Analysis
-
max time kernel
156s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
13-10-2023 02:59
Static task
static1
Behavioral task
behavioral1
Sample
a58cdef078051e1638fed400b12ff96e770becc39789128e44162e6e4dd2e72d.exe
Resource
win7-20230831-en
General
-
Target
a58cdef078051e1638fed400b12ff96e770becc39789128e44162e6e4dd2e72d.exe
-
Size
1.8MB
-
MD5
56343d4b7671c49382b1439b69a68e3f
-
SHA1
75a148fe69926b6e1af43f26afd61034b64b696e
-
SHA256
a58cdef078051e1638fed400b12ff96e770becc39789128e44162e6e4dd2e72d
-
SHA512
8c8bac9ccad893eaa56c48868a108ec0b3ce2098c25a4944ff4f24d1594c1c9e47ea82d847eb7ee01c94e90747631fb61b91756a11e4e4badd024b50649d956c
-
SSDEEP
49152:Vx5SUW/cxUitIGLsF0nb+tJVYleAMz77+WAh3/dk0fztKlcjI:VvbjVkjjCAzJcGUztKlcjI
Malware Config
Signatures
-
Executes dropped EXE 8 IoCs
pid Process 8 alg.exe 4884 DiagnosticsHub.StandardCollector.Service.exe 3724 fxssvc.exe 1392 elevation_service.exe 3172 elevation_service.exe 2796 maintenanceservice.exe 4900 msdtc.exe 4724 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 14 IoCs
description ioc Process File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe a58cdef078051e1638fed400b12ff96e770becc39789128e44162e6e4dd2e72d.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\22325a83f93f084.bin alg.exe File opened for modification C:\Windows\System32\msdtc.exe a58cdef078051e1638fed400b12ff96e770becc39789128e44162e6e4dd2e72d.exe File opened for modification C:\Windows\System32\alg.exe a58cdef078051e1638fed400b12ff96e770becc39789128e44162e6e4dd2e72d.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe a58cdef078051e1638fed400b12ff96e770becc39789128e44162e6e4dd2e72d.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe a58cdef078051e1638fed400b12ff96e770becc39789128e44162e6e4dd2e72d.exe File opened for modification C:\Windows\system32\fxssvc.exe a58cdef078051e1638fed400b12ff96e770becc39789128e44162e6e4dd2e72d.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Google\Temp\GUME157.tmp\goopdateres_ru.dll a58cdef078051e1638fed400b12ff96e770becc39789128e44162e6e4dd2e72d.exe File created C:\Program Files (x86)\Google\Temp\GUME157.tmp\goopdateres_vi.dll a58cdef078051e1638fed400b12ff96e770becc39789128e44162e6e4dd2e72d.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe alg.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmc.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstack.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Google\Temp\GUME157.tmp\goopdateres_mr.dll a58cdef078051e1638fed400b12ff96e770becc39789128e44162e6e4dd2e72d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Google\Temp\GUME157.tmp\goopdateres_bg.dll a58cdef078051e1638fed400b12ff96e770becc39789128e44162e6e4dd2e72d.exe File created C:\Program Files (x86)\Google\Temp\GUME157.tmp\goopdateres_ko.dll a58cdef078051e1638fed400b12ff96e770becc39789128e44162e6e4dd2e72d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\kinit.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe alg.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaw.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javac.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\xjc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstatd.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Google\Temp\GUME157.tmp\psmachine.dll a58cdef078051e1638fed400b12ff96e770becc39789128e44162e6e4dd2e72d.exe File created C:\Program Files (x86)\Google\Temp\GUME157.tmp\goopdateres_ta.dll a58cdef078051e1638fed400b12ff96e770becc39789128e44162e6e4dd2e72d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\pack200.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javadoc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsgen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Google\Temp\GUME157.tmp\goopdateres_hu.dll a58cdef078051e1638fed400b12ff96e770becc39789128e44162e6e4dd2e72d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Google\Temp\GUME157.tmp\goopdateres_ca.dll a58cdef078051e1638fed400b12ff96e770becc39789128e44162e6e4dd2e72d.exe File created C:\Program Files (x86)\Google\Temp\GUME157.tmp\goopdateres_sw.dll a58cdef078051e1638fed400b12ff96e770becc39789128e44162e6e4dd2e72d.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec64.exe alg.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdeps.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmic.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe a58cdef078051e1638fed400b12ff96e770becc39789128e44162e6e4dd2e72d.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 668 Process not Found 668 Process not Found -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 492 a58cdef078051e1638fed400b12ff96e770becc39789128e44162e6e4dd2e72d.exe Token: SeAuditPrivilege 3724 fxssvc.exe Token: SeDebugPrivilege 8 alg.exe Token: SeDebugPrivilege 8 alg.exe Token: SeDebugPrivilege 8 alg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a58cdef078051e1638fed400b12ff96e770becc39789128e44162e6e4dd2e72d.exe"C:\Users\Admin\AppData\Local\Temp\a58cdef078051e1638fed400b12ff96e770becc39789128e44162e6e4dd2e72d.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:492
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:8
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:4884
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:3128
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3724
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1392
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3172
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:2796
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4900
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4724
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD539cbd34dcbcbb182f2c969911d1787e3
SHA12424e7093ce45412aebac9b9a94690bf65e50781
SHA2568210d49f2645ae080c9a191061bcfc8ee38d354baa281717fcd35d2887308d3a
SHA512fee632609edcc8c402152b4dfb9ec2a9f6d81dfe897ab9d652752bb118c7a5ac2e6101db8e90d6f40368ba0bfdb9f6026fd064c6d3765d39cc6c2cec5d6be0e5
-
Filesize
781KB
MD55a16d66134de39955628bd80a5ada08c
SHA1a343ce49afd71ec9ca1eabcdecc198c33ef98f97
SHA2564f7f158224dc26781e6b322acfc2806ba9bc2e849f862dccbc54a4b2e85d4f55
SHA512c9c6a964c43d69fe23068473f7e178374f7ef2cfc497c9fd4521a3263b9ddf0fff718336d0000983ec01b86c3806b9fd8db6cb4f803982359c5d8a23dd5951fd
-
Filesize
781KB
MD55a16d66134de39955628bd80a5ada08c
SHA1a343ce49afd71ec9ca1eabcdecc198c33ef98f97
SHA2564f7f158224dc26781e6b322acfc2806ba9bc2e849f862dccbc54a4b2e85d4f55
SHA512c9c6a964c43d69fe23068473f7e178374f7ef2cfc497c9fd4521a3263b9ddf0fff718336d0000983ec01b86c3806b9fd8db6cb4f803982359c5d8a23dd5951fd
-
Filesize
1.0MB
MD5dc0f7bfd348509f3e35ee7d0f3c8d070
SHA145a3422b7147010c30ccdd96dc0e0709008453e0
SHA256585437906914c5e6be6d884c6c74f98068883a2ef5be069b34beb79ba87c7c46
SHA512a3ddde0d522889736f299144015671c41052a6dcd6e3a2ffc0c5e827859cdf2bc5dda9a34fb568a40f326ad9e54f3aa11beae05449b36627aa86ebc28053ed68
-
Filesize
1.4MB
MD5e14c2b1db7312515de458c9678b14a3a
SHA1a31aff1d01d0e241393cd45b7af00d8a83c8665c
SHA2562144e69d7ea1d4d05edf4ffac598a0036989de7f9c0c0cdafdb223629ed9063b
SHA5127480f8945b588d0c25f7b8a85447450c5695ac4f8104b910981c96f1976cb75d4541002017c7c8d22dda9093b986a75831de45fb9476c163d03c477eac340b3c
-
Filesize
1.1MB
MD5055d9a0fe410f2f0fbc7e094dfcf616e
SHA1987c7371dfc8aae622b909f5059d21a7a2571759
SHA2568b46fc2bdd02e109ef223db30e2da6c1e009c65d568e28fc730687c188631d9e
SHA512a13e96defa1df0f3a9d8bf9058824cea4ddadb91db68f3a5d71ac8184738bbfa9091011d63a7b5620f9a93b9fa84535f2e88409fe83f19e23f0ed101d932afb5
-
Filesize
583KB
MD5fe36c94a1c098efe9b8af4b0f7f4aa66
SHA19f465687033c5592efa2b8c2a92bf2f85b0a000a
SHA256dbd2154af6925f94d11337c0d2a40494b369ae1b0fb74721e381435f839d98f9
SHA512fd1d078a2ef070564a64eeef055de744f5afd87b44eff3202b2ffa63039d4b354868164bc02f76c9f2fc73d424df64a3c848dee0f841ff2aee352852915f817e
-
Filesize
840KB
MD5414a1d1c61c31ae072ca07810c085c9f
SHA1ade9e514db1eb937ef37742625ee962b5e8911f2
SHA256e51247d8f9291e6dda89bea5c5f87ca685072f6b50c2e46a05a65b240ec35ce4
SHA512e33eb44306433acc1b76d25b3cf3f38d256ac03e0c9186dcd56ad6369b14e65cfe13bfcae6e68d4320b250dda8e8291ea2b0d0e3c4d8761db46b8729df54ef76
-
Filesize
4.6MB
MD51b2df3201675de52aa9b596b057f85b6
SHA1c5844b8f2a42df7971b9da276f44774f61014fd0
SHA25611fc4d193f3a32670ad0880d9f566754e4fcd5ad4f7bd44da47c60ea83f9be07
SHA512c44bfdf89b4f93a99d0ce70506cdc0b82c5d891bf834af5114ea81374c57da684a965168999296e8c6c2d6957b8a2450e1e5633030b457ea780069cbdbd2ad54
-
Filesize
910KB
MD5bf70a3a0374e30b709341484734b5965
SHA1cf6c2d3d4782d8ef10d8be5c112ab06e5ebb83e5
SHA2569e9a4381d097004208daaf1b921eea8dac3bf0e4e19238cc467f37750c23bf29
SHA5127f9965b90ac09af73e011bb39470a23266c9b7d7cc770e0a690accd5a5152f7397d9b175ad7f7c222d7b854a36ac98ce7890d985577347cc27c2855e6547d3de
-
Filesize
24.0MB
MD57feb10fd8f3cefcf80249f9c1fc40000
SHA16045c7d17e7d422076f2bfd523cfc524387d51da
SHA256cec8054e823313b8a8f2b1b49330d4d13efd65e6c65538dd15ecd71bf745c69e
SHA512de2d276c4972be8703181a7bc1d78ea3b6407ac012df432e1dd69e358c5ca26bfec1f7e0c1401f23fc8aa1189d1c3a99b792377b7aa3ccb125ca6681d98897e7
-
Filesize
2.7MB
MD5573191d3a19198b1e327910fe3916850
SHA13da4a6a3676c70ac2f19495b6bb8702f37346d69
SHA25646e13c46f3d60b47debacc501447ce205ac2ce50bba3d2ffb7dd4a6b0bc6da91
SHA512b888b8dc7fe67fd0924f8ded4c1a8c94d284a962adfdc717e54b5a057044055b148cc12518221cb90dc8d5841fe48b0fd4d80a369a45223f98d177e4240ffa2b
-
Filesize
1.1MB
MD5affead845b8d32e8c70a93dad1e27459
SHA1a07adcbc2854cea9825ac3dd03d3416fa0622b78
SHA256d66feb19a7141550035f1c4dbfa16afd3dd8ff7022376d06e67b45108d91e2a6
SHA51262558c86ceb5c2b9685a80dab92245fc53aca71d9c3253f8473f1640592aa0705d31eb6db966f1c2edd4e58176ec946fa712a147494d743f85a073c2921edf2d
-
Filesize
805KB
MD5eea76d746aa39fcd182a237791d51bbc
SHA158ed9e9361c6adafff9bf9343b1260f642c87658
SHA2566c00cf408032e98275fc00f958980d648351cd86185a04a3925a170bdb9b9808
SHA512b448ba192a984f518efb7ac39ecf3c7ec834fd431c7801a6ed380a4a1476b09b56e4dae00edd7a129e236b8a4492403b586bb40440b67cd4a9aca3942e091b2b
-
Filesize
656KB
MD5450c1d565373ab5d2d5e262b14e17390
SHA1e221598aacfd633f9f923b0a7c3a761e0457ddf8
SHA2569c2f94a9f84d799b8473cba2462714d701636f0a13d0bc467503ed36702d195b
SHA51225abc592ca394a229862a9f2e5fae5b4128d9e3ea80979ec21c7944d0ff97ed4484d324e903da9b252e499705c98c6c00ae7e48ce3b81fd8f40a83b52414f368
-
Filesize
4.8MB
MD5eee2ecdfaf00fadcf0668d32165f45d1
SHA172df562e3077bce1480e5c7f323f2f853e70722b
SHA25688e43106ab0b6c6dac9fb4e77646f9ee9c4252fea89a3bd3291d27eab673c55c
SHA5124af690c0a3d0cef671b09ecd45572c8440035dec20945cf37b41ee2cd983d6a3fa9ef01bf475ac71383555ea8dcf708b43f3f0b699c0cef7ea029d0ad0befa1b
-
Filesize
4.8MB
MD589988bda37280c1058affb3585ec26b3
SHA1d0a30db4bcd1c9aa1f5b67155d514dc35fab3ab0
SHA256389530fbd03a5ba6d2487032dccaf0f1b9cbbf2910d159e62ce395d9e37fb45d
SHA5126c04b9e8b593dd3a2d00b3ae57e856b1567557934e923b2a8297599fb74b4b26c7398ee284b0d845055e595d0f9d97396fe747cff254a1d7880866d55c4b1703
-
Filesize
2.2MB
MD5a6cee2e648973bcc5fecf1d946a448b6
SHA16e2599e26c60f74ad11c6f5977f8d91bf9d75602
SHA2564a486281a0591e1c4426c0a43ea9e62af833a47c78ba22611e10f1f5013ad248
SHA51202d007e695c9b8b249d7a825c27495a3484dcc0b1b10fb2b9a7ca9888eb1868764e3051eab99d793ed1e4a529bdd8979b2c4a110e3d14e836646a65671519f4d
-
Filesize
2.1MB
MD51bf3186560ad87b9eeb5c4f630b3fa88
SHA1fc2982b62f51f187a42ebcc2b6b81f6ddc0c4c2a
SHA25624e76f0a0702bcd3b7f89b41116f9223ab306d25715930506b58f8a917a8c602
SHA512234bc0308b17b735b9010d70530f9a24470158b6ecc65ad00790d27b6786d6747df28a096e9c392f16b92562a293e442b5d921b5569eb28ef33f0c0e164a1923
-
Filesize
1.8MB
MD59c41d4422e0ebac225f2e5e24365ffd3
SHA113b7888a29d02ba1c179236aa875b6ed7377765e
SHA256814a5293db329ab65fb25e8aec061a09ac5aeee59178741d9e758b9a46e74da3
SHA512acd6bda9b6c14397aa5c568b8e2d94462177964766c8c079bb909ecbccca15ab47ac69abc3af913ea2f24479f0a4921a70ef82e56eacd303af92db2701fe8a68
-
Filesize
1.5MB
MD5f3c140050841d3f4923caf4bf1a029fc
SHA1835232fc57ce43820080df6f0a8409f72fb4ad32
SHA256df9ca8b1a06ffadfd1e1623956488dc8c70ac8e2e889a8efeeef37b5e2fcf017
SHA512754a4e5f0355d9616ddf62acf7eefd6ccdb3da8b67db5508d0d14c6f34529c43b304e0c02754a620d1292cc8779d6f8536cb5005e9649542cf06c37d5e9e6301
-
Filesize
577KB
MD5378ee1a7fe1043f22a06cd8c34e0139b
SHA1f5e0f5169f7d74b77e64b826de0501909e1e0f02
SHA25677ee4b07cfddbdc6830bd13405b07a6abb5ba8d02348c2cb571b7525453c317d
SHA512e26dad976aa35b2fa38a37b34b04e452255b3804f7326bf8a54b407d72a500dfff0eb4a7cdfe7199df2854d204b29b6443701fd6ccadeeb2e6878a8e7f172c80
-
Filesize
577KB
MD5732b70b1f5fa862623c6a9a9fe8abab4
SHA1358627e100242bc1bb43d99028851559395e592f
SHA256a471d4e025910e4f297620248217de75ae6b1428657f85b73639d51156dff195
SHA512f5f398db2f1b53de136ffff6b3850827fcb0d65a28420000fb45b0dbeb5ce74d304a3e33f54fc40cc20e6f587d104ba9856636087e93dc796cdcfba66f072eaa
-
Filesize
577KB
MD58ed81965fc7e41acd883ebbd8bb2df6f
SHA1e2ed467eb70716e5817b05ec164d7c3c591ab193
SHA256eaed20e871466b4cfe910e32882830283ec0e987f26d9c1c5fd632bfb2011355
SHA512a65aee9676bdf226190c364dbc86d6f7e2646c5257a5ad291a867e21f3003096709da0d45ce7f121f2746b6575e9efcba38475e4768a0ed3ce3c5e567f434e1a
-
Filesize
595KB
MD54b4653fb564e5e5d6a86e7bf4aae7369
SHA1c98e61e052c8593d8e551e0ce37e3d8f49804776
SHA256161cd45f95a5deaa8a1deb21ef04c493b890f895c7d3f81151055b73e4745d1e
SHA5122323bc485a58a2acb6a3d7d5eae7dbc7dbabb45d4512ff22ec8cd3d14a38cfae0e8a768dc55e1e1a22cefbf52007f39d7449be51f7a937934ffa00159bea9ab2
-
Filesize
577KB
MD58ebf6accc7bf6d6492e751c4daeca379
SHA189da553fb96af3b1a25c44b51c2f1a458776d7e9
SHA2564eb59089ece94e3d9a3e82619789348b50f64fe78f62c8ce6441e59c8771fc14
SHA512f348be6eda720dbfb7afc450937c8dd4292e4d1e45048028bb1b89350635290bd9d3349002432169ea176e1f23a892f089d4fd2ff28f148a547c0cd1c1cc75e5
-
Filesize
577KB
MD5f06f922a73dca9b1324c2171f8dd751a
SHA1e0b5f68f9ed1019af84260c5c1bc8c2e6294a3a7
SHA25645373140dcb627aaf16e1b2e52f3690fba6bc224eb67d55596ce7584c3ab3bb6
SHA5128363e17341e6fc9cb2387cf7a8200ac1e8389e4d6cc9c62881db1d6aef40778edc1b2a30e03db0e1a92b013e4dcd803480b6bdfaf93e07027573ad14c694aadb
-
Filesize
577KB
MD55b69c42dfc06620eb2c6494a8be841e5
SHA1f703113612e51ce8e6c89edda6993f658397da81
SHA25620c4158af1305e7da38decefb500a332e52a4e3e2d1f223f9f3d872936b9ebbf
SHA512d70c6c624822ac78619a085ad257288e7d39f884150f12c5fdb4b1842449dc0a2a0d7f256c0362042af960a066126184f513ebd5579e1297bbf04168693d9b40
-
Filesize
762KB
MD5fe5a92978d4068a85eb482dafb47669b
SHA1162287f6f20f34d88a28cb9f201f9ceb79a72bf2
SHA2564435b1161512cb9128b7bfb148e4be6fe9e4eb3505cc4a7675c4884ae2d62102
SHA51234a7cacc29874e2d24e6e7f1880be8f5dae94fd282234e871100d930f23dc01b773b28fb922a85188f5e308b4a560e6cadfa782ab11f9f934fcc30b8938dc517
-
Filesize
577KB
MD5531d1e04174cbc789dd816515f6c6689
SHA1af19c83f99bab530b9c36bc9267db25a2c55fed2
SHA256e74370e73a04833d19a6af006e0ecce93c5529438dd96d1c36cbcf5d2f5b5e8f
SHA5120d33ad25518294eba5012ebf0c8e60d4bc3b557e0044b507d662e455aef807a0bd4e793da5d3c32e09a2392dd2b07d6fbd51ebb0700c1b8521ed7b4b7242de50
-
Filesize
577KB
MD594761a117f7c6664ce6b7455af286c76
SHA1b616f3ba792d40c8d6fcf4e230093ce9e6f2ff2d
SHA25649177031ac315ed3e8506270360b55f580d3ff407dc182b136b818a17bc3a133
SHA512a1f66b7e97b193194c5024c63c8220798cd34b3b2dca5d5f5b5f2d01d5df0a6e931e74ed2f378aabe1df9add7b65b85018c47e510e0ce71c62ebf14f684805ef
-
Filesize
690KB
MD50ec5e4d2b68030ee1589662ffbc81b9e
SHA16e08bd1da15b60cabb1be890926b4ee632838fac
SHA256be27975036aafb76692f8ee07258a0960cd30799d375dec431516874a6e6a71c
SHA51253743dc7db0bc2223cfb1d09b41251d59f9e7b6215bf64cdba3898033e17d53145bfb837e42b0958a34000f1a54c0d0f36a5ee407bc03df29aa7a222dd83ad7e
-
Filesize
577KB
MD567708ae0898ed0506c6a1745c94c749b
SHA1b58261a39eeac1c35af9b1545c630e8fc6379e34
SHA25611d26a795c4f68b7e1e16a5a33ddf36a3d1182ee863c7acc6c06a16c393c9d2a
SHA5123d4dee4445d5275aaf13cb1a38a8d11c81ca862660bbc3e996f694f644426fe4a719a495f6c9fe923e7b6077a93e96c51c39c29da74db7dbb061d57fbd01f635
-
Filesize
577KB
MD56b54797a1d68172d1efae4e7db6f294c
SHA18993be431fbe4e270cdd41b3e662167abbc13c72
SHA25617091f591758873d16b1ffadbb07dbd50f86ba99bff89256b0674f23eaf058ad
SHA512c4e4afeabac71b7f7f21f483881eb2ffed0fe2f685a19a57ae29d7528f778a75b936836991552645c2f70812d36e947fe53f75af7ebdde7d19f0e0478410140b
-
Filesize
690KB
MD52ccd8109effb29fe8f73f66706216bea
SHA1536016077239b7a86659f4f21fa69ca7699396c9
SHA2561b5e97b827614cbbf2ece379a438aa7a1e712fd7c1f95e9f4868174c2136598c
SHA512142fc02e9436f382816e394c36b6b72da208f37a804eb74490aefea9a131582bd0c0c33adf1ce706d743a93df31bb41dc49a25c4fe0c728f03de27b235303a42
-
Filesize
762KB
MD5bbbed1fd03a7397f0bcc5bc0e28b88f8
SHA1a456b486c7033ccf83c7eb756d618e4e8f3c6a88
SHA256f643e22077fd97a6b9cf3a18ab4155d34d3d71fea7f3e03edc82f3d9c299cff4
SHA51281f98884be346ce7bc8af9eb3882b918b9ea0024a8bcb3f1d2d5bff7f1ee48d68adabb21b8cc483f851b9820e0e1bfb1d33aeaff96b35bf5e455a4933872d4f8
-
Filesize
878KB
MD5a6c3bca44e29992ca241bc25c2ea92ff
SHA1d5492a79d438833a85026371505184a46345317e
SHA2565add97dd7c045689a422ca80e8d118816d1fe52956e1e0cdfb7b1b26ee0c4415
SHA5123d7ea61f46a029b770f0eebab731bae14fd745fd20103b1af2ea6f0d277982018199b5da9a72e58a790266d0b409a06c77e7f4900344ddc80b8ed60ce43b1db3
-
Filesize
577KB
MD59fa58492fe4a410004faa04f5dbf2e7b
SHA16ba61ca9dcfc85c9685ad7e4a86021a918ad42b8
SHA256a3d0aa6e6785c1340716e0024ca83bffbe283f39502d7c10b3d6d5f8b7453ecb
SHA512f216d2d25711b386a3815f5a798bc664d3a25a650b59c37740921c6b10c8a0190d3874d4226f4039c1627ac65d7f3a7707a89e4a97d234397c304beb036b2497
-
Filesize
578KB
MD501deef07e80e356dc7baf6be7fa7fc49
SHA14996002241c09b98aa6c0a1a6b5d7c63c26e9f23
SHA2563f6fb51b5a6932a55e54d80e9656863d1dd0f84e64fad9c5eba1e016fa9b5aee
SHA5129b2dd2277d6182cf1cc1fdc08b1d284528997b0460439fd71e1300e399d73f9c8c9c10160701d76547bc005729aa85823d5464dc038615b56383f12277671d86
-
Filesize
577KB
MD5befb7d999297b44895daae3a75ee16fb
SHA1d171abf545b93d0a06d10fd06c6146317c8dff72
SHA256df20f22695dc503eabd8435c8d59d4eb8fec1df90bf98dd7c3c7391e00778799
SHA512f9c937fa2a69938fb40246a16041eed3690a0e92c19a72d70c34901b8f59e0c1be6070b3c09f7e59a2ad7cc0dd1295687740bca49698c5d71ab9e8bbb4a54854
-
Filesize
577KB
MD556867a90c48fcb0c64fe632c0631161b
SHA19ad9333da421c93e43fb4888c7aebe6470dae2ba
SHA2562b5930a54168bf6599eecbad4e40902143b2ee7747b40f4b9d1f4fee9c7fb29c
SHA5122a907e746a99198c65399a24e009b8e04d71140988b6c0c596031db2b879086bf8270cfe0336fcc00b2266eea64c357c05133e8a1ecd60ce06fb8c70ad4708b2
-
Filesize
577KB
MD5c36ba383d990c7288d1419b84fb2bf2f
SHA18c45f34fa20713505d847fccc4a3dc5bf5ad25d7
SHA2562499fdd62d40ae7727da133e3e9d0f72f157836109e8f777e50d363fa72903bb
SHA5122b1321596e0414e560a3d0cf0ca0405916ae1f74ffe9b433547562f0aba0c9671fc059e9bd61251cb84a0363e0bca7b63571f8623fc304a8abf6bd82f6872a11
-
Filesize
577KB
MD5e94e47c490cec7115b67e666dd96f439
SHA1a18ff002615b19bd686e4616c54ab1be01928351
SHA2567009c0319a50d1085b99a76817bc1236cc2eaff97e896d46a69bbea6b0f88a35
SHA51276b30a12ef126936497a119bf346f777f78fce695d9897d8ab8a3969d6c5dad0dafd7f08f76ec13d1be8f44173e71f0717ca10c0bce1613bf9c6f5e18cac0eee
-
Filesize
577KB
MD52f219bcc8ac3367efaeff1e94c5db518
SHA17e49e610a00e9acec88c164a3e3187487946fe85
SHA25698e5b126413149253383641d6f075b6a31aa8de7f14fa3b74ff40e19177af891
SHA5127a7cc78d017e5f333677d45400c61a7a99e1676baaa819a60a6f5a4549636a9ac0204c812290c5089ac77b60ad17c32435247f58c0405b77d16c30af750e1cfb
-
Filesize
577KB
MD500da63baf156dd4cb9cfc40292800c61
SHA132bc7d245fba100c2f8c798f9e3444fd92e27777
SHA25661ea316676d580e89f1b16c40b2eb03a4345f6b44d05b3a486f41ae834b68538
SHA5125770c93003de4730903acf23c1a5bfbfbf8a4fe1637083b7ddb4f0e4b129e56d59569f1d153f59622e9d2768333f92aef8cb78e7f2e17aa40665b793c1114612
-
Filesize
875KB
MD59f14c4dcb83b3306625fdfad0785a0e5
SHA111f542ebf14d74cd9cd6dee00088f2f82161d589
SHA25659e89329719a29255ae8c9c188dc87aafe2611f200aee67258a979609f6080cb
SHA512961861b8587f72fe5dbf9ea8c502ea81b50d208a5ae68ec2196dd71befe2aaa41e4041601adcabcd53412087df830264aadef45b1b8308ba184299d3eceaf65c
-
Filesize
577KB
MD5a5435a67cd494bcce239fae1a571579f
SHA1f9b220c952ce939183dda0494091964daf2ca672
SHA256c48ca766e836d202cda5b6af31b0d46cd5b2d87cab117226a652f0b8f66a7873
SHA512133dac258a3b4efab82e388d2e95f2a02e7886b4672f9f818dec914b32a9fd0bd004d83685ba273cd55a0a2450fa269d396e3769599bc14fd0bfa6c40ead96cd
-
Filesize
577KB
MD52e693926b75f03ac46facb81019e1f0c
SHA1567119ce804262295c4e861ecca11de34b0d6f37
SHA2564e61f121946253c7ebe89d1fc9b41d08c627c0a09c134b3196ba96119a51ea8e
SHA512bd99816fac1534aa95cc279a4168beb9c3e0ed8ba3d0774ec07f1b3587fbe9aa8637ab01e658b7d6e20bba5ab63c6e724032be2c86f2dd37138206d3ffb53492
-
Filesize
577KB
MD5366cf1ea52487cb43d622a3aa2bda252
SHA1ad582037e9593c655b6dcbcbdbd0f32432a97cd7
SHA2567e34308666f6d740a05ee872caa67533d46723cbe41d0ef5dadc3222a672c058
SHA5128ad0dd4c88ca881846993488723bdb3e5ca19d3ae8c1390ee067e416f9b9734302db643a47722b0ba120abc19d8ce51ba3ac8a10f2c3b8f2b51654560e0aa067
-
Filesize
577KB
MD5fb4bfd8df690bf863a6460ba96705ed5
SHA1968dc3cb19bb3100d9a98665af11c47e97e17831
SHA256ee31ae20f11d7da00817897019ce737c447d94b0c85f0f43f474bde52118cfbf
SHA5124026b7df4736a134d703b343f288dc6ce4d8a8a39841ef6cd0b7a78281edd363d416ef5eab2b8ef77da0fff9f5d91b0d929ad529c74cced3bdae5db0501cca6f
-
Filesize
577KB
MD528383cc8cba478b9bd28fcce5de4122d
SHA1ca1821c33ae8b272fd2875941dc66237745097c3
SHA256046d740765dc9760b3b741aac66f0ec91d122c8a9ee18593a036925c66f2c88c
SHA5126d453d736fc8faf93f20adf8c30734e7a1c81d51d7df01d7c1d946d55680d30c01ab36580776b63e62000e9b7e312dd2af45cdf9acce21a1d47393fe508217fb
-
Filesize
577KB
MD577812ede39b33f9ed27ae3deda4ce6d1
SHA1aede4537bce48e636c4486d4b54eef6cf07a806e
SHA25662b8c1b6a026c88c846994ea20c58b1ce50a1fef86db8465aa1e6e88912f9d6d
SHA5124f055cbe057652c2c972732e402260cf38e9e72ccaa855d9b095d3b1542654c00b9860253152b3e513ffdea2087e914c690966dda1de8c09ae8b7cbe32e11cba
-
Filesize
753KB
MD5ed3bac606fa73f0b5979161fdf88ca8f
SHA1e44efe99d2c496191fcc4b4ccb1bc32cf611d6a6
SHA2565ee868e42ae300cbb5971df8bb64b443bbb50e7c709f27e7f83093a06ce7d6fb
SHA51276a82d48997706f523af11397f9094767154ad5e36efc4c3abc962dff4c19fc13203d75a4b3074b680ad4a712cdb77250d3f7f911c5580bb6bb698b9c1a1f394
-
Filesize
577KB
MD5be05354e298a7e6cb6c763b790c783a1
SHA1862089302220cc2a2a0be98b5d43b73ff7489f5c
SHA256384e97a590a489f60e4cbb8d2e72e2cd35fecdb61015ead7e7cf01df17b3c989
SHA512128b3dbcefa95a2596617362a7e6466465452e1cb2d0edf889e447b3db072080e7134ac7f353f076c697d068b6708f086cbdefb578a13019aad0d0a1e5bfb08a
-
Filesize
577KB
MD5429222960254ec06a7d06aaf7961c541
SHA1372430a15dcde96a72da220d5db25f4d4bfc06b2
SHA256785e39ad5220d185fe452c60e5428a216921477186e58206c6679e7732c9b18c
SHA512952b856964979b439e1676a402ec3c6cd984139a2f17b8958810a13e6162b230c235c8764d5c2ef74ca09c3a95b01036932e5ca950b80d33d31e01e17914eeb3
-
Filesize
577KB
MD59d872353757511e6b7451ac0080bb76d
SHA158824f866240b7c2a6d50b35beda0e25ff54383c
SHA25643f9a5932f1de90e5294bf9c92d6f29d5e44d59b62a07b94b25e594abd1be1c4
SHA512fb7069f34fe5f2fe60bffd06c572b596d9955ad4e3bcf67de83200efce12898286d968ca5e7b5f61a621b14b77c41946acb4991dcecce477e8f0c558dd40a7c9
-
Filesize
577KB
MD5087506029a30a546a084b6e81c074d9f
SHA16a36136e385fb447920810691fcb714b1c05c8c2
SHA2560d2a2de4d934e76099ded346aea239986eeb69a3a899c361035b3df9ec5f51a3
SHA512d658e141d1d59008e78c1421f9d4937802999fd5891299b6aada5fcb3b20e25a1ec246ced7d3ba079e95c3413212be3587223392991cf9907f1e8693f0f67185
-
Filesize
659KB
MD5b143a1f6d33d717257cc55c60f56fd86
SHA1003f33ff24e4f701a19817e5ff5058a38d0db30b
SHA256318b23043cb87a24e34ce41a38838d7f6b7b48555cfe3b826ef27aaaddea2b76
SHA512a509476ebc6e027512011f9d35ad927622672f24e2b989edd22ba8cac88537f8254c980751215b4ca0a73055a4fe247901a59aec4fd33378b22d40ec61fd0b36
-
Filesize
1.2MB
MD538d7ceb617ff8660bf11f21305cc9eb6
SHA1940d2df79ad123132841a0102118206f46aca168
SHA25685d9b4f8725233284d54e73ba94b1b9553b862cd5f552f514dba10b50e260032
SHA51260f5d91536a476283e57f9171d6ddb1371edcadf7179020e5775fbf25e161cdc9b4c759cc5edd10a17c360b2c2a49bc563eb46dfe677cd34e09b5a49d1024cd2
-
Filesize
661KB
MD582a2399f074eaac94355d84310c5bcd1
SHA13d1db62847dec4a294959b192de343824c39eff9
SHA2569773abeead7ea9f17a763e73f72e60c650ab43892d9554d940860d65c5da3097
SHA512040ce88d13147ee03475c0d938595bd526ddba6d937f68a2e393ae9e0ee64b5f4843f757a58064bac1f6c654df1f30356df0de8ec4bbc5e22eac95e5b9e33986
-
Filesize
712KB
MD58e04c3d10e049830e5516736b28f789f
SHA193d25c04d467675431576cd22ae14502fca28210
SHA256236fc140fb8ca5f99af358cbeddf493d6e8d281d51e811be9efef7f4c3786b2c
SHA51226b146d9e84772124ccbde936445902b9f7876082db637d45fe902680784d4cf1f22bffa7d4888561033a7f561f3299d9b02c31471f5f7825f09b6ab1dc30572
-
Filesize
1.3MB
MD56c4c0b17fc29400b0b85f2b4a02a4a56
SHA1b9963ebb98158b67fad0c58ef8531867d99197d6
SHA256ce49a32c751767056109fd1953de37836371d653ba4fc8103705e725ddb345e7
SHA512dd029ffc960cbe75110bda05b60b3f8aafe6e2feab67591aa9456faa0d7e4de570aa52bca48bedf9a59d57f81336fb9a98c55dcf24a8922d7fad32ee2515d011
-
Filesize
1.2MB
MD538d7ceb617ff8660bf11f21305cc9eb6
SHA1940d2df79ad123132841a0102118206f46aca168
SHA25685d9b4f8725233284d54e73ba94b1b9553b862cd5f552f514dba10b50e260032
SHA51260f5d91536a476283e57f9171d6ddb1371edcadf7179020e5775fbf25e161cdc9b4c759cc5edd10a17c360b2c2a49bc563eb46dfe677cd34e09b5a49d1024cd2
-
Filesize
5.6MB
MD508fab4c23b589eec2e28d5d7dbbcaef0
SHA1898b94ca5e5d736441ca470be655c0498ac04acc
SHA256308f81ad098d4a78920e484c2874c301cb2c6ce66fbae4669c7af2b2a2483868
SHA512e6bd4bb629fd9bdbb2ad9388454495cb01644f71de2313ec1712f8b6c002c6572ce9af4029d3036c53c92ccc245e8ec47cd8c9c0cf0e4068b657bb98022b0b4c