Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20/10/2024, 21:50
Behavioral task
behavioral1
Sample
4ed716fdfe57ca7c603b392a6fecc961ebe1b954e224d0a7be9261cd9611983e.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
4ed716fdfe57ca7c603b392a6fecc961ebe1b954e224d0a7be9261cd9611983e.exe
Resource
win10v2004-20241007-en
General
-
Target
4ed716fdfe57ca7c603b392a6fecc961ebe1b954e224d0a7be9261cd9611983e.exe
-
Size
186KB
-
MD5
41225f052f56cdf4ac215f320341d9d4
-
SHA1
1f8ac241c60345fcc668310858dded5907ea5e8f
-
SHA256
4ed716fdfe57ca7c603b392a6fecc961ebe1b954e224d0a7be9261cd9611983e
-
SHA512
9c4751d1a28651c7d918768ef2414a42c681ef4005ad168846a75dbd202e56742582b0864f58c7a0e11039147d2c25627b0dfca55b10df651b121b7146ca0b52
-
SSDEEP
1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8zxY5KwCyNYRyNYk7Zf/FAxTWY1++PJHK:fnyiQSox5KwC3knyiQSox5KwC3r
Malware Config
Signatures
-
Renames multiple (3713) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 2 IoCs
pid Process 2880 Zombie.exe 2800 _HeartbeatCache.xml.exe -
Loads dropped DLL 4 IoCs
pid Process 2792 4ed716fdfe57ca7c603b392a6fecc961ebe1b954e224d0a7be9261cd9611983e.exe 2792 4ed716fdfe57ca7c603b392a6fecc961ebe1b954e224d0a7be9261cd9611983e.exe 2792 4ed716fdfe57ca7c603b392a6fecc961ebe1b954e224d0a7be9261cd9611983e.exe 2792 4ed716fdfe57ca7c603b392a6fecc961ebe1b954e224d0a7be9261cd9611983e.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Zombie.exe 4ed716fdfe57ca7c603b392a6fecc961ebe1b954e224d0a7be9261cd9611983e.exe File created C:\Windows\SysWOW64\Zombie.exe 4ed716fdfe57ca7c603b392a6fecc961ebe1b954e224d0a7be9261cd9611983e.exe -
resource yara_rule behavioral1/memory/2792-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x00090000000120f6-9.dat upx behavioral1/memory/2880-12-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x0008000000016d63-21.dat upx behavioral1/files/0x0003000000003d6a-27.dat upx behavioral1/files/0x00140000000104c2-35.dat upx behavioral1/files/0x002a000000010667-36.dat upx behavioral1/files/0x0029000000010666-40.dat upx behavioral1/files/0x000b000000010604-46.dat upx behavioral1/files/0x0008000000016d6d-47.dat upx behavioral1/files/0x0004000000010664-58.dat upx behavioral1/files/0x00080000000106ef-61.dat upx behavioral1/memory/2792-62-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x0005000000010325-68.dat upx behavioral1/files/0x000200000001043c-76.dat upx behavioral1/files/0x0004000000010321-84.dat upx behavioral1/files/0x0002000000010611-90.dat upx behavioral1/files/0x0011000000010441-96.dat upx behavioral1/files/0x000200000001044b-101.dat upx behavioral1/files/0x000200000001044d-114.dat upx behavioral1/files/0x001300000000f83e-117.dat upx behavioral1/files/0x00050000000104bd-120.dat upx behavioral1/files/0x000200000001045a-126.dat upx behavioral1/files/0x00070000000104be-130.dat upx behavioral1/files/0x00070000000104be-133.dat upx behavioral1/files/0x0002000000010459-134.dat upx behavioral1/files/0x0002000000010459-137.dat upx behavioral1/files/0x0002000000010462-140.dat upx behavioral1/files/0x0002000000010462-143.dat upx behavioral1/files/0x000200000001045f-144.dat upx behavioral1/files/0x000200000001045d-150.dat upx behavioral1/files/0x0002000000010457-154.dat upx behavioral1/files/0x0002000000010456-158.dat upx behavioral1/files/0x0004000000010440-166.dat upx behavioral1/files/0x0003000000010456-174.dat upx behavioral1/files/0x0002000000010465-180.dat upx behavioral1/files/0x0002000000010465-183.dat upx behavioral1/files/0x000d000000010436-186.dat upx behavioral1/files/0x000d000000010436-189.dat upx behavioral1/files/0x0002000000010443-190.dat upx behavioral1/files/0x000200000001043f-196.dat upx behavioral1/files/0x0002000000010446-200.dat upx behavioral1/files/0x0002000000010316-204.dat upx behavioral1/files/0x000300000001043f-208.dat upx behavioral1/files/0x0002000000010310-212.dat upx behavioral1/files/0x0002000000010312-216.dat upx behavioral1/files/0x0003000000010312-222.dat upx behavioral1/files/0x000200000001030f-229.dat upx behavioral1/files/0x000200000001030d-235.dat upx behavioral1/files/0x000200000001030c-245.dat upx behavioral1/files/0x000300000001030c-250.dat upx behavioral1/files/0x0003000000010318-254.dat upx behavioral1/files/0x000400000001030c-258.dat upx behavioral1/files/0x0004000000010318-264.dat upx behavioral1/files/0x0004000000010318-267.dat upx behavioral1/files/0x000200000001031a-270.dat upx behavioral1/files/0x000200000001031b-274.dat upx behavioral1/files/0x000300000001031b-278.dat upx behavioral1/files/0x000300000001031b-283.dat upx behavioral1/files/0x000300000000fe9a-10265.dat upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Port_of_Spain.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Luxembourg.tmp Zombie.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Services.resources.dll.tmp _HeartbeatCache.xml.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkObj.dll.mui.tmp Zombie.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG_PAL.wmv.tmp _HeartbeatCache.xml.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-templates_zh_CN.jar.exe.tmp _HeartbeatCache.xml.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-io-ui.xml.tmp _HeartbeatCache.xml.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\de-DE\Hearts.exe.mui.tmp _HeartbeatCache.xml.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libscte27_plugin.dll.tmp _HeartbeatCache.xml.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Goose_Bay.tmp Zombie.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Amsterdam.tmp _HeartbeatCache.xml.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationRight_SelectionSubpicture.png.tmp _HeartbeatCache.xml.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\dt.jar.tmp _HeartbeatCache.xml.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-editor-mimelookup.jar.tmp Zombie.exe File created C:\Program Files\Java\jre7\lib\zi\America\Argentina\Cordoba.tmp Zombie.exe File created C:\Program Files\Java\jre7\lib\zi\America\Cuiaba.tmp Zombie.exe File created C:\Program Files\Windows Journal\Templates\To_Do_List.jtp.tmp _HeartbeatCache.xml.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi.tmp _HeartbeatCache.xml.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground_PAL.wmv.tmp _HeartbeatCache.xml.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pt-BR.pak.tmp Zombie.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\WindowsAccessBridge-64.dll.tmp _HeartbeatCache.xml.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.intro.nl_ja_4.4.0.v20140623020002.jar.tmp Zombie.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util-lookup_zh_CN.jar.tmp _HeartbeatCache.xml.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-templates.xml_hidden.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\fi.txt.tmp _HeartbeatCache.xml.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrusash.dat.tmp _HeartbeatCache.xml.exe File created C:\Program Files\Java\jre7\lib\jsse.jar.tmp Zombie.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libx264_plugin.dll.tmp _HeartbeatCache.xml.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\UIAutomationClient.resources.dll.tmp Zombie.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Singapore.tmp _HeartbeatCache.xml.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.databinding_1.6.200.v20140528-1422.jar.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-settings.xml.tmp Zombie.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Sand_Paper.jpg.tmp _HeartbeatCache.xml.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\charsets.jar.tmp Zombie.exe File opened for modification C:\Program Files\Java\jre7\bin\java.exe.tmp _HeartbeatCache.xml.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\view.html.tmp _HeartbeatCache.xml.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.nl_ja_4.4.0.v20140623020002.jar.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_mac.css.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages.properties.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Campo_Grande.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-host-remote.jar.tmp _HeartbeatCache.xml.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\Bissau.tmp Zombie.exe File opened for modification C:\Program Files\Windows Mail\wab.exe.tmp Zombie.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InputPersonalization.exe.mui.tmp _HeartbeatCache.xml.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll.tmp _HeartbeatCache.xml.exe File opened for modification C:\Program Files\Windows Journal\MSPVWCTL.DLL.tmp _HeartbeatCache.xml.exe File created C:\Program Files\Windows NT\TableTextService\TableTextServiceArray.txt.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Scoresbysund.tmp Zombie.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Mauritius.tmp _HeartbeatCache.xml.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Chisinau.tmp _HeartbeatCache.xml.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\bckgRes.dll.mui.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.update\platform.xml.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-favorites_ja.jar.tmp Zombie.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mshwLatin.dll.mui.tmp Zombie.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\FrameworkList.xml.tmp Zombie.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwritash.dat.tmp Zombie.exe File opened for modification C:\Program Files\VideoLAN\VLC\THANKS.txt.tmp _HeartbeatCache.xml.exe File created C:\Program Files\Java\jre7\lib\zi\Antarctica\Rothera.tmp Zombie.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_jpn.xml.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\awt.dll.tmp Zombie.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\deploy.dll.tmp _HeartbeatCache.xml.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\MANIFEST.MF.exe.tmp _HeartbeatCache.xml.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector.nl_ja_4.4.0.v20140623020002.jar.tmp _HeartbeatCache.xml.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\tipresx.dll.mui.tmp Zombie.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4ed716fdfe57ca7c603b392a6fecc961ebe1b954e224d0a7be9261cd9611983e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Zombie.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language _HeartbeatCache.xml.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2792 wrote to memory of 2880 2792 4ed716fdfe57ca7c603b392a6fecc961ebe1b954e224d0a7be9261cd9611983e.exe 30 PID 2792 wrote to memory of 2880 2792 4ed716fdfe57ca7c603b392a6fecc961ebe1b954e224d0a7be9261cd9611983e.exe 30 PID 2792 wrote to memory of 2880 2792 4ed716fdfe57ca7c603b392a6fecc961ebe1b954e224d0a7be9261cd9611983e.exe 30 PID 2792 wrote to memory of 2880 2792 4ed716fdfe57ca7c603b392a6fecc961ebe1b954e224d0a7be9261cd9611983e.exe 30 PID 2792 wrote to memory of 2800 2792 4ed716fdfe57ca7c603b392a6fecc961ebe1b954e224d0a7be9261cd9611983e.exe 31 PID 2792 wrote to memory of 2800 2792 4ed716fdfe57ca7c603b392a6fecc961ebe1b954e224d0a7be9261cd9611983e.exe 31 PID 2792 wrote to memory of 2800 2792 4ed716fdfe57ca7c603b392a6fecc961ebe1b954e224d0a7be9261cd9611983e.exe 31 PID 2792 wrote to memory of 2800 2792 4ed716fdfe57ca7c603b392a6fecc961ebe1b954e224d0a7be9261cd9611983e.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ed716fdfe57ca7c603b392a6fecc961ebe1b954e224d0a7be9261cd9611983e.exe"C:\Users\Admin\AppData\Local\Temp\4ed716fdfe57ca7c603b392a6fecc961ebe1b954e224d0a7be9261cd9611983e.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\SysWOW64\Zombie.exe"C:\Windows\system32\Zombie.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2880
-
-
C:\Users\Admin\AppData\Local\Temp\_HeartbeatCache.xml.exe"_HeartbeatCache.xml.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2800
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
748KB
MD5b6e6f17ca042a769cd46ba0cc28a406f
SHA1e6ce22ac76a79d9a98376a44ef2c51030909bec9
SHA256e48bdce48e54631a72a2ec28150ccc85efee1028cca3fca12e213b77b6d228c7
SHA5121c56331c7083010ed8c9da8d48ca67bae2a35cfa96ac5405435025b810cdc188e83047a597e70e24a25987358d669941266f3e95da81b3b1e6bebc84cbe122a8
-
Filesize
160KB
MD567942f49b045fea36c6f5b07949f73f4
SHA12460e8bf1c1d8e7038c0eeb7c7e4f5a1920b33f8
SHA2569e3b67a564eb524905c06b807049838bd3517cde9a65e11bdfd9398819e6b645
SHA5127595365f2969288649236aab823068b1197fd795c0c678f40292a1ffd9bd2b0b24b9a55e2c9c98d658d71875cea70f443924627cd5789105635c17662263c791
-
Filesize
1.3MB
MD5bbb51c6becde6cd6c0eccd0a7d5c4401
SHA1709520e9ba95f089723cf8f8172ffafbf67ac1c4
SHA25601464cba9364974db9c65511c25cd7382044eefd95eac4eb9f8d107d3ea8783b
SHA51252d46ff6988347f0484b8094b7401e76329ed80c528262260c9be4e8356516ed8572e513f517fa29bbf3033f06a8ccae53668249c63849fc9eabee309b3214ac
-
Filesize
238KB
MD5b2c60131cb74f4e1ed3da96e412da1d2
SHA1ea61b7898e37779f478e7b22484b7bf12c9ba88d
SHA25690ee4250ffa2cda26659022da953348c2a8b7aaa3a65a311b47e60e1421c253d
SHA512aead7401f6ef1a5793b696ff895fd49fa639e4e73aca292714b63d4ebf566ea6560e71bd4f16a513f118c90d3bbe1da69bf550d0a68b3b2db1e91e75f11f594f
-
Filesize
5.0MB
MD5307ca2a140fd40bb28c9b2cbeb35a2ce
SHA18b375b4e7d93bb4f1952da255b66f31679d36022
SHA2564c1895c53b31943d8fbd0b3af90d38f0a7749fa7f14b9a515eaddd83f86641ef
SHA512e0928248dd26ee9ea09f579657258cb25e84893fa21d2b8fb63267279844f4e1767767cf84d7d985c3e9fea359d8da4a3425d69febfa6e85431c8094996bd36a
-
Filesize
792KB
MD550e87c0d38666025dec6f8bd0dd91e9f
SHA1249d3b1d11ae79c6f10f4f5b9edb5d146cfe6c5a
SHA25664a7bcc1b56c0de55c09e52784c1a45db39675465f831a35826b85ae07e09b91
SHA51267299e9923a3de4fbad8a49988f9ad6724ad04a3e434e9f23ec121bd2c85f1fa1237b5eedf2a0ef9adcb1c3a2b61ca4997941ada44dd7f78193394502531cb15
-
Filesize
1.1MB
MD5bbbf6a583bda039ba7adb179886b2094
SHA1c1b3bbb03af41bb46d7af5bf6ed73f057b562e9b
SHA256e9f0c0075ad810eda525c35943ed4629850ab1f6aa1380d2ebf33032bf4f69b9
SHA51234c70a064a34ef9c8fa5a1be7a8beacf167c9172a482ff541da6434d19d7af7f942397e80aade1c7a61dce78edd06f5683fa7c151f9f60c1f488752b20f22ab2
-
Filesize
212KB
MD54bcc3426ac93c5bc552aba01f33ddc25
SHA14e1fb68fd5c1e8e84968e96de687ccdaef0917a8
SHA25669df7be585f9dbb513ed99b1c1bf17a87d34636cea4ecc895dd69c7eecd42524
SHA5128667084c900aa568d0a0228006f3451230548f231a2ebc7371f80a3e561e1a828d5e806ab49e7610c977fb7f63d56f46d39e02bb4910b7807c9b2d4a7ae8b9bd
-
Filesize
1.3MB
MD56ab34b72818678cad2eae70c064f59c9
SHA135d5c3a51f504c46f0991537e70f52260c9070ee
SHA25617803b43c6193d381451ccfadb94bf4497fd32e35fd5875e762ec0fc606459b2
SHA5124d4f4ea0117685e4e1e4cbcc317bb05b528ba14972f3e123d470c6033beeda3d05812db59ea9595e7ed3f36957bb2100efefa77645557cdcbef429b2512c5042
-
Filesize
1.5MB
MD5df4f904af5b06762548ff72336661365
SHA1c55d2748ec5918df8b4e23bdf6785f747beb58f1
SHA2569d2aced89e503772e9728f9f7937f70a4f75f6ced63d181d0ed84cc8f6b886e0
SHA512668aae8a9f0da18dd9e383ad7e74048f891bf2a3a0b7700a1ab7112b16c164e5083791d5a483af924959777edf5772f40aa07282a4d6b923b4ee155de976d25d
-
Filesize
5.6MB
MD51d20b56758d499a1a8acc63e3b19dab9
SHA1a2e8fa48d0b2042e3461ec36943f7fbfa7e59838
SHA25608b73ccce943125633b768dd245ef677fbb90ee5dd4b42b9d4e64b12c9353526
SHA512a2533dc601ac83505da892b970540c07b9750e26d2f9e8bd171592fcd9b0aebf75451467f52ca009329e43fec22e036016e10149823ae51f5c532a7c178a8e5d
-
Filesize
1.8MB
MD5eccbee51ec6fbacd48b933e301a1b0c0
SHA1fa1757ddeef9ee2f5c9b0a3abb19f71437512cee
SHA256fd6380f3f8057e6191f52a1760b75762ceca2286fe8525f9cebd2351cbc0b830
SHA512af353f432d1d5a917e3124f6e059b1e9fca77431b36a79dc77d1c60cfb1b41c1249e21d3b3ca3c6635596d8f652fd57e4f922fd8f35fa017d8ded497bfe4089c
-
Filesize
5.4MB
MD59fad34395fd6c261c573e69c256d5aa6
SHA1b1db1400d66d11794936b6702bfb2911711c12e8
SHA256baa72941afbe3b68b7a4f062720bed3f1735f6b7a8b4047322f76cbd1b8e0779
SHA5125d0311e6f4ce500b657dee850e4751d37b0bf9cc05a1de4958c0e613dd00853dd422f5569f145ce9e58dce557ea7bc90a881df58befce018ce31b6ea3a196882
-
Filesize
2.1MB
MD50733dd21a7ac07e288a5b98f4d98d3fc
SHA176092b53de8c004396a1a76af26b892eed0ba269
SHA256edaf48f93cb58afe92e58b185f2c9cfa7d9fe2e33bce629a5782ff8fc2cbe495
SHA512ace174e0e22c999f75e74ab0516ced292f78bc2d1c4dda3f7dad1646a010dfec525c127dec8ad96bc2b23c9fb94840d8567fa3e9de6f50185b453f781927a22d
-
Filesize
97KB
MD53763ee154059cc4d6811a36b8343256c
SHA18d960c261c58b5dcc68673236c250ce424d295f0
SHA256332a1bfd3e935bcf3d90428815e279299e60942b54b2671046939bab12f729bf
SHA512a5947c0fba6a7ee90abb95f2e54b51cb8138d8faeb03b65635c957949893e7ff5338bcf57f494f619564abdddd3aed9f3f1ba5e807f0bdc36fa140b9a735dc8a
-
Filesize
1.8MB
MD5b22827dec1da04c2ffb90c9a640a5b16
SHA193ee3630435fb4eb54f4bfe55ca1a2f61e64c54a
SHA256ca09883c509f6f648d849012a8d074482396b8a89a7f16de075633569d622be3
SHA5128c2f0ab38a98e9f9e3b8a80f9bdf0ffc3ce9a52ff836d06b0ea259d1f0eca3685511178e767054ab86d30d863866689ae761e105c1838635aa1c0b79bd2c24e9
-
Filesize
2.2MB
MD591cf5d9bb306460cd431eeaa13b3ab25
SHA13c002e1bf7d4741b4b2b1c95cd106d5d691ee37c
SHA256c89f951c3c2e686261f855963c462baccafe352c6f55864cbdd89713bf46aa5b
SHA51237db2d585b43c24a28173021ed549a26b81323eb170761bd8ddd486ab45cc30d7e0e93eb71ca3636adb881e85041681f9a4f9c3364b7c09b00445a4af4b1b347
-
Filesize
95KB
MD5651dc36d010b0bea49759d2b260c0258
SHA1c29fcbe14828d83108cb3a03b5e6d397874477c9
SHA2567a76c0df6ffa4e6af718e330c6d7cc38f85617a96eb82a387540be15848c32a4
SHA512c7f5a990921e80ccb6e4a4fe603bddbc84155b38013ffea053daeb88924f46954f719f32f5f613434b4fca71087c4e7bee697327ff1911887fd9c2e55c0a2039
-
Filesize
100KB
MD599e27341ed7692418fe0d0f805f6354d
SHA1ee914cfe2b155e00ac92e4d0c238a7cc05117942
SHA2567fcad2bd49e464495cb34290394a0a855a4781240b835b03d31945adc33ea3cc
SHA512c5df6f1a897b74a0077291fbbde2da718dc44e96fee6b9de04d9eb6512a5c69624d03567d4e684efea31a94c593f0f97827dc6b3688fdfb13b24dd103f7ddc1c
-
Filesize
12.7MB
MD5c4dced29f0e8faa55b79c62c6e3bb6b4
SHA106d83873a1efd26240f74faac2e24441f2bad585
SHA2567ad54c8378f1126b5cf5018ed05e541c7dd4f68a16e1c3eecab3c618606ce13f
SHA5126676860c7461fdc4dd5bd09852d52a6c42b0c5d3fe23ee88141c2dc03a5fa718dd0c427cbb80fd540a0da12c2b99464b61d2e5791983bf07cc4b6b392f1cae34
-
Filesize
328KB
MD506d23b401b2cc5787e61d4d7e503f343
SHA1cdd71031546f9f865526e6bf67e91bebb6466dfa
SHA256885c6962964e097dac29b0bfa2c7bc3b3207e2c889fd17b61951a9f8dab1732e
SHA512ce85f03bfbde8b708d4dd8d9ab876717b09d355cd384d1add1b375f90ad9a0f3905ea8e112fddc83a836e758b645e328d456516433bc06b9255fb09f39153ade
-
Filesize
740KB
MD5574928e74c99c8cdbd2fb142931c2cc9
SHA15552ef841aa18a66923f1e262d89a9ed7282ec1b
SHA256a16e4842c0385a24bfec2af367d066f3df93c86d4d2b6169013ad6bdcedfe17a
SHA51238ff435b1d4a944cfe5f897390bf703415d6b1a00e63f784d5cf80b0a60b1d3af6342ab0e0e2a19418dd621ce5d00839d9cc67a1080e2679e74d8ddec115b08a
-
Filesize
464KB
MD5445de804cb4ed919a09824da7adbab93
SHA1e15000e5b06c6e889a06bf7dcc3486f1b541e13c
SHA256268ecc9920b010c9247eabc6c94adcd0c7b6d58e4d851db07a473227d0447df4
SHA51240105cb9112e4dddcda6d5ca02fa5a95af033539042171537d73932e57db8bb5ab669bd420a56bce04a00838f2d6cfdaeb13f8a2f0c7072f5de66848ff82fb1e
-
Filesize
19.6MB
MD561294ece8ee7aca2be80f4c5ef0842ab
SHA18db5c01358f00ce85cdcff4fca7b13dfd3a8996d
SHA2563367d3a44ec8d58d9c0693f9f651d13350cff9d0b36ae51703065b0e39449eb3
SHA512a306ac491a22ea23cef3a97c330912873bf6866f9706214547c715d4b3911747a79a8768dd35379b3cfc6e745a988f5a7cac65649f76f3b76f6e0a9d6cfbc368
-
Filesize
745KB
MD511fd465988b8ca279aaf8a9cfb0bdf70
SHA14f51ff4686477c3f13d1388e2ff5e6659e864f81
SHA256b4c397980449cdab987403b2c7131df4ae155fcd19fe336ef55040ea49d686d9
SHA512a5222ece267e068d3765580cf690766381f1acd9ed2a1c374e70a1f9d867ae96782e855a89924315c586c86b27b6aeaf3105214c87cdfc3bb09928dc140cf771
-
Filesize
100KB
MD5c2187b64ff8294dfea5518a0ebadecd1
SHA1aac349d5514a6bfd04afcb07a1cdb0c692354f77
SHA256b7f61121fe478397228b49f43244a66483e2bb061f97e31636d9c7e0fdcd1a76
SHA51285a56d6ce177add2d50aa9c1ddb7fea384f5d12838959ce9caf4ec9c8a6af469c6f3aa973c890e370110a859dc7cdb6c78914d27931bc45ea3c57804f30eef0b
-
Filesize
94KB
MD543511c026c2d5364911570e0387a8661
SHA19520900865aa24d80d2406792102f1d596f9996b
SHA256aaa4d23ca4674f70c5eabd7ed0905c6851ceb1629c436b765ccf46b94d3829e7
SHA5125186646aea2e35da02920a4fa98549fc5db097edea3eff3e1d7474c0eba561227205d97079f595e04f14b2bdffe81bdbb1721f605065285cb2bb9dd86b615901
-
Filesize
98KB
MD563cbe812e2814dbed23d282f060170d7
SHA1c3eb5eb8ca81b4ac4175a9483ffa53802de37672
SHA25650901b9075607a882a719ae28aadf08d169859b1f537b60d202ed7b13054a769
SHA51222ef8a6972e8e50916b88a63b2aa957c0aa43d21ce32018bc13f3c4a097358b4408a9e288bc9943f574bbe3b3b47327a978dde56c747e1e1ca886bf44f2a783a
-
Filesize
56KB
MD53983a8954bbb4baa2ef04b81d12dad03
SHA1091a5d6d8be70105aa85a70e5d72e26775667347
SHA25650be7a1ab6ab717b911e00555726b418d16b2a82528c9e2b2b5be356279d9179
SHA512cb10a53daff4ae761e1b11a10d07bd103d158c06b55c76c42d6e0cc1679e51366b1e483a31933df7e15493648ca6dd8c1af0ca28e5d7447b02abe372742ddc55
-
Filesize
96KB
MD5d40cbb0dca1bbc2690f29d436e96b1a3
SHA1e2794f360e1a0ae76ed139b33016bb159aafc836
SHA2561b03ea1b508a59208ebd217a19fef2f0d65dc2be9652fe06c7c54950230d9683
SHA512a17c24d681e313218de3a29a0a4e5f0d59f4a1104e702523ee6ead5982ed1cb46f4776ef3110b289733f7e1dc409a67103b61096a3eb10c37e90739aa4d91bb2
-
Filesize
1.8MB
MD5f78356102ee2cdc7b915dccebc837948
SHA115854f373d53dbfa217b7c5f0cac7036f47e9011
SHA256e4c0e9a1dbb61e45139b574f79d8c500bfc2fe5ad378c84b9eff454ff18dff7c
SHA51275649b4b5abb44a4d6c67ceb598b99322a2a4792ef2536041b1d745490063782fdb94a0108b201764d8a1da5725ae40e3e11de936c87041a07e0a723c08eb39d
-
Filesize
2.0MB
MD5cdd858c50d24d529270eb231f3afc4ed
SHA103d4b47c6744d837297068781dac31ae3aeeaf9d
SHA2566c96aae69ef66a7330d486872794b662394373d628f51bfde9b5f1600a6bc1fe
SHA512fd9fa71460d0159a62fe23c683ded69637a4a10071c509cc73de3a4d7bc7227e65795c3c91057bd3242f2375cdfd7fcd17befe490e207dd921c7f9135552a920
-
Filesize
16.7MB
MD53f09377f63b40100a07c59f767dfa88d
SHA167fd74df45a694c8a6ed30777aef3b40db018da8
SHA256eff32d17b1bfcba7e882677670b35574ade5c848185ed77e9879fcc8a3ab28c2
SHA512ba31126fcf8211b594e4351d80c8e0af3f6735e5a4fb9502d1ea0aa709fd7724cc2c556f9fa2bdb8b625a0e05722568914f8468af2b9e146fd01d40020433099
-
Filesize
540KB
MD5797d3859684af2a6e93528b21f533a42
SHA1f55d7f1307cdfe9208e5f7bbaa6ce36919796c38
SHA25665b1cdfdf9883e50bfa7bde5e603f0b5ab84b0610caac5dc9f6d9ac0bdad24a5
SHA512acbdd54b099f8cf38652eeab6c5c2cd3757713bdae9f0228a6ce2f5c866d54b5c97f2b515d08519e0bb4b8e0a2ce5cf48e821ee02481a5cf4fe3d93ada795925
-
Filesize
4.0MB
MD5dfb8a7d17bff30f9d93af366e05386b2
SHA1fd958aa4a0c6d3c064606ce31a68874eea538501
SHA2569d321f704db8983e0859d68ffe5749ac73aa02dbfe1bb2ec7937f8e8f45484cb
SHA512a5ee24818438c09be88af0479a6d0bacb6b8b4e00d99edabbe10d1128573fd6742bdd6628c8b27a5f32f6df431aa7c98d4921a48cf2af7dafc4ab22eaa61c5d8
-
Filesize
1.8MB
MD5a2fd17e8a2f30d10e2fe4f8eb9029f82
SHA19402c5ca406940ad57464feb5936a12877d9f431
SHA256f1fa64c5ebc3dd98c5d1682e708880694dea2ebcc31535fb54e912c280580280
SHA512dbc5b5c9abd1e53a4940f99e9dea59c1c853f2ac076c4f1f5797c6fa9f356b03cdc0c5a96127f5c6483e4ebfaafabbc17f823c098aa2213c69b66826d8ca032c
-
Filesize
95KB
MD5a4d248417a15bf76211793b946d2ac66
SHA1b88f26d34185efcdd0315dfda8206bf68b476b9b
SHA25606f6ed00ae3af256db29d494dd6ea95b0c55abc20cf34031f8df272bb549eb77
SHA512a2cde63645265245080a26f114367cf8b90f625e0f8efc0d5d72764426ce3c15253f3c7acc8edb6013b040c769c097164c6e101802264c57a32a1aac559fd56d
-
Filesize
198KB
MD519c7eaa12c7a14a3e729ee0804947173
SHA1b8e16b2ee9a475b63a12c17359712ca1c427409f
SHA256ef16b26edbb5fc32c329cef34a1442560aa56b0db032c6964251c1baba23deb8
SHA5127dc8541921d828ad942db716e4654d8c31cffe67d039c00c65d5650e3cadce752c1573fed140d9008ff316b6d2b2eb029270301e729e0238f28265c935d892c7
-
Filesize
911KB
MD532fc8ef9b0c015e8beaaed152ded7e26
SHA1d3de55a17dac4e33130c01f9a5d982b590e45877
SHA2565d46b3266601950a215fdd2a3c8697af592108f90621da46175d8e54934adbfd
SHA512597e7948c150e30c989d35c3816fde3895e3aeb2a010a36151326429e171f6b50293b6dafce56413ba90b648cf72da62889097fed92efb3ea325a720a266f19b
-
Filesize
1.2MB
MD5a0d342a80e34fdd8629f1b0eb9c63ef5
SHA169e9349858b7a9dabfc8f6f787605f4697292c29
SHA2564ef3deff1932cb02af088f4fac9e92896538bbfc4307881dc64d4662f1a39b4c
SHA512e7cbbfa4da12a1be12622c5db7c3627307fc7658e4afe94f076d46b9d95d9d32c07f77c8a243d30157ea2283eb11494c6530faa7a40513b375b6a440f9abc38f
-
Filesize
727KB
MD53073fab38e58a0c6fe534c4492a133e8
SHA13b458f1414bfe59cfeecc8b21b417721a0b3d495
SHA25667a0c9ce197d6612efc2dd10a7b0a7a6103d8b8f3655f186be00dbf27c94259c
SHA512d31ef48b7e9e08afc32b637436b20341bd4ce6908c173c7a59b3458f12d10941d1f1db5ef84e6d5c17ddb7933c505598d2746396e552a4d456bf1f0b6338b8e2
-
Filesize
102KB
MD546207fd6737cd8ed9aa5d2e34bd194c0
SHA15f24f652e97d0c247d59c3f10b9bf6fa63e3fa10
SHA256cc42b9e534f9f94d4c33a701eb98ddb93e5d837eedf60b99b52b5d038f7e79ff
SHA51274bccf540933ffbc8c49b2218fb38ccd96bf2ee33c7848498804b6a3d5194c9433680c1c0953e38f493d3e99b44be30f88082dc6584b99f4398057d569773f1d
-
Filesize
99KB
MD56f9ed3725d40e69f73cccf09fccf4bd2
SHA1405537f8c99332b5561878437511b0f9fb647b5e
SHA25693a60c027d02094d60a31bc9685ed36e83fcb4ade8f0c1730cc2011ee44831e3
SHA512aade2ab92422034271d4532d4dd5de30d25d1b4b11c6565890da468339a2c5ffe1815117c6b2c14d4d8138e772225ec6e7ebc2824d4cabba94f8a7245bc899e2
-
Filesize
96KB
MD5a1edb01af86aef5b58697f08bc90dae1
SHA15267649b8c8e65ce4b7ee3b5a5e61d074245f45e
SHA25642d19fe02a53ad5eba913806d072f2a44aedc21a73eb7e827998b9801cfc12e9
SHA5125ee94c68bc4390630dbb880f69bc2781c95e9bf687fcde150c8666bfc824e6dfe16fdf7757b9646634c461e5a017bc693dc8688c7f8baf58f6acdceefd7d4ae8
-
Filesize
606KB
MD5384646c40cee4c14310fd4efadaec043
SHA1be98457f60969efcdc6544e29cd59b8de543c825
SHA256bc4dead1bbd94a30de72f5f4eb8364be143674e53b189a72a514d4d73d637b17
SHA5128be9235bfa32d88016be59da312d035fca68efde332c6784ed3913548d0dc05ea787dc811e08e851437a0f01c925ae8f3416f34d2a92d32f920c14bcbffda0f0
-
Filesize
600KB
MD5734343886ede8daf2027d58597418476
SHA1e985783450bfda2b150f3b20dee45128355dede7
SHA256414d7320950a3f936fafea3b37baadd40905fe1e55fa8750a7790ff105243ce9
SHA512d6743606436ff580bb0949a6b2b1524ddc74eb01132dd255253cbfea9eb59348dc30f1480e9d36172937f5dda24555d152298380901dbec92b856d59c3de5d48
-
Filesize
100KB
MD5832f3195b03bee1bdb6fbfc8d39b1d57
SHA1677146038a573cfe04ec771fdb294a9a86982a40
SHA256f1937619ef4e4bca4f7c493153df82f170b80d8f30a787e81af1c994bfe6cf0b
SHA51248c3889a02f72a8bcd1600d17795826564bd7a989bb65aeaecefcef47c05afc0886eba6fd4a957a582946f4b3a0afc7eab5f9e9e9b00a956a3ab88a2e6f7c753
-
Filesize
119KB
MD5f3c2a308031e6017d87be3fe883a06e1
SHA11e981207b34f978ba2afa084663c3ce81bc6da14
SHA256941e52e9437ff9248ea6dc53f9d841296369a1a8fccc20700e6eac6ab4e0fd82
SHA5121e1342ac144862b169055d9891b5424cf86ce229eec4a11a771b2b84207a5b3ebfb6d3c0c789d52983fa7bf2da94841108adcb4a24018b008f96623a80de3833
-
Filesize
158KB
MD5ce7448d96accc521595c40c102edab6b
SHA184a4cbee5d82257bd4ceb27a305d0746dc668e29
SHA25678ab6d57467a88c603bc2825f709fbb62130a0ca61d6e62ba4887574dc79cdda
SHA512c3db938be0f0fa407bdef09b5aa3a18ff79302f11044154f08a4da3c6eda0ab91f228d324aeceaf51366e572fb34631082a548b51dfb08be4e8d4d9c098de335
-
Filesize
1.2MB
MD5a45d7213ced97c4e1475513d7657cd5f
SHA1c0776a1aa0304439286f23f2cf66413cd663b7dc
SHA25648e141859789b4d0c3ef704a7bb3581eb473945b2d870f44d0026d488a4b55ef
SHA5124a9d87f69e2aeea9970e5f66a22cee06fbacf34212574bdb6c6ff78aff9e01b0f8b7bff55b4d825352be696067f00627673e57de1250ff6b3752bf7f39f9896a
-
Filesize
731KB
MD550f98e0be5478cd44d6c01bc421958a5
SHA15e65f4a6424f3f455504cb6adbe5bd0d6ae8803f
SHA2568a571e675edbd9261a3ce472ca8d0b69550e1b4a6cf6b3e108e778291fb99e02
SHA5126979ae2b9c4ebbb093410d5cb3345d3be77f6ddad8df5d3072c83eeb6da42bbc9afbecf1893575fc155d7da6d4dd22652be61c70e0e074cb22099b2ba4679e9b
-
Filesize
728KB
MD55a8512ab9bb74684bc9023e568355862
SHA1297d2eeaded0f09ec41e95e827fdf191196723c0
SHA2566f619b7fe6ae07fa58a518c0a9499477fb1a0f1842b77d043803bf37dc675585
SHA512fd8083accff73db9314b6f0babf2d1f61fdcc6b7bd67283461306a63f25bbf5b131198da9604c5ae98095279e094ce0d5270d6502ca95b85e46e836714ad4468
-
Filesize
728KB
MD5febb34cef427b284688e03a6cbd93ea5
SHA139272d4e4124b9310c4a3954df60e941042abd75
SHA256e4b11bf4fb63ade234601446c8472cdf3483b0c0c94760684c19f2151be71220
SHA5128ddfad981f6c553a2e2cd3ae41b226a71dba0a49129e8efe8af734b7d3cb08dd79c5afeb78af1f2be9952190b3c406c1b70e359e241af5c8014ba3091db816df
-
Filesize
97KB
MD5bc5c896f6e5b7f3df26721ba4e2ea1dd
SHA1b7d63a50d461baa35759e38ab274d63ab9ef28f2
SHA256fc6e5b188748cc7be8110fd0e794775df960119be79eb60440336eadabebd66b
SHA5129f6b3b37b637c001763e3604be50d8d03cf31a335d94b103b06fd0b4fa05b774e1d561b7d30e319413650b6c9a7ea48c109ef383c612f24c16cd5fcd3731662b
-
Filesize
96KB
MD5ec67a4042535bb13de57068ca95885ed
SHA17973c5f3d86273d4ec8cd83de84c7242f2599677
SHA256da1dd1c4e39a45f9f9a3050fe544da8a729bd7d3258fbae0e6bd1f2109073a66
SHA512ee8bda26f1d8f1abf10aeff24d92de53c4b3f672d4f24137a769bcacc87b530d0ac848e387a1d9bf8917029e12c774357b6af6d811b7367e60b3ad0366206757
-
Filesize
1.8MB
MD5efe54e258f41ff26ec841715199229f3
SHA167fbdb607c83950ad822e2b92a7282bf51eaa97b
SHA2568b6e5402314c192f3847766f1b61a0705f2d37b18a84e4ae9ccfc73fbbe3b4d8
SHA512b574e005df0b5d9687c6915bdd1bfd9d0cabaca6b1958967c907948e6ea93d4a2ff24cd57ace635b7fba9c3ac1d6212ca823f18b76ec5cb30eb95b36532e59d5
-
Filesize
94KB
MD5c495a3642b6b629c2b640240a789dfb8
SHA1dc8e462809529d873de3a5e93fc24f5dd776d9e6
SHA256f24537b55166ff4b746bec2c2798f664d0f42dec4d14d2bacc66d20bee936eba
SHA5124dc8142f8855f2561bba604f70f948e00fdeac6031dbdb6dbd8b7c0db19f8aab3876eea76336ec1e32489d04f6ddbc1b517ab88e684554582794f98877cf14f4
-
Filesize
93KB
MD56a09d472eb93a080af8d511b7aac231a
SHA1f08209061af5f887cc63abb2d465cb7ed72ff24b
SHA2561551bb6bb6ee27fb98d63688e8ae999862fdf11543fc8ed77702e6a573615fcd
SHA5123abadc49041ba3f5703c887e7df3eecc285c880f02fe56d23a7ec4e18fef05cd3540493b26fa5e471b7383258b9d02efa37fe684b0f2246b746670f01130c1e6
-
Filesize
92KB
MD59936dab3d2cc8b66637c74e87bdf5c80
SHA1aa24cb1170a6c6339a8439534a9d0ba2b5f54993
SHA256cde205e1c4646b3a2a3cdaa0ce787198e8ff278b0899eee608e644f836c44955
SHA51226a48f65b80642bb5f0a832347cb958f4e5c7b9e47ffec574a7923c554c9e8d39db618e7e3224cb2bcbf77f92944b735f6d2decb75edcd45b2e532c16156275a