Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25/10/2024, 21:15
Static task
static1
Behavioral task
behavioral1
Sample
45e321779dded0668dceef95802c3540769bc219f05ed529c2bf076213435259.exe
Resource
win7-20240903-en
General
-
Target
45e321779dded0668dceef95802c3540769bc219f05ed529c2bf076213435259.exe
-
Size
841KB
-
MD5
93b8d17445bcdeb1ca313220713f41e2
-
SHA1
1412d07340cacbe3f303b1c39fbef835e08998b1
-
SHA256
45e321779dded0668dceef95802c3540769bc219f05ed529c2bf076213435259
-
SHA512
94cf278fb0dc42b952496c37110217c9cecdcf949003dae7b095304faf46164cbb9fd4577920af76048be39fb3be95cabc4ce00e78977ceade20c390a3b0a367
-
SSDEEP
24576:VT9aLl3z0zDXg9qB4FIr56y5DY4LpB4Y3olGSY8:VTQLljWgoOYDVLpB4YYllH
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 1344 alg.exe 2892 DiagnosticsHub.StandardCollector.Service.exe 4344 fxssvc.exe 4700 elevation_service.exe 4752 elevation_service.exe 3960 maintenanceservice.exe 3924 OSE.EXE -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 11 IoCs
description ioc Process File opened for modification C:\Windows\System32\alg.exe 45e321779dded0668dceef95802c3540769bc219f05ed529c2bf076213435259.exe File opened for modification C:\Windows\system32\fxssvc.exe 45e321779dded0668dceef95802c3540769bc219f05ed529c2bf076213435259.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe 45e321779dded0668dceef95802c3540769bc219f05ed529c2bf076213435259.exe File opened for modification C:\Windows\system32\dllhost.exe 45e321779dded0668dceef95802c3540769bc219f05ed529c2bf076213435259.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 45e321779dded0668dceef95802c3540769bc219f05ed529c2bf076213435259.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\fac1559894857919.bin alg.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateComRegisterShell64.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe alg.exe File opened for modification C:\Program Files\dotnet\dotnet.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7zG.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe alg.exe File opened for modification C:\Program Files\7-Zip\7zG.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdate.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 45e321779dded0668dceef95802c3540769bc219f05ed529c2bf076213435259.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2892 DiagnosticsHub.StandardCollector.Service.exe 2892 DiagnosticsHub.StandardCollector.Service.exe 2892 DiagnosticsHub.StandardCollector.Service.exe 2892 DiagnosticsHub.StandardCollector.Service.exe 2892 DiagnosticsHub.StandardCollector.Service.exe 2892 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 660 Process not Found 660 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3244 45e321779dded0668dceef95802c3540769bc219f05ed529c2bf076213435259.exe Token: SeAuditPrivilege 4344 fxssvc.exe Token: SeDebugPrivilege 1344 alg.exe Token: SeDebugPrivilege 1344 alg.exe Token: SeDebugPrivilege 1344 alg.exe Token: SeDebugPrivilege 2892 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\45e321779dded0668dceef95802c3540769bc219f05ed529c2bf076213435259.exe"C:\Users\Admin\AppData\Local\Temp\45e321779dded0668dceef95802c3540769bc219f05ed529c2bf076213435259.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3244
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1344
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2892
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:2444
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4344
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4700
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4752
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:3960
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:3924
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD58cf65bd697d9d0b9a71a85b961f26dee
SHA1251009b78508939a0948070081d6fd7de4adfda0
SHA2561c322432c98c197fb4ee1dd9cc0b09547d8d2b78546f81a4eef308b2fee7fa3e
SHA51259d2b621568822db54c220b11b44fb32ad1fee00697c4036c740976bb51830582c4ad4e73b90ee50b0148183bad8c666a8832334ebff654d566feb9871e11d13
-
Filesize
789KB
MD506f84db3626c372a57ad3c937e37f680
SHA13e6b3c5de2d7dad81a6b431106f5a9f19f7cc825
SHA256f7ef79f42d4a3a0a8c2b71705fadd9faec53c1ee1b5b5e4f6ec20c8c01a18410
SHA512a0eee395e49e09a55e6003abe9c0286aa7a35e64b401dc56afc73370289b494d394ed5fe28cfa4891799c1755dcb400f5900927cb48e37fec526f253070377e1
-
Filesize
1.1MB
MD5c16c2b0c86a3ba3db7896939e3cd26f8
SHA198e12ed0bf60162c75c7877fd6f372d2e02376d4
SHA2567f55a45cc256bf648d9028dd13e2ca81ee8009ca529df2e78f7cb67c95e4a8e3
SHA51280c9cbd40284330580c46521d50ce9a36ea830c5334aed20a3928083d76aeb930735777f1c13a63af3d7101c9d207aceba40d125846630ab55eeb10826419721
-
Filesize
1.5MB
MD50437d2dc78b490ecd84210295c497b82
SHA1db11eb1354aefab183f1646e9cc4b310cefd1bb6
SHA2566294d3e6e91974a137cee4246932706742428477c9dc4cc6d61d09f47d92a65a
SHA512838750f41514401f635d1f4eb6bbb039e45e96430f1cbbcc8690574a45711cd86a7ea692f75a3c49202e2fbe58468dcf4fd8b86ae124671e2e741563eda0d275
-
Filesize
1.2MB
MD58be97a01f148339b28b927cec1421375
SHA184ac0c2e2d485f29ef4ad4e5e5619accedbe4a95
SHA2561c18683fdbbaf4cb3934d07d9ec5a53d84209b6a347975706125240280005b21
SHA51277adc1099c50986e490888c6804bb29c07b5f8ed3511b4810fe5d87f3e669064ec9dfc8dca17f92a791f1e3158e2c5d858799130bf23f95dce0dcce9c1765289
-
Filesize
582KB
MD517564675d4f4908b3761740db2740bf2
SHA1cfb9795625eb76be2e855e2537698d7dba5d1918
SHA256c3465cbeba9245220e3ba095a842e8cf6f3a662086d374dc98e57d1d3e7bb2bc
SHA512d043d0f61996196ff38ba8b061b4cedd5df03f4a216f883599c80d364c797a612008eb7897e988b0506b6acea04f41e927d7e347648ca93c2bf5cc7619864f68
-
Filesize
840KB
MD51f1390819e010a6430a3d1554e4b1bfd
SHA17cf12b6002bb606991c58a1fcf56cd99894a8de7
SHA2566e6c576a755339692968f074fa519bec2cbc16b9770acf53e1efadf3f4b7a95e
SHA51273f02d90a8efc82907b7b3cb9f691fa878f2d1e329883f235f5ee71c31125f35896cb129fe93460c05eb817ce1f5fce550c4537627c143d9cf02989948f23e79
-
Filesize
4.6MB
MD59480b39a24156528f8070fe1430b768a
SHA1b16e0ff971f3392799c866aac5edacda2e58a48c
SHA2564f03aa74da0086f62a32fb929731b9ca9a13beb640cee0592d68ab1f3b0a64c5
SHA51230d77c9f0c8fdda7fb924dee4fcdb16b809e963201844df531d5d4fc91a167111a1746d21b775d8a9cbc8e2785e21600aa071f26ee27b9f60c4146673a4617d3
-
Filesize
910KB
MD5b2410b3245935ac98aeaf014cd52574a
SHA19dbe0f31ea82c5bae355046911c45b71439c2a14
SHA256a91a1d9bff0084effe56f581aec5567165588838cd6fb900e2e5fbd9f04b324c
SHA512e909427612389e02035dd9d43b23ebe2f16cb1563fcd748ef8b1b8757d004e0237dbfc6f9c9747796aa535e5504475111c9d62ab63b8bf31687f40005e2f5e72
-
Filesize
24.0MB
MD505340ca1fdb7a009ce0c9bed90f25f87
SHA1a8b8c3fa74d953ecf21cc276674a613ff012fc33
SHA256e3f529a76d9cd7e82bc7c3fd13d98b5dce25c0845f1c30d2438cff583381d7d7
SHA512a9d749bff2f8ce0739f7371102da7b841da825e4b4ef204aa4ee984bdc5b8aff62f325ed3ce3c7d6ff675ebad5206b66327458c4d093a706c859e2505096bb05
-
Filesize
2.7MB
MD5dd67b3379c300c2592b8633b2762896e
SHA14d6659cf747a71790c05d5c9ae5192d429c7a639
SHA25683113aeb5e8c0f201fd624b9c144ad8230e9f8ebcda2759a01478163366377f0
SHA51257c73c44a0434fe7de0f7743946d0516871568b20a22262798e035a4c30bd0e339e5aaafe92e19a1f870c246d750975ae8359edac0156d9cfb0744b4b579b5a5
-
Filesize
1.1MB
MD57d31e075bc1286f0d5e16c4638e15231
SHA1fdff1f715dcdcd3b53147996fe756eee3b4c7088
SHA256bf494ce232de08fe5ce32b82969425bd8e3378aee4312dae76ecdc2a5f631011
SHA512920331760c0bb146d3b4314ffb4ad6663a64c43d7348d5ea9702fdeb0535245520242ba65ae423726ab1a5c2bfa5572dc1e5114db156a72c98a7f7461ac69a63
-
Filesize
805KB
MD5523fb4b899d131bc6ebb0c62d7a30abe
SHA12dc81129f9d8840aac2b4b082d67d611013508d6
SHA256110f510126c293ec6ba39162960d6cdd1a2976115bf639314842046ce2d46df8
SHA5124b05e4670fae51a841a7a6f981b43f0770ae49cb9050f4d2f3d822b61f8523a1c4f921dfe2cd73482ffd3dac21eebf23b84f030faa8f335e429598cf42679466
-
Filesize
656KB
MD5eb112fd9204d510e5ff163f95807eee1
SHA1ac2bf0ae491a59d4b5751d846dc1d946b071c638
SHA2567f7a5b976079bfcef030dc2236cc85478b6cc6d13dd804ec878e85571e0805c0
SHA5129ab5ae381d8a8398059f9b8ebcd5d5598e1b62bf1ee369bf69cdf2e9fd962fad596a186a924ad3b997e3776f7ac0cbe1247d1b29e0d446a3b5c502d020649702
-
Filesize
4.6MB
MD56c878aba2242485afcbee3c620229dd2
SHA1be6df30943f612a1ef78cbd29780f8a7c62c2361
SHA25677ecb91174305ee00cc8c793ed0ce3f5b9d232d71f75b709e3aafd0d5949cb74
SHA512dcdf3061205a299b79367e820754d1c1ac470e39bbb236d451021d6fece991e3d51d3319ac383c9c487a20a0bb64f6c79bed4fb447a9dcbc3e9afdaa07cac2cf
-
Filesize
4.6MB
MD5c571718da686a089a2cd758ee9aa6310
SHA12bffb2a74d4c81a0024246197342c57b4c52e28d
SHA256e4c879be6ea582c9d59fa24f7db1a2548360e1161e03384c47567350c73f171a
SHA512df0f6905b31ecc3dfc92291420ea59391e6f79457785b73c615dc87507001191b72f163a1a605768832c8708bb080cc733fcf9a82968a1de949004adde5b5d6a
-
Filesize
1.9MB
MD5ad074c2b1e2ae89bf33be429345c9e41
SHA15e873a188750f0484ffd0df369d4c7f8526e38cc
SHA2569a42dde68ddcb82eb60d03c980eb7b01904e1f26d88b00aac3b7f53a86ca4431
SHA512ac0ed34d0a2ccfebd1665ebcb1cee3b332cbd5f9ad85e453db6290b317146a5c4b558a94e6cce3b988e434bcbe23e939bf92ceca7cddeef66eedc20b452da38e
-
Filesize
2.1MB
MD5069f003385eda6ff9b8a6eaccc3dbb00
SHA1fd34277db27bfcbf3f5ea9942dc7f3bb92718e85
SHA2567ab03f04d50de57a5500f7f06d64ad8254bc0633e4392803e91cedd361807176
SHA512b871a0fc875291c3faf64c4cefd34deca9a39ef70ba6a51b2d3d7f626ae469d0e4085f0ae91859f2caa4a4f766bd1b52be4178dcc8626af499b330097ebbb25b
-
Filesize
1.8MB
MD55273d8aa6c8e7e86ca0eb65a8de615aa
SHA1c5b9ff07f13e109f8387076ac6fa7c2b13bce307
SHA2569a834c955ee2eb817935cc688a7b3d39afb74c2e4593a96f721ec110cb4a3252
SHA51283be217256ef1c32b62f313e44429b5d637e5932ef3d1dcb560304cefd51980d09e504750a9c886d056703816eaa3cf164e67a497a0d7a059c53c31f47565dc9
-
Filesize
1.6MB
MD5061cbbb8cb8cbe7f9fc57e7035d8a1e9
SHA19f5ad7183121595eea148e8a6ad70172973469f5
SHA256f6a8fd80e5803c518df5a89dacbe03d702a8ba5bbd9be4f4b1fcffc16f7099bc
SHA512232d1812f7959b4f1a9e6dcbae8cded927903bf7bc4768e843831ad432875e4be04ff515cd4eb2d7607a8529afb061b0b7063731f7fc0af2e9cbd88c2a113c97
-
Filesize
581KB
MD503e79e22ee0357a35e0f895accb54e56
SHA1fe753351fa973df817bafd202da6c392bea2acf5
SHA2567c6a7fb17c3aef6200bdb83f774212cb7af0449a1a25349b22c5dcb75cbeb497
SHA512ffb74510b5084b28b972205e969446fbaedd098994e92d341c4f61bd0b5560749cd2d473bb10ab9876b8c1800d6b1ee4d4d524beb5d2e2d5c4288666545fde68
-
Filesize
581KB
MD5e0588d5ab908d93c12c13fcf49c499c5
SHA1adf504909087fb999d59a023d1f6bc174483b84c
SHA256064f4932f53e900d44eb299fb52031ef506cb7c166b18fd63f01a2d8e6544640
SHA51270d26ab112cd9559c5b70dffb568e71038faafa04e4efca7aa2f8df0319ecc325322313912a7d5fbde6b879e9f04953f120205c3cb5ff82602815e53bb8dade7
-
Filesize
581KB
MD5a93226d1f12e279e7c3fd4fa4f97bb22
SHA1c96ce52cb00d456eacf0f14b3390a3886731afa3
SHA256c952944dbc21ac3156d123b8e2e684befe0466630d6872bab9cc6b3b03691e7b
SHA51294a3397645a7ce84a6bb3e5b4c5c57468daa3ee6230d92be3623f12b082939d0ac15a19e46cb15422de132261eb5e9f508645d8ea56e52a0a0949bac82afe88a
-
Filesize
601KB
MD51c64f7df117c46ccf70befe99e66ae7f
SHA133211d4e2760b5ed535dad05ba48257c52d7fc7a
SHA256f762c323afd8ea395ac9b18158867b143752f9941ab5891169adcf58679cf6e0
SHA5128777a38133732d7e7d24af4b8c862324f3aa15a139fa3e9bae649129115868b0b6a26bae4ec0d671006dc0c456275d6ef7d50d11a2c9ec5a8342646e9702f51f
-
Filesize
581KB
MD5c28a49da94ddaaab9d60bac6984a400b
SHA198178e352321f8e0f51681edc9da9d4e9b6d8232
SHA25675e54c5abae1f9d9ef84ffa14653fa4b711944e9a3603c9f8eb25ae797b15198
SHA512f4eb281e3e52f4c77cdc9b077445d8397b90c30d3cdfda088c50666a087f885f8d7895f227bd0296b81f36b33aac6cf9b65b4b70d768b2111441e4d1ec4a0d06
-
Filesize
581KB
MD5a2f0383645ef95847bde9ad121636c88
SHA198ff57823e64e61208c51a88b2c22f5ffca9c483
SHA25613a33039b5d7a2f29c5f92a8b43d10485039aee7a45f736205ce07125f7c05de
SHA5126bdaa05409d8e53bb370eb3d8e89b07b8e374dd5f0c4b1ec70d2cb112708d3ebbb208bdf2caf48633522dd2c5d3d229dcceaffa53170739e954fb822b3cab3d2
-
Filesize
581KB
MD5736f58c88809b275e3c0cf3fb13abfe2
SHA134881a7a8fc046aed0aa2e8c1b75a54e4acb839e
SHA256f674455d1c2338dceaf7c502db0357afe73fc04b956054950e18add07a901b9a
SHA512fd8578005c15e72a5cb9022d67600c75e33007cf1fc38b2dc6be3b2038425630e27c56582476a61020a0a1a292e44a33129267d70627aaebf7b4451b26140b11
-
Filesize
841KB
MD5fce68b3228742d9d7ab92a08e875bd7f
SHA15832dfe6761bd67433631b7661f218addd7c6771
SHA256122b83a493ffdd87bcb73825537cd11b33f01092dd4af23cd68ec8aa773599fd
SHA5122f08786222aed01ff31089ae63fb613d2c0f8de4c6fe67ff18201e2006a59e73c2777abf0d802f863f09eee2dd684cab1883f87e4aafadd2e24a1f407e9e53fe
-
Filesize
581KB
MD5b56ae57e319771d0cb766e101a463162
SHA15e8d853f0fcecc82949d298db97ceaa5af899ae0
SHA256f548f4d58588da43e714eed670e2fbae285e2f69a1eec32453a4fb01407ff5f7
SHA512ba98febdac877033e8aaf6a454e6e216006ef0222a790c7e548d86eb4a5c4d94ecf1c84513021392874fac1c6aa4a5e53f295f9314064e0b3576488f6f075e2a
-
Filesize
581KB
MD512f9d0e7d93d783ca4e72844c4d94b01
SHA1c082342e3905b473285671e8f750140ba99e2a45
SHA2566870207668b059b0cbad155bdbff643f8e29d5053d6e24d114673881c2edc9da
SHA512be4821cf4541d7f324dba623beb8884de59e8144649438eca2c455cbde9bfc7fa44f11f8d49ddad39dc90404a244130e2c3d8728726c59bd43de521116987056
-
Filesize
717KB
MD596a265d76026002005f85ca872733024
SHA1ef93b4cdb3c3ccb171ca7349627c04b419656219
SHA256df25d4e049f8d99ed96212511bbc1f81e0012ec8096724a270a57007458471e0
SHA512245772a8ed1ecae79a6c0c9cf8bfd1bafe1f8cc8953abc22658cb03319f5043cd9b8c451c4198186b27852fc13cef23a83a8f7d3e0e0c42de3e4790a1eb912b8
-
Filesize
581KB
MD51e77db00a68bc9ecc3a50d5fe7f675b2
SHA1f2e63566f954238efa643a04043dd78c6b9b17c1
SHA256960024da78d814f709c095c066536675f1e631887fe6a9a11b6b13752ab36a76
SHA5124bb1656eef6e20282a425a5eb98560bf868b25ef3e16e6c38ed5bbc0085eba0bae118249dd4bb594f4a58ec2092ceffcf43041cf76a6908be036d920918ed4d6
-
Filesize
581KB
MD5577c23af38faafb6303e3e47406df11a
SHA1fd76d5f16a1ce1a563d2db423188e411d76e8a76
SHA25607a467edf8e9a91bfdfa601ffb1603be267cc358c2f46924f22098bbaeca50ae
SHA512b7ae2ae450a37d64b8b2ce80aa8af6b8067ed324688a82a7012673cca322f80b41990f27eafe6c2ae9b6589913c35f42be03453fa813e0829fa260534d35c229
-
Filesize
717KB
MD5e809cf11119f3d644710a41b4d78b354
SHA1928f979207ac3660937688ee497eb7248a382ba6
SHA256574bacaee0aa553c6ea6dfe5feefb2ba7f7e029163e3e2c942a9ad40f3590f42
SHA5127fc2416df33d8164690b78fc9e3f4cf9f71285d47a60a852feb71bfb6897764acb003ff56accfaf992531d87c3551da2fe99009edbad6edfb2949b14d493646a
-
Filesize
841KB
MD54b8452459244a078e8fb25c5b154b6b1
SHA133ff2aac9683c82783449895469b2616f3dc1a1b
SHA2562e6b64da9fc401527eefd6469467d04fb82717fc70b2caaafc4adb211c55fc18
SHA512123751aa69b7c45e0e151a0f5051f705e0b72df11a1bf7c61a7024e0e06834cda44a7f69b3b8f7f777ea94d0d57fdfad3fd6f2c30e4e42632939387b153cbfb7
-
Filesize
1020KB
MD534328321c9dc13a9715223eacea5a9ee
SHA1e8d6f0441c651f52d0f77acb73f0ba248c02f18b
SHA256726454dbfc01e33f40907ce204192d3b3a58f43dd966fc4c7345fd91716b85d9
SHA512eaf54790beb6376f6c4ab083abc94003758951492396386abae943c4e9028c302b8954edc1d66d83e4442eb4b5d1f6515f610d65bdb36959564624811fe2db68
-
Filesize
581KB
MD56b1731a9b3dda1cc85e47db9fe6136ff
SHA1da5457220497ab0ea5f17c64aa3cfa3fcb32f9c9
SHA256c41642a6436a340b54480da678d77aaef9eb5a077d5d47725269dc8e0b9d034f
SHA51251e5944167e8d27771ce9e431574e2362ac47d4633b7877ee5cabd09a5a95a7f155354a7ca1ecac86493b49e568d4139a2748af296c3187ea265ec3bf0833d33
-
Filesize
581KB
MD50d5a8c25b0a039b89bbe9c2706bd2089
SHA1201957e7baca43a0a850937798b9059702b65035
SHA25606e0ebe703dab4753343ecb2fc3f41a77b721e7d9d155ae4ba93a1e3e39d77d1
SHA51268873ca6cad279f08f49f5767d50b82d19a8f4ecafec6558a66e77940886ccc0a5d53ae9be41cc902b5ffd969fc4bfd43b59cd8a9cbefe9102f2014e0cce915c
-
Filesize
581KB
MD5b94711b957f2cd6ac7c4ba0d5991a538
SHA1fe6548db3932d01d206f4d2efa4fb13d4eb6867d
SHA256f812d5757d98a129a2def2301bb48b96cf63a335138949fcbb4213f66ad4acdc
SHA512ab41216d5c7fd69a6aa1e786a4ded1e3ab1a5381a3b9f238e74e9a83c523e0ae38d8069c3d5f70ec5301c8bc3d6828850f92b02470fb65d62eb7fe6dad07d04d
-
Filesize
581KB
MD5bb0a24843a1b1a2cd890e4690afe0d9f
SHA16eb070cb4cf6bc037843688e616c89d6e9f0c406
SHA2563ec41886d50210e311fa3cb73fc22bdf58f10fcbe5c72ee0697d0b312946ddee
SHA5120c3449ee8a29b77e878c587f1918f4a726d2edd50a09d3ea2636c75e8be547ea57a9bff6a71e66b1fec6ac7b968ab7e93a8730c6d44a7967e185c8a1914d4bc2
-
Filesize
581KB
MD5c176ef2772f9044f6a19991242ad6c6c
SHA11fc228169e4f993830f018b6187339d0b3ac1860
SHA2564b75235346124b8cb251d6573d82030925571f7896154e1f7b2907331bf02d33
SHA5122f06615d7f8e25beb0eaa19d520999267007c681eaacb5cdccdaaaf5047820ae61093b8859220b092dbfb62bd19ddbbcbbdc4e55b498426879bacac33160af5f
-
Filesize
581KB
MD5b72edb8049a4eba694dd366415e8b013
SHA15569739e246af49c8d27c4f22560efef0fe26a68
SHA2564b8e8b0c33d23cbddd7cd993c4368ffae77f02251427a64695d4ad87d78bf1eb
SHA512a637b8558aafd404321a53fe3980ce0dfed0b5095716b542b8ab4b999a312b3ca922b96641da7ce88acf850150850a1b375c4e76afa3217ebac9802c7f6a5693
-
Filesize
581KB
MD50a30e96d26c600608f98f76ffea46c32
SHA1aa301ab58bbb81ee0c21bbf5224520ecdf170d7b
SHA256deaf2baa0e1d168e13c401e92da2e72f2849aab46d1a4a7df3b039e623fea3f9
SHA512009c731323cf65f31a2017491b86cdad435dee30579bde9af62181c8f4fca1c0d198e54038302c805722bb639064ce2f8a8f31ae0172db6c7551c995b92b1eb4
-
Filesize
581KB
MD5a4f84d1ba7f298ea57114a13e3e986cc
SHA1db69d071a7c35fe5eab72f106a718f3fbca81dc2
SHA2569e167ea5bf5ccd8c65a14a58ea3d487023457de1f2c1f8e4239c8244f4f476f3
SHA51298ea8dac19be87f14bd83cfb01c7469cfffef1294750bf4f34e8d2aa962f65ef597769bba1db812f50f4c00cd43148a9513fffbf4302b32dd88827b713890c25
-
Filesize
581KB
MD519eb651508e396c7e3799b0ae31d9a7b
SHA1aed0f33065987ad2dd70d0f4528ef5539d969012
SHA256cad430d01d457d240ccd777eaa9c6f5643238152de61356416162a70cffeaed7
SHA512e3173058dd24259916c4596bb3c23cca254793db22e10758d8533b637e36d6501b51947ddf46b334aef8b4c3985f04ce618d0e9dc9e9c56e4784b9990101b2f3
-
Filesize
581KB
MD5f308c1d8760e4cd425e96efcb84497d0
SHA106a43f33f95815a7c9181e0f57384b58d85fe418
SHA2567a3b951a0956617bfbe9bbfc5a5d3cb99844b6e2438cb0e81f4f260af053265d
SHA5120097eb70dc4375de8b42737e6eb6e7e4b99532c2883a1da10666a8a56164f3008e86e174f9cb3be62e1515603744d482d5e7929f0af3db048959f992824874bb
-
Filesize
581KB
MD5708795f1ecf2ad9ec24f8cf982c9183b
SHA13a02ce7a7f7bbd996a1a2a9bedbb5fbffbfd48ab
SHA256bb85ff625cd5c794ee01b2938f0e8d23502c6f80dcf6ae23152f6beb128437c5
SHA512d8eac93facf0fd64223f365a6263d954db87654d5ab4ac622b7aa79fdc6c2d0ca0d768a6497f4016e53e373836ca72e9c82209f2042761e3a06f238bdfaf8ada
-
Filesize
581KB
MD56f79aa02e49154d5e77d3683fed8dd95
SHA11d94c772a1fc8d9f869955464d0b435b8c1c45df
SHA256fa3ed5a8abca6c4694d7f46bbc60d61bdaebaf5d205500cdb06b48c4050c2a7b
SHA512f6d9d197cc654d021c7e50a57360e3ccc0a6f0a3d528627542a3a7d3a552b39a4ac041406f11ffa58a244afcc74a86494928ed5a2fd406cad6b6c3dce5e45eec
-
Filesize
581KB
MD5eb789952566a90cb558e176aefc00e58
SHA19646cae1bb23e147854cc1bbe7a4c5638c45186d
SHA2561153f7b39d959fc260697f54815e9fa52f6fe0a3a4d1c1396630df36581ed73c
SHA512ad6388047965203f995d47aa7db4a8c699bdc80aeda20f7dd9f579e7fc76630ab430f86b58ef8b58b1808bedc3ac1b34fba44d4b9812c9544ca473635c410bb4
-
Filesize
581KB
MD574b580eba5ffd24c934053b7693b262c
SHA1c0d64b7f6bb828b3355683789cc20f3da188b142
SHA256c9803a67cc968fba4b67889a678ee0968812bd211e2f623e58d906aac64a7966
SHA512715d3774c804a92b86185c85bfd7dc5c5b5911df7e9c40aa100ae4875c9783e19823b5cd70372bc8fca627c4369daad751dd1a4e35d1c52e52f99ac8cf358f27
-
Filesize
581KB
MD53d247e3d35b22d2c63857481fd64342d
SHA159a56f94e9692d8dc159ea25bf1aa42ad4af0341
SHA25636051799e771764ca82e884e46e3f8c5858636a0f9fe6cb423577d84ae5f6054
SHA512f9d6ab041d7be99d9d6e4e694fe77db126a49c136862765b86280d0095db00e257c0e97229b6031b77b8c0b35fe62ab50184f47cf2ce0e11346d3d59b10bea9c
-
Filesize
581KB
MD5a2b862473e821693128450835e2ebc12
SHA17507d093f63fd4507eeb2984198acc60391fbad5
SHA256368ec53cbba725018fa0bafe34de1235fae4f31c4743ae1977915355246eb62a
SHA5121f963e442d4f8b301f7bef6bffcf673742a6fb29a8f510cf1167d3faee03975bd3bff85c0af0818824a35239c3b1f01b027521258a115c2d881f608b3952267e
-
Filesize
581KB
MD532f365b4f00d6d1bc2e9cdcd34c16b32
SHA141da9509c8b5c8b06fed57ad33e8eba0e887d8df
SHA2564242ee01c46f3422e42e0b925f139399d0e774fecaa3eb7b3acc34e1a37ca6a0
SHA512b711f810351d37280604378b4f05f49e5090d3b207b4708e2e67a900aca7237019906d86555a3e590f0b3b878d560442083a61db42084ab773a65328c7827d31
-
Filesize
581KB
MD5f1ab827bdb8d3ab8e35ed9f8c2465aac
SHA174b4a10377228d7c2fc9013de9ee48fdebeae14e
SHA256064a8eac3ea5250679562036d097355aa4104f2edddfd5333739e44c5b1fc14e
SHA512cb66ec96c704a55b0dedd03feaa6af58ce7cdb50e1b6865c830bc0bcb1ffd7d39dd3278afd5d25dd198d64d63ca9a4b209c8909691e14cdb730f62464165ac15
-
Filesize
581KB
MD5c01207048c1dcce054d3b5cfa9d7842d
SHA16d902b11334cf482b7749b209602b958e0735e76
SHA256b3cc550ab0ff063f8fcebb7c83cd7e50764c087b6b10b522d5099f4c6c8165e8
SHA5121ebe7abacc7a14b620abf58b74b918c123a1076a96345986398a99eefa0313733c1fa7b536d47e8a8acbc38db5aede7816cf9f5f0c52b8cc41fed89ab6cd8381
-
Filesize
581KB
MD545b4959e6b3f214c4db20ddf2f334438
SHA107347986e70dcb2b67819a3b7c6ddcfd80edcde6
SHA25606e47434c9e31ddedb876428d62c559d5220a258a5df811ee7d92ddc79f86f6b
SHA512e66f1e2f6d85024c5af3ec47fe6dc15376080a29c59dd8014764ad7d3534f67005ba92b00853356f2363b924144a3b2ca6c02f68ba2209b168c8cfa1bddf0255
-
Filesize
581KB
MD57aa7b0487049beac04a504feb05f062f
SHA191404c3363fa8d2860b9fc2d47fad331248a688d
SHA25627fb13f07745571e57f95c58e10fedf6abbd8a058afe2108e7c6281704fcb413
SHA5122e73a8fb1e9ac81e65fa28fcc77b899b0b91c2bc179f9849468f00f0e094d1193aacd433682f88a2142888b99bb912d31244d0e8132eab2eaa0982d17bab9377
-
Filesize
701KB
MD582cc4e34c9183e32ba76ac155356f317
SHA1143446b799b739a03651e5382309a46582909c1e
SHA2564a69ef695ee7bf2675562c33f9ae4d6575c5005550fc1834987021fbf32d4932
SHA512f4287ef08b80dc7154b9a0a440708ec8836b4913a027b1696367062132ec5b4c3658c8808399f7fe6349ecbd275c9a824b302c1cd0ca4789a215c57d229fc633
-
Filesize
659KB
MD5e169e871d838b20674f3b8d43f9d676e
SHA1f31e08afd976bdd618776b7db2c81e21c1f2704a
SHA256c63670fefa16d958978c0a88c725ae9ee27f8234805cd51eaba50474162cc6fe
SHA5121bd118c004958c21eeaf81adf16dec884afb10ac006096e65067ff0dc941b5b1eb1f610dcc5a2f8e3b2f6d72442f164c50ee5f4d176f71013ea198cd34f7c512
-
Filesize
1.2MB
MD54bf221710757b8f0c3d046d5c9bccfe5
SHA1564aaa0440d382eec0b5f9ecdc43c77a90378047
SHA256458ea5e97c1c3eb877e4832d05e1d00c71e88bc8b5185de03830da75caf7cfab
SHA5128fac4062f3bc341b749f973a23a00e58c9b1385f0d90d376120550cff3cb4f5565561e8135509070bb79e211014fef17e2a29c68b4274f47c02b32d4fe4bd9df
-
Filesize
661KB
MD552435603fee51bd503818bfc9bb59cbc
SHA1b24ce591ae298577d9fd9d15124e669a38de9f8a
SHA256211228da687708d6d5fc771be2a159028754ddf33aeb8ef9db1f69204f5cdfaf
SHA512e264c78079d2b3a877341769be38146c8184fd4972d444d038c2ddd23c575592e664fe7dfb00f7deea22696af25e3b460980b1e39055b48d4334a04b1aed43a0
-
Filesize
1.3MB
MD530c2fc7494094341ca1c4343b810c7d3
SHA1a88a9116ba2a1210421313508d3e72f59969f92d
SHA256cc496e4a1930926c4cb6797f5d6030da724d0dd98aeadf7b585fc90bc7893873
SHA5129640f09ab9764a17354fcb4c3b54750c8c0513641790fb292a7cebb6ea874653dde108772c4ac88a17fddee6996cb845ee4f5ca4a49d08387d50a037d58c20f5