Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
19/07/2023, 15:20
Static task
static1
Behavioral task
behavioral1
Sample
f2b4c29f8f4966exe_JC.exe
Resource
win7-20230712-en
General
-
Target
f2b4c29f8f4966exe_JC.exe
-
Size
1.5MB
-
MD5
f2b4c29f8f496617b42bfcbe4cc803f6
-
SHA1
c457ce9c3bd5b7d7a8152a7305b063e4adbe3c65
-
SHA256
2dfa9f287e49b43658b54564e83f9a2744320083e485d2903b60668cdcf85060
-
SHA512
ff321ca01277c1e83cdf73e134392019db934b67a192eae1f56f19f6216071ebcbd0148a89452d684a51be5ec465fc5a82b7402d61ad8a5dff6ecf5e2d8f0c83
-
SSDEEP
24576:ciecWdptAB4xZuPxEfcBkND9A99JAKzzdCN/j2GLl3iFSE33b9:c9AB7ZEfOkNDejJ3wN/j2U4FH
Malware Config
Signatures
-
Executes dropped EXE 9 IoCs
pid Process 5104 alg.exe 4416 DiagnosticsHub.StandardCollector.Service.exe 4672 fxssvc.exe 3988 elevation_service.exe 1052 elevation_service.exe 468 maintenanceservice.exe 4884 msdtc.exe 3900 OSE.EXE 644 PerceptionSimulationService.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 18 IoCs
description ioc Process File opened for modification C:\Windows\system32\msiexec.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe f2b4c29f8f4966exe_JC.exe File opened for modification C:\Windows\system32\AppVClient.exe f2b4c29f8f4966exe_JC.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\a9479e4875b4061f.bin alg.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe f2b4c29f8f4966exe_JC.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\msiexec.exe f2b4c29f8f4966exe_JC.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe f2b4c29f8f4966exe_JC.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe f2b4c29f8f4966exe_JC.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe f2b4c29f8f4966exe_JC.exe File opened for modification C:\Windows\System32\msdtc.exe f2b4c29f8f4966exe_JC.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\msiexec.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jconsole.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsimport.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmap.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstat.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstatd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe f2b4c29f8f4966exe_JC.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe alg.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ktab.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javacpl.exe alg.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\serialver.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstack.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\policytool.exe alg.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdb.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jps.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE f2b4c29f8f4966exe_JC.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdb.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javacpl.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\xjc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe f2b4c29f8f4966exe_JC.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4416 DiagnosticsHub.StandardCollector.Service.exe 4416 DiagnosticsHub.StandardCollector.Service.exe 4416 DiagnosticsHub.StandardCollector.Service.exe 4416 DiagnosticsHub.StandardCollector.Service.exe 4416 DiagnosticsHub.StandardCollector.Service.exe 4416 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 672 Process not Found 672 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2980 f2b4c29f8f4966exe_JC.exe Token: SeAuditPrivilege 4672 fxssvc.exe Token: SeDebugPrivilege 5104 alg.exe Token: SeDebugPrivilege 5104 alg.exe Token: SeDebugPrivilege 5104 alg.exe Token: SeDebugPrivilege 4416 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f2b4c29f8f4966exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\f2b4c29f8f4966exe_JC.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2980
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5104
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4416
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:4904
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4672
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3988
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1052
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:468
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4884
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:3900
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:644
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD55f594b980648bba5a65ef1bb0b3995c5
SHA17dad11d9142a92e6b4867d35dfb9a6f2da29725a
SHA256a51405ee12ebd0100c7f77570c3e137258c01e3cb88a73f3a6cd549bc0014a36
SHA512ff25f6ba69a2668ab772b5f36d7f499142e264d591e63c40eb085ab5c71da00f06c4481fe323dce6c067fe716303e36afe2645e7d34c348f2decb4dc1b67afea
-
Filesize
2.1MB
MD58b36fa33d0ab7094939b37e50365af62
SHA13d7c2316990c7c9a5f8db0765978dd212dbbbfe0
SHA256a1fa3116fbdb057fdb0fb0992f0496c2121e9d7e756a63d1b6a32bf0631c1b91
SHA5125a967aa4a9e1d6d9d19b2b6e114ea0bf4076c2a6303e0d178e44946390b75795fdd8c193d73563e766f9580c1e1631da8c5cdb8e05b95697252b43942dba0b3a
-
Filesize
1.4MB
MD55808fc7bfbcd84ac7ff1bf420ec64fec
SHA14d572851ccd15063adaa442f9f31246e4e064b30
SHA2562a162c6296feab5ffd9e71a0378fb8495f1fe1a092d438855514684815c459f9
SHA5122a779da199c146291eb6e5848c38c765134d134c60598a9a72a603c3f23a11ff6e17aa5ca436ae6b102a0f6ace8e43ed60aa70310c68ea63426455061e0cbca5
-
Filesize
1.4MB
MD55808fc7bfbcd84ac7ff1bf420ec64fec
SHA14d572851ccd15063adaa442f9f31246e4e064b30
SHA2562a162c6296feab5ffd9e71a0378fb8495f1fe1a092d438855514684815c459f9
SHA5122a779da199c146291eb6e5848c38c765134d134c60598a9a72a603c3f23a11ff6e17aa5ca436ae6b102a0f6ace8e43ed60aa70310c68ea63426455061e0cbca5
-
Filesize
1.6MB
MD54ed0fe5b6eb3ecc74876c56df1f6a9e9
SHA1bf2108dd016abc5236cb5e6a52dea37a5a8757a9
SHA2565f6d0762a0d1895de0a324fd29b3e37d15c9995f9e1da575b17c1b38bdee55ce
SHA512cf8019e20d1a44b029face76e9d4bcc3956a0bbb3aad6954c119523bd1ec7822537552911f7f1c66bb77af0b900ad8ed6559a2c58bad762bfd585ead26f547c5
-
Filesize
1.4MB
MD593b2b569fa78b9697cd08d857481f49d
SHA1589a49285a0281db1dda726fa63ab6689476a389
SHA256053f01da14e5291f7a619821c82ff42edf365f79b545e0d0daca0ca3112735ed
SHA512a3f2094bc43a091ee11f5927605d1803e8987e1f430ee3fedb1487f953aa5e45a656bbdf03a0f271e912c271645209cab36a13f14e523b2ab2da1ae5ccca95da
-
Filesize
1.1MB
MD5058e150cce45856f6efadfaf57af9e6a
SHA1aa119e02947ec9f3487058da2579ab5b545b55bf
SHA2569da6204a1550df13ac6feb702c22e4b688f7862c13103f21af158848b1985075
SHA512cf14415b70676ae5db6c5f2a385447e16feed7ef1e3bd3df000c64ad0c70f7fe54031068aae2d0f6f9dca914e0378cc7aafb4962b23fab7be60b99eda6b26f72
-
Filesize
1.2MB
MD523de702fc4a4d0f7c24800ae1ec0e39e
SHA11d7e01f21709522eb59492313487cd8a74a8fdd1
SHA2567bd6fe105e20504f4b7efb19b9d368578ae50cbedf078af51ed2d848c0aaac94
SHA512d509042710aadcb86f5dd33e787f5d9116e172fb42d4e3bc5fda0b3a550f6744961350af256b4468e8411de755245f03def9b60b6a938cc869a9079171e31922
-
Filesize
1.4MB
MD5493db787a3d56ccb8841f9e7816880d9
SHA106da7a0930f80b8957e433226d980912be822066
SHA256285f88c44d24a513bf0b2237498cac5d5738bce42b1569200ed8b57f493e66a1
SHA512c0e29ad1a6ee2318365c85202444b401cff8e056c729eb1d2da5b6593f471b264310c8380e3055e78842865b1279d2468023bb37cd70fe72fce8fe3c5661e3e0
-
Filesize
4.6MB
MD5640c7947f670cfb2955edc57ac7927cd
SHA193ce4a812b8befc1573c7080ea84a033c2a4ba48
SHA25654562cc594af412ec86332699b64ee5699c2c1056b8c3cd8b47f16fd89ec1002
SHA5126e196dbb8bdbbec1e9ecbf5a5d6a19358c9f12d29aa0f372f893069ffbbc02309ce56eb0fef5dc747b80297ebcd3b269066f430c608367bb5df5829a2d47fa68
-
Filesize
1.5MB
MD50203afaa82d11af6003c92ec219f3b00
SHA162adbb9aacba028d104746d6a4d09174df6b5930
SHA25602d94e291f3ce78ddcd4f857cff44ecff897c972101424e8ed6bc46fd75915a5
SHA5120f41811b9f2c519d0a4a4bb87c65ef6f98506d4a085350c828a0e9f2503e02dc765960e21e79d02535f5848eb17d61f9d20f30043ad6b378ab54fc770eb2d9e6
-
Filesize
24.0MB
MD5f34ee81a2ebcb31881f1273e67096a65
SHA1986267c620069718b295f6227b1c162111548812
SHA256b4c17fee02ef2e7cf5b8240f5886612ddd84eff30f7f1c809af7dbf875d1934e
SHA512c6383bf70e46293b2b10b2cba2c459f2b26aba306c959565e9110bff793cff4ac9e2d8fc39a62dd25c9b7ca1fc01c9bf093af7ae2d502e12842b64b8a62e4259
-
Filesize
2.7MB
MD54d4f415f981f888624d266bddee7ed15
SHA1fb71182088457514673a0e0b5258dfa1bb74da85
SHA25695e46d23a87416a435cb6d8355c0e3c539eb4d8e6da86292e597c1ebec43b204
SHA512bcfde231b94638ca471b333f52abfc1c5ce4d7b38bd1a0c481071b9709eae5e238afe52d35cb7ee3361938a376c28c603e12fb3a41c034de3b38362c2ca6a2b2
-
Filesize
1.1MB
MD5966fdfc55209bba5de9a2b93346fba64
SHA187bdefba403bc62de27064466f193aa4cca4172c
SHA256e6383fd47f4f7e551eb6fc1746140c971d39ec48ec9234343c094fafcb29694e
SHA512eaf1302a945575b4d03a5ddd9213757af3875899fbe9c2b8a40992619c0e5a4d020805f3bfde4b884e4a19c15c3bddc4598d80f5fd806954ea2dcf71ae8243f2
-
Filesize
1.4MB
MD5863ab630ed08265398e1067378106515
SHA1fd322976e0b537f911d7bedb61cf52f369330797
SHA256a93c3a678c9d0b52f5451671f0fb3208680dd42b68aec8a26083031ea187bf40
SHA512669065ed1767fe93aa6881ab6eae1b3847e2e55d68d2e8b818771704fda9370f65430985727e3ea472c0311dca5197d5c31a23b27aca959bb76792bfa981c8e8
-
Filesize
1.3MB
MD5976c2f45a3ebc65bac5b8eabcc077097
SHA153363240e674deefd07caae0f4638bfe5c3ccb92
SHA25698ce836ff1d86be828f566b82568d44df55142dfc6dcd5c55792df5d529684c9
SHA512a2d029b6fba2da12bc0e775aee215119ce749fe641f2cc3869607d39ba1985b89afbbfdfae3ed3110b1c1a140ef79393aa1f51fc496c8c9f16b3524d2f9e1efc
-
Filesize
4.8MB
MD563b8770e0301570495aaab4fbf941676
SHA17591600aeb78c9fbbabff06e1a52e82645f1872c
SHA25692216e5059a830b20eadfccaf0c63de093213c6f8a61824e7d2ee065002f6772
SHA5126b709e917e1b7dfd96c205223ecfa899a7899788901548eee283d84c5fe69b9c60ec9c9998a625daeb82631dd14d2cb97a7eb833d149bed89184dd44d1a83c55
-
Filesize
4.8MB
MD51d17068774d4db2dcc5e5f35a9e33c9c
SHA111e2d5034c860e8c67be89feede2cceb633dda1a
SHA256e269b336475f3ea5d72feb8094ebee1a31709408f312d8a7455002bf052ef73c
SHA5122a3e33c5191ea0e4dd1cca445bc4ef59f3442483e133fe2189246db678d881e63327c08d666a00645b496ce25b893805ee89f19c44bf987aea1239b1d264e6b4
-
Filesize
2.2MB
MD51d77226451f333c81243cbab71ca96ee
SHA11596ef32dd20897fbfc0cd7ca104416832743782
SHA256e11f4fc4f9d603e68d103726d9c6aabbda9752823021501e3e870fadd628f9b1
SHA512fc55a915e582c643b8356bfba3a2aecdd22ef6364fb5fbbc9de58a85110563b9c91f2bdd63873b0658ea866fd11f1ae2dc0c6a81baba4b097920cf66b9093d82
-
Filesize
2.1MB
MD5fa16f8f9b9aa25ff2dd521fa48c42f83
SHA121512f7f999642bf2eab46468a25b248e9756a98
SHA25674001da0a53d847b78aa34e16c4f1593f1828b21d1cec87a0c19474107e750f5
SHA5121b412ebf9424040b917c3fd4218a143e57195534766b6ea0b1ce4655cedc08a9cd96521bcded27d3fe2ff97292d6dc342b98b97149fe2e351a234d6f7095b6da
-
Filesize
1.8MB
MD5f69b30f2b1dbbf0ec25ecac5e1f419f2
SHA110dd53c98c00a03782ef9f575c4446ec2e80deb4
SHA256eba48757cb9a43a9a7bd6c9316bafd1b4e3c3366a9e04b2ea85fba3e767e992d
SHA51281b8749dd431d0befe73c086bd1dd57d5f96faf5e2b48ace181bed53f3145e332583a1e67efa8105476717966fe221c4f280e1f4fbad34ca60268603359fb372
-
Filesize
1.5MB
MD50448c0355a0046c03a54335f751766cb
SHA1de00b0e1d72bd8b435f90e2b69a419886fc1f8e3
SHA256126c58d8cbe254e752e042af316036f4ee7b05898e94a90391aaaee2b55ebcf1
SHA5128624f6c43fedf7e95759cc5db852a907932bf36dc3c9ea15c678874522d45179d7466b55b5e24459f53d6ee7a50213634cf8c834ff23fc7861cb3283853df816
-
Filesize
1.2MB
MD531f4bab24d9a121c9cfdc25e3582560f
SHA17573557ae2797609904b2383aba57768e6397b2e
SHA25646979e508fdd5e69f38b1374f1696ba65f38047e98915e1cc68e082403b8b5b8
SHA512260738a9f486b4c8fde5a3a45159e6883a0b3420309b5a32161c72cea7eec9f0d3630632be93770c82c5a578192391b62252d0a14ee979c39276172f99386d6c
-
Filesize
1.2MB
MD5ee7474a8942b0363d319c6685b3cd75a
SHA1abfcad52e3c627d2c8b5ca89369367e2ad747422
SHA256aad10f02b657a6d691bfcb3f6e2fbd0fa14772968f8bc240042aa0a5c0192b46
SHA512d4e15965176c65c41b4b3f0f6dd9cc084e5fd18d0c21c27e0e1071378112f54ff46a454b8b583f4a8879cea648d27268b36879cdf352bf053e42cfb775fc4c1e
-
Filesize
1.2MB
MD513ede8875c9ba99944ac2e7c31d366a4
SHA101352748499f65ef60fc818c665e8f9504d3bc4a
SHA256772410a8b0c19ae20774427690216221d18458e2541f7d136263458587d6d9d5
SHA5128d99eeeae44a713246b1078ff011f2866ec17ed32008b950a93f59139359bbcfff0b548d0a5a0a9749be6f11bda79d75b2b38dc5624c83f7b27391e50c89b8e3
-
Filesize
1.2MB
MD5c468e0bacf7804c964397c317bfccf23
SHA15edce284118ecf2e08e1ef4c1248395d350acaf8
SHA256cdbc95eaf774df40e0efc3cf8a682d7edb7b3f548b803168bb60edfb8098a6b8
SHA512a63120f9ca4a734d8e95c25de791fa838b1bc72188395c405ad645c685eeb9b003871657009d278dd8b9e6ca7b420637ba5886a10df1de572b7a31b5585ce634
-
Filesize
1.2MB
MD5db3e04ede3c3e14e5cb95f6a19101a97
SHA1ee316fdcdc671e85a411ac837cf7bb82c3ccfcab
SHA256c03b8051ff7b19c38aeaf12dc6adf721c570de5722cef18252936fa0412e0db4
SHA5127a25563706f09c3f8672509dca69e3ae820a95d53fa66eb50416d994968a96b570aedb8e50b3798a7e4ce2c3c2c50f5c41c72b65f5f7036549ffe83990dc9564
-
Filesize
1.2MB
MD5d9660e8dd32de10987158cecf030459c
SHA1b23225004dd0554d9c9942ffb0b64cc865a5ff19
SHA256e7e9ab75805e7d536d17732d333e50928092b5eb9ef28261c1bf52907c48afb8
SHA5121efd1942ba14459dc04c2ffb89e1436ec900d2d43b8d8fdb297cccbf7f7a4e95194df0c5506e20ab27a2d339b442cb73d10d9dc383e9296038a1c8a718144f6a
-
Filesize
1.2MB
MD50cb8c32ca5bc2915c77fa64456357b4e
SHA144d491814d421c158f3c65540b2cf2b53276007a
SHA2567770887d13c3a9156af3541ea64451e76ffffa563092b77b0f68c23765eb7d3e
SHA512aea57c51681e6ce60810e1759a7c7a575e8969e9032e1bc97a0b40e9b4d5ea2c2a05e6b8a63fcaf9a7c85cb3d9ebdc29cd58451ecc220989c3d9f0786ce60599
-
Filesize
1.4MB
MD5e9f4009102840682a0b42eda7df9df21
SHA1fdb199a212e38b0cdeebf7c6bf57ed20061d1ca8
SHA25653ac8460be4d89f10fa8d95666037696aa503b40d90ab91269b1fae5456a9be3
SHA5128d715718c49d38b64cae65a3e9b9024173383955256aaab8e79efd4d773a1fd225b9384b8f9504d7ba2f64e4c27ba07721e8db4b071532eed7bc4c9c372fec9f
-
Filesize
1.2MB
MD5504c40e9b7c461358c80dcf7ddc0262a
SHA125a4c289507102829a1674ae3ee1d5051af2849e
SHA2567ab442ac9eb01bf45b583637da7665a3f59f684b6630c16f66a91178f74542e1
SHA5126e53dd30d5a2722ace1370f49f561fe7af13c2cec70111c48aea3f1bf8b6220e7af0fd13ce94d5a9a72c3285936faeb26970af79099a3002280f00d591ca222f
-
Filesize
1.2MB
MD54a43d4f1b256520f4c0a074be7630c54
SHA133957b2c99ea77379529f4196e87733c7551adcf
SHA256a36862578eb02522859872a8d360861b40f7d87dd26a54845c1d8d048e098c8f
SHA5120f69b3d2c6b8fa82db62a16543fa200b83e3c83eb7caa54267b8fe266378be6905da23e3bf8f05aeca4eea7d8c79cf7658dafb8944bb91857ae5dbd6995dace5
-
Filesize
1.3MB
MD5ebc287046b7902661f16bf0da37f375e
SHA1ece73299d6ded83eb990d7a69c2984ec039bdad1
SHA25618effef8e031d5f8c42919637bba0bb92fa4971bad13e8bda991d5d156d0a6d1
SHA5127ae5cd2207e0337646382d40b0d6b0769bba03f838e90222302337b018a03a180bd628739e531fab2cf12b3b994bbac882691f19a0b3c915636b6bad34eaf835
-
Filesize
1.2MB
MD5a33f221790e6de90451c7c108773de05
SHA12127a00dc3044f30383bdb3f0f75afeff076cd40
SHA2561524d3076b49794911801738704a7453e04f2a445fa8b53a26d32266c5783699
SHA51217521f7c8ca807a93c15b76634f6943a0a196c986bc339298bce583ef2b1760448a258272b9b8063c827967c0067c0aef8691532e95acc02bd1520b1ba8bd4ce
-
Filesize
1.2MB
MD522d683e12470e9f220e3ca4426e11fe7
SHA19b128417ce8c18703d9c413a39852d271fad6bf9
SHA256312ed40a10dbc3aeeedcdb1aa9b51c434384697fb032acfd2ed533dbac8d9e13
SHA5120de9178bd429d5f40533f235d092e72e7e5627efeb3c35edac40d3d4a7549c769fb9be93cdca0883db9f17aa3d5d4ee56074aa9420a50953362a801eacf6a11a
-
Filesize
1.3MB
MD5193f9f35155ceed98d86861c74ecf1e0
SHA165aa2a41407d7b036aae55be503f99ee53196da1
SHA2566efdebded60e8d843bbba35ba498ad23e0b350f7cc34a660900e52b731b7baf9
SHA512bb921908f3d7a08129a2da45d4909f0937a960472c839aba451213cd2f614381801d6b67035d63294c26a6af243af3c1ee1d5a7618577c9b3709fcf721daf5f9
-
Filesize
1.4MB
MD5eb66512cb34a502a29028bde61795047
SHA1cd144a2c5dd3dc4f1ae33d3029e371a5da416a0d
SHA25623dbce2efe9775d5c7801bdf8d77f362fbfb578eebfea01aede716c661a70b5a
SHA5128576463b7d2b2c12c58d36ed36da1afe96176aead94c325caf2708a5216465e1219304829b662b3f097bbef7f8e16dec540420338280d66e6064148865964c0f
-
Filesize
1.5MB
MD5b1d03047d1ca8c34cbb5275d15d62ee8
SHA10fbeb0dc5d8f438373783da8cc78b313f53ea229
SHA2560aec2d7aa6804a86608d2f0b10eed6c6fc3bcdcedc129b9a8f782f74211bd6da
SHA512bdf8fd845419f1f71d2893261ab5959f70cd5cc025d5f75b3673da68b13411cf6f631b0bfd85b854e826972cc4e548736a6a9d8c5aa8e1837c9dc6c4f2132946
-
Filesize
1.2MB
MD5e0f3999de026962bc53c12fe64bb2d80
SHA1e6b1c9d9a6de17b1e5e3a70c43f4ef4ccdcf17be
SHA2567678f9370a511e166835df67535ba738a2259e786c2b5e2751539d746edc0413
SHA51223eb0e6199be253dafebfa6e0e85aa0bf1c45608a54a2b5c45101778cd99c20455ea94b3932a4ae0d9a9182f4d5d607f979bd84f85d7b673949ff806ee3effb6
-
Filesize
1.2MB
MD5c591c8f28c5efe469ee8b78f9b42aed5
SHA1a7645404db6269fafebf111b2c19310d7a750857
SHA256a9ebcb1f11127d5eb06eb6013f667cfccf8bac74f493179ec5c541ee5cf71d7d
SHA51294b8a347eb23c48974fae1dfebafcaddfc4cb05e563f2c9541639b7883d856599cb7696dfe291c7dc063df404bb5a631a5cbb02c018346fc3109b657c6fa25dc
-
Filesize
1.2MB
MD5fec4122a0289ddfb852a3ec084b098e7
SHA169baa63ac87edd2929b99aff214008c83f87fd92
SHA25641728947f3edb3af4895122c3385ae715f33b49036f1cf235977b80e9469e0a1
SHA5125ecdafeab626670207ab6ff467cec642231ba2c714c009f424e8d1f5ef9221cafeae899884da44822da2342549c913794fbb949efb518272b7cc88f7396f60c3
-
Filesize
1.2MB
MD5fc03e7df6468202c056023658be813e3
SHA13c48def0ce2fe932fefec989e54a462adaa87eba
SHA256050d7e8ccbceab70583255bc0e84a3e5f742466e3966f2fc4fc73216208a44e1
SHA512db651ae0418cc2042dd2947b87d4ff291e7bf52b1bcb68c29ee6f9cc423b076b3a1d10e1edef89c78874d9717650ef0e53e2865e557564f47d65b99bfc138d7c
-
Filesize
1.2MB
MD5c3d938c0cf8e68c212a5a5a9aa773701
SHA10d5d9e882bc01a017ef6b85cd8e25be20c620126
SHA2563f1641077ba451f4dee90005c85418bf0346a364a7fa7658dbced26026fcb349
SHA512d21b5c464ffbe5df952ea68c87e8e02d19940d8f29802c011aaa3bd1416440683edbe0818168df96934d482bd5d70ef11ff1285b026a1b2b1bb06b7828363ad1
-
Filesize
1.2MB
MD57ed92cb7faef8a4be8d643f2123b2390
SHA1ffc6b92602608528f2c63d291a48d441ea2c28bd
SHA2560a759ebf766e783e4b9711febc15ced99bce4443a03233d8bce781cd7f31ec85
SHA51243d90789f722dcdf3c2bab6a1d649f97670fdfc7960fbacee24c09d62e7e804d5cfdb9bfd3d88e94e601fb3753c2b5acaa8e0b683063d85988f608bcf7165e4a
-
Filesize
1.2MB
MD5b061a0181761a68f8af552e123b3eb9f
SHA153e6bb545d8fbd9c65fd5b624ab4a9c64d215a53
SHA256b26f70da5dbc79ef8c6408984f5f31a2ff1d9faf3d6f23672a2907280908bec0
SHA51205c8c031769ac9a57f2d12790d0ba90f7cae24ed40ccea74e182beb9d0c2d0727bccd8caa8bf6ba94f801299374a28a4d2726f54ad11af9f4571cb50e9bc554f
-
Filesize
1.2MB
MD5f4ec8e243c29011668db57f8fa1015c2
SHA1c1aab48e1ebcf8b8e514856778fbf2cd720f5e5a
SHA256a6747509a3dcb40e2e30be25de5fdaf32adb8fc0cb3a2415a8f09303ab01b975
SHA5122f106842e3d08848ad8d9e000729ffc2a9d7348906d4a84626fb26946fc1f9529e56185957c56fff5fea8c857f04d1485b97583a7ea658a78a4a72cb2450c0b6
-
Filesize
1.5MB
MD511c130520559457f02b7621d19ea62c3
SHA1e504243b4f0cfee8958995b6576afe4134188aa4
SHA2567624c3d9e0ea02e35561f7d1399014d59a55c46d1770108a493c6690a576f35b
SHA5128a8c11df0354a9b65043df4901a99f341cc84b49ca0a03baa4872a8d5769c4c2c911057a5c8f6e7cf57202bfa333808420c7d8c033286259ed56bde01fc0cbf9
-
Filesize
1.2MB
MD5bb9d1e36d9a9ec3d4f9ca686dcb0d71f
SHA1a25246cc3807e70196008c1173c09b08f0b19668
SHA2569ff1f100f92096823b8cfb744557d8c40c84b5703e1ffd7979ae7e2153298d53
SHA512fc93bdc0f28a0160b9d6c925447633a5a6cd7bb3989be5733a9fd36cd476caf61f565d14daa74d295fefb1c6a3f0e0c198297e1926122a2c2473f62afba5ebaa
-
Filesize
1.2MB
MD5531fcc26c4d17c5a1549f4989ffe4d1b
SHA10680fc7f7299202ca08e339ca22558151387b749
SHA256fed6c11f434ae917b9ef779d98ba8f7479c66c9f08777782222b49c0b53c9805
SHA5125f7a98f33200462cf1128e6b71375b777408946e608636a118e8a1d4408df3b4794c8710261efd5fce80ed53f0a477a50941cc81c190a50daf5024756979ee28
-
Filesize
1.2MB
MD53040b0def6e1809a88c7f42e5d00d1dd
SHA1b4456ecf84e908c92629afa90a8af2a3f8ba1ef0
SHA2569d4a30af2343ea0fa733a33616714a72f3788c82b684141ef1f0411735ac061a
SHA512393ffd8f9a2ae103df3e1c87aaa763b65dd8898b1f8572085ea4983b5a0d6fd2e578dd8f410f8f92a9e9ed2ff24303e4012d7588c331998038c1ddd8da75bb32
-
Filesize
1.2MB
MD5596fd59191e1dbe1bad3ffd8258a1caa
SHA1f51e36a2f2aac55fdcb5ad85fa53569d01738d24
SHA256f6234e0b9e6e2b5c8942355a96c578a77fffde9d7b71fce7be68adb2dbeabee3
SHA51229a00f9881513dea9829b3fbea494713c5b78be486bfdab74286e82e9deed3fe09f729d76ef2c1fa70219f5c2bc3e54c59e35b9752ebf78e9361db074cd2b660
-
Filesize
1.2MB
MD5c75d097516508978475a8aa995d1d278
SHA13cfc8270fa76b6f797116717fae9fd0dc122413d
SHA256198420afa7837f0cc14dc78635d9ac0cbc8fe89bcdd862881363a9510c7c15c1
SHA5120d3a8182738e3efe51068cf4c547fef132ad23501e3486ff036808428897f18c96af596c936a25b875611815666dae59389aae15540518e90cd59763a1b4bbd5
-
Filesize
1.2MB
MD5e360b7c1264b4031fe37f89eddf99d33
SHA1c4006acac6d3f259394a91b1507d9d8df04ae68e
SHA2563a87a4f01e69e8c753d008611517941882a5764ced99b2ac38f5c11001218d6f
SHA512407a41a6eff8940b50659daa16bcb936a8a3fc067f632d09d4e87c5b2b3549461ca73d8ba7851637f629a40034682fb8954e127faea1f5f1410178bcf36d426a
-
Filesize
1.4MB
MD5b4cc66a928bead7835c69bfc6595c537
SHA12fd142335fec16f30971636dcd1abf0425521687
SHA25615ccccc20abb57fe33b375a82a0c52c34f1024ea2668a0a2311355f26fb42449
SHA51258dc4f48c089d359d3f6fe44a912c876bada371af6ca10a8f0fc2b9e70791f6e1fc91ab919e8002a76656cf86874218cd45343d590c7844ae36a1dd7e6c65b8e
-
Filesize
1.2MB
MD5564abeb0e2e4e75020c1eb5c7bfa1aa6
SHA1dad1ddac1bf880ffdc15001cc3146beb1c00438a
SHA256522b2585b1f80a2b68a2038566a86addeb1f3acab339b3cae7d2e301fd077cbc
SHA5127ff32ef6149df3e82ceedd8730be49a800d148ee233f435671d7c4e73936da5daa9365a54f9bb468212c3b6f9d077f2d843cd5f08eeff224a1b10bf0730e747a
-
Filesize
1.2MB
MD5290cafd62d50ab0cf051b2d3ce165bfb
SHA1ca6419442875031a9ef2109f0fbd18f7344a09d1
SHA256d3905f0621aed3387661579aa0da6b6e6679e648b354ea3db58be0677ef39bf9
SHA512d4368f8b12e446802c54fb5e744b55dbede498883f6f7c2de687913126713f3512c0f72d0080fe6a3e27e9679e3b2173e83cd5f06dec5d70e8957c0e7fff5193
-
Filesize
1.3MB
MD5fe6193f44bb7078af2dbb1918f56ef9a
SHA1373f40f7d33f5385679c727c1981a6434f73fe70
SHA2563ca4a6b60b4e8840f556c572ffb264b8eda02b066ce9f371e9bb4be759ce116b
SHA5129b9c35f361fb4fc59bb40459dbda887058369070e28be470493a5f5c2271a3d809cc51fa3fafb14d08c5e140a782236bf1753327c02552e1741113ad7d45807f
-
Filesize
1.2MB
MD5238483cdd87eb28e7b5a836948c2a40f
SHA18fa8262f005495a8d840c8601959ea511c82fb6f
SHA256adb7a2408c8d0e6e09002656e893969b4602fabdd901f05d2f311404ccb2ac03
SHA51226d7a792d3d9755884c5932b329757731efa691667254f59e6ef0bad6e00bb7a955aab605f8dc7c58e5e5cd969a2dd96ee2e73645c0aae63a8602d0581d836fd
-
Filesize
1.3MB
MD59e847dd3a32b95de27de30052dd8820b
SHA14dc6f0f6806b25cbd516872a80b98f63313f4578
SHA25695ebacdbc446339ee457f67bb8a732b013966f3fc90692d51c53a20bc7776d68
SHA512747026e9b948e6c7e402a13e2b4bac6ab9de16dd3a4ef823f81630e1e8cd6d1f1793a4f5994b026643c099aae8e1d1fbdd2ce43aaeec2189bf270893622ca427
-
Filesize
1.3MB
MD5a915e34967273ab5010dc32dc9c14920
SHA10f0598cfc53a8c7f9d28186fe1642d3aa1738fdd
SHA2565b170bcfc7f26452f6589b23c213ccd32c191352e9c6868bba3c42f975c5a55b
SHA512a94907712ba397f84ece68958ce23c73445b63fb7104fd1dff1241612c26044b01c3aa6989a2f6c20d6613c2c739bb7e2aabaadda4cd8e2236ee61c7440e9b2b
-
Filesize
1.3MB
MD5cb67dfc69ef2385b26936390055effd9
SHA10cd4782a3dce314858af87e354cf5f48556b1907
SHA256f3d70a792311ab26e885a74595eac386b04e43a4a9bbf2f15ddad758ac52b277
SHA5122730f143c97c2d5da23df2cae8b91c3d0304e6038d8d7d2dca5f608c178f7ad123901d6033ab45e2e0513a2060abba98af48a1e388c522d38fb0380f9ddeec1a
-
Filesize
1.3MB
MD5e42847c801b9d327917e6b39e8d016a6
SHA1e3acc390cec974c366ab90effaee61c2b35cc299
SHA256e9e577fb82df8731a1d3ecc52a8280dd29bba4b33d6a1acdcf484b7629a019db
SHA512dbeb755dba15445d73bbd74ba337b2f09fa4bce6ea4fa26f065196e6118ac4412e17070af9a45247a4ad612b640220cd340f37263172a0eaf308032bab05004b
-
Filesize
1.2MB
MD5238483cdd87eb28e7b5a836948c2a40f
SHA18fa8262f005495a8d840c8601959ea511c82fb6f
SHA256adb7a2408c8d0e6e09002656e893969b4602fabdd901f05d2f311404ccb2ac03
SHA51226d7a792d3d9755884c5932b329757731efa691667254f59e6ef0bad6e00bb7a955aab605f8dc7c58e5e5cd969a2dd96ee2e73645c0aae63a8602d0581d836fd
-
Filesize
1.2MB
MD5df3c6dac9652a86d1bcb8e6a93675890
SHA1015d0984d44d4cf70fbddfcb07d5e950c30ebc61
SHA2561729a46567842e771e6d99d3e2d1dd7e5492d0e32ea837cf91dae70618be835d
SHA5123a48e2e3a07abe77ae1607b8e671bf7beaafea061bc839038c0e22b92baa54dc8f6a725ad3a89a65302bda9a75da9019416635705896c5eb669316f3db3de3ac
-
Filesize
5.6MB
MD58ef728e300100389de1d88eadf5d337a
SHA1c7db74e16e98b73ebb91053eabdd7576bbb9744c
SHA2560ca17dc6bf240fa37fb9da2357aba013912f82ca20b327fe4b52d78183d32681
SHA512c5204da0d0bacea49b7961f3d3c420ff1585e68f052aa2bbf6085e268ab939dd07d44fdbd84595e9f7a6dc13ea212a6b29741145fb2636ee2570c6dc74a57d7b