a873a8c224b23dd09424fb3904d
SHA256456d2901df59065e67a1373a146d13e424fd8c51c90667e803fbdaccc44907ea
SHA5126725b0e9062d3c5769a21a251fa5827883fd512ee401826ff7a1e5523b4edb0cabea3adfd1bb860d3c11bf8afaf79ef9110b559cf4f5cb545200b619c8c8e439
-
Filesize
581KB
MD5cedc8a18b66c40f3eec6101dfa5b7ea7
SHA1b644a35de8d6221bf8ae7521af43b599a2b7c815
SHA256a24416791df00dd80cb6697f9a122649ea6aeda55ad70bf6582eae9d0a7b305d
SHA512b84e3a9ab6527b7911bce99a093f4b526abc8dedefe6db780e1783412cc5dcca48154538214c1e65a08584063bc1a373b42bc08632469e4bd27e14498cfd6730
-
Filesize
581KB
MD5645a2bb1b0702569d38b78b6d681601f
SHA1ab80535ae361fdc9671711700ed5c61d298634e2
SHA25652710b1bafd92ee494e342841d9bc958f1d07f578f8ed78c5eba28107b411bd1
SHA51215997d27e167b7d3828895b5ac75afe5aa8e71b7bacf4f2ea2357a2ec4d3f2307e6b998999eab6a5b6d2f98a96a3f98dc80f43249944f24db1e28e2089ff546c
-
Filesize
581KB
MD56c0c3d88b851e9c955c8b09396083ed7
SHA1ad080af4ef59c4b5096fcb55f554bf12784d6cb9
SHA25683f2cd1985b3465652d853d09609d0044d6e7c385a9bcac51a0c247ca01aadba
SHA512ebb278fff50d97d796d353506cf889852bc961d9425707bf21775c55872ca109745aede35e5a12d82de711cf56f8113e1ce068ea3afbf59ef78a7c0080ee1cc3
-
Filesize
581KB
MD5e571da53280f192e573bfe785c833d21
SHA1e58a0bff4eb4e2929bf697e92fbaf4df1f7642db
SHA2561018c0eaadcc0b8bc403d947bfca3c89457104158dab5a0a61309918096e22f6
SHA51271128e527489ba71480bb415277563244ec3f9476870c7e7af27a2847c2ca28403ec749772dff4992633ff73804c6c76e24ec8e3a21f58039408fc05124e81ce
-
Filesize
581KB
MD59b1aa56ae7656dba9914c7f173dd3b14
SHA185cec57fb2e7fa75370bbc658c784fb84dfa4de4
SHA256f25bf5bb079500e3daef6c0a9fd8a3a5d2cc7e92e46e0a8b8bd4be9ed03dff4c
SHA51211d54690d8a96860441bf47df1f0e9db014bbad95b8039c69d831592b3f4fa934696bd1c096ea8e1aad6c9d38ea1def273140496b383985c19e09011e241beba
-
Filesize
581KB
MD5c327027e328bfd9a9c85f5031939be2a
SHA1b84a662a7da8a628168fa2defcad52b52babe3e9
SHA25647727b9832dd3433c8b780c35c95e32b1cbbfab1d9ab908d9446d5c9af2d74b7
SHA5121c4bacb7735b65aa54fc28105d595824dbb9c9dcf6324ce2821058207e2b7f006d3b5c0766a81961609097588ae4b32760a15c1988a54132d9b689844f413f89
-
Filesize
581KB
MD529316f1e0c2c6c41d03ec0a5e567b4b6
SHA19f22221bcaee3627975dfa06766c3e4b5d5f3abe
SHA2568661a8e3ecda83a4b0e4ebd4c830620f603b5fcdf1d441b13c2c04252ca42253
SHA512ce560ee8108f27d8ef3e991bb126f3e325a09163f7522a14203eaa1086f4af6f1def191b3810760946d067e3ef5605b94e14f0d8be9c8df6d3556dd986959a68
-
Filesize
581KB
MD540a0208ab2c46f178d4bee1c1b32d750
SHA14fbd75a80cbe1a869b57d721a2d816114fb239ec
SHA25699d395e43f3a7a1c42fe55fc3fbe3164be9b3b2b64827f8ea71f1e73a5e994c3
SHA512d9e807ba46755155287301910bfd9083f8929fd2426dd9d9920b705f1a0ee597e6d9c3320636c7abda50de6bc9dd30a87e94bd0e179e438fd7ce4163a2a0353e
-
Filesize
581KB
MD5bc9f3a4563ae77e751054fef48857f89
SHA1c306e07fb70be3190952f948f1dcb7f0e4e0ac9d
SHA256f0d7e4c1bb8af809c1f748fdecf6a27e4406e2f6269ceb256619178a40c5214a
SHA512026f2602b3bcd62d36f42fa59ced44976254f53b874c7c7eb13c028ba3a8fe409f52a5fe4221720a36f6c459132c44fc4510c29e404b4d2c3093b429f12faec7
-
Filesize
581KB
MD5bf11e7b236078f4b5f1ea8d1573ade5b
SHA108706baa9c41377779703d01115bf56dd4717109
SHA256ae3f971c3a1fc49b96914a525feb0f6335ccdd9e28bfdb0a2e37e7d784721c1d
SHA512cc35227df22c6a0d793e24cdc4f0558f67e3d1aa2e546e034de32d738ce0528f54bca99d56f548f2b90ad0514823b6cf1c6ccb87534bc534e24663fa04685dcf
-
Filesize
581KB
MD5885e4cd1e1c639392982243c77df10fc
SHA1a62b37ab196f29a4221fbef4c85d979a968b3874
SHA2565c8749bff9edb7c6971b34fe37e258933f51fb686627a8412ca35a5b81ec93a5
SHA512a024f478544315c8bfcf6bdb29ad4f6209be09012502515b2a78e6514d6164d9576a6682253262e5101031cb4b587467b7f237871b49aef70f62d2f37cbfe885
-
Filesize
581KB
MD5c91b7a9d0c011eba856ad0b7df551d90
SHA10b2ac7f26443b39d3e613960f271cc8d14f1eeff
SHA256ee7aaa2fb0bf6111b4c07bb62f5d780510697979329be227f50734126cbab802
SHA5129795f3bc4c22a0dadf642344928d60315026f1580161cda0375ae21633f8ad50e552e3d3ef077dcf128dc41fb1f6d23ce704c2dbcd68022fb33e5dd5c420b15f
-
Filesize
581KB
MD5eb3bb8f1d75e82357fefe8b62da7b730
SHA10d3c1e7795b88c5149b3f0629da3aad917bcedb3
SHA2569422ed0aa7a34bb6395832aa3cbc65ecbc0f93fd69a00be2a5f82f19f8c1aa39
SHA512ca56e67a28190a7fa192dfdad892d5feca356c404cd3152c60283000f51d8bd20b14a0868d60e66ca6e79e2deba03609efeeb3a26ab954be5cb1461a65e4fa17
-
Filesize
581KB
MD5aa20c12e92b5df80790cc03e354bc0b4
SHA1d06d1c2920b656b1d08b587d70d67d205414d088
SHA256ce743de44b89ca9984306e23327d235e1f52b19942fe355cdf4b2af7ed068141
SHA5122a9d6a14ea9cd4e329019c8d31f28e167e56b4683c2a77dbc078a28aecd38a30a5fdad8412bf9e536ccdc34984f7604b8fca98e95e1eacfa962fe4e76dd84b32
-
Filesize
701KB
MD54192eb7477af0e94a0a74cf99e54c088
SHA12e41dda67ca79086a787575e3a582e598c8540a8
SHA256d261b55e610a4f817ec63e68b0e2e7141cf5b92b74885fd616356f3b7ff341f0
SHA51255794373f2787bdaa61f4c91276a3530baa558e1c74b70cd811b17e5c82a782d9a9fc76f50f88b501cab6750586e27ec9742a609109ac7b0cf82121626368b09
-
Filesize
659KB
MD5e0bed550f6242b26cef7c90198d8d5d9
SHA135d2887306b66605d8b97152a0cdbb8676980ff2
SHA256db8fdf32c8a436b7c8be6cddd5881bef38646c8c9d6d3481148a0ada4642b06a
SHA512c33edec161791b07dd8c60bf27dec582f96fbd5bd8d5d00ef7c1efda65c9aa2de5eeda4ae2dd6b7229bbf4f295df34e573f221a3d2704ebdf25f03574753ad00
-
Filesize
661KB
MD56a4627cffe3563e634a9d74de00e1438
SHA176e1819f29927815c97e7d49884ca1fc298829ed
SHA25679e76f86ff279782067d036452b3680444bde58e53bf0e54dee3fe071860c52e
SHA512b0da9402e6570ea35a8ab573dc3f37fc15c4e1b443f266a5529b896672131c794b24697800866258a387570516f8bc6ef46f6f5baab20da0c5db947f567e0178
-
Filesize
1.3MB
MD56ce081cac4c5f5494c11fa25f47c8d8c
SHA17142ad932ab1dc0af5c1c7d98bb77324fb9d2497
SHA256600a126ae09a2f8ad24d4dd89fa5605145409fa28a35b7fac3153b75821cbe97
SHA5124360d16aa9dac7f3484c95905ea6093cdecaf73d1753d4b27dbb15a68272be271b6b7c952e56732de8f5492f54741ca8c0aeb499c6e909a018fe0cee203f54fc
-
Filesize
1.2MB
MD504e2f40109f9aff14af8e3db09c13d1f
SHA1be17269e11a7425c097f42d9d762cb039905667f
SHA25656f9a21c4def860793357a8f652b6a5287b3451d78a6a9f592841e40e08c3a46
SHA512d50319af339debd6ac0900d35192eb9afad91cf8b794e67bfd26f364d2c12220c2eee766d4f120f42f244b393025f47cad052adc889392a658e29893fcf6aa6a