Analysis
-
max time kernel
153s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
16-11-2023 16:38
Static task
static1
Behavioral task
behavioral1
Sample
d88299a89e28245ee9e2041338b815edc68f2d379c42b000d98fff6a868a7828.exe
Resource
win7-20231023-en
General
-
Target
d88299a89e28245ee9e2041338b815edc68f2d379c42b000d98fff6a868a7828.exe
-
Size
1.8MB
-
MD5
80416b3845566bc5e9f6a46af2bdac5c
-
SHA1
71c184124d65c36cc413c93342b997bcaa8a0cc8
-
SHA256
d88299a89e28245ee9e2041338b815edc68f2d379c42b000d98fff6a868a7828
-
SHA512
f1cf7aba47e1f7a1d31b15f5cdedd340117c355b3272916e831ff7857302ac539b3a2562f27d23282e4d08c3352a3e734dadb03f91dc377b3f36bc0f25d6fc10
-
SSDEEP
49152:Xx5SUW/cxUitIGLsF0nb+tJVYleAMz77+WASk61QT8y+Ttb0tP2:XvbjVkjjCAzJrDA83mt+
Malware Config
Signatures
-
Executes dropped EXE 6 IoCs
pid Process 3512 alg.exe 2512 DiagnosticsHub.StandardCollector.Service.exe 784 fxssvc.exe 2440 elevation_service.exe 3332 elevation_service.exe 3228 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\system32\dllhost.exe d88299a89e28245ee9e2041338b815edc68f2d379c42b000d98fff6a868a7828.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe d88299a89e28245ee9e2041338b815edc68f2d379c42b000d98fff6a868a7828.exe File opened for modification C:\Windows\system32\fxssvc.exe d88299a89e28245ee9e2041338b815edc68f2d379c42b000d98fff6a868a7828.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe d88299a89e28245ee9e2041338b815edc68f2d379c42b000d98fff6a868a7828.exe File opened for modification C:\Windows\system32\AppVClient.exe d88299a89e28245ee9e2041338b815edc68f2d379c42b000d98fff6a868a7828.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\8e240a3fab605b88.bin alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe alg.exe File created C:\Program Files (x86)\Google\Temp\GUM8E84.tmp\goopdateres_ms.dll d88299a89e28245ee9e2041338b815edc68f2d379c42b000d98fff6a868a7828.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe alg.exe File created C:\Program Files (x86)\Google\Temp\GUM8E84.tmp\goopdateres_no.dll d88299a89e28245ee9e2041338b815edc68f2d379c42b000d98fff6a868a7828.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe alg.exe File created C:\Program Files (x86)\Google\Temp\GUM8E84.tmp\goopdateres_ro.dll d88299a89e28245ee9e2041338b815edc68f2d379c42b000d98fff6a868a7828.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files\7-Zip\7zG.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Google\Temp\GUM8E84.tmp\goopdateres_ru.dll d88299a89e28245ee9e2041338b815edc68f2d379c42b000d98fff6a868a7828.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe alg.exe File created C:\Program Files (x86)\Google\Temp\GUM8E84.tmp\psmachine.dll d88299a89e28245ee9e2041338b815edc68f2d379c42b000d98fff6a868a7828.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Google\Temp\GUM8E84.tmp\goopdateres_gu.dll d88299a89e28245ee9e2041338b815edc68f2d379c42b000d98fff6a868a7828.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{3474AF85-0707-4FD5-BE9A-A2B2360C3765}\chrome_installer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Temp\GUT8E85.tmp d88299a89e28245ee9e2041338b815edc68f2d379c42b000d98fff6a868a7828.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Google\Temp\GUM8E84.tmp\goopdateres_el.dll d88299a89e28245ee9e2041338b815edc68f2d379c42b000d98fff6a868a7828.exe File created C:\Program Files (x86)\Google\Temp\GUM8E84.tmp\goopdateres_vi.dll d88299a89e28245ee9e2041338b815edc68f2d379c42b000d98fff6a868a7828.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe alg.exe File created C:\Program Files (x86)\Google\Temp\GUM8E84.tmp\goopdateres_th.dll d88299a89e28245ee9e2041338b815edc68f2d379c42b000d98fff6a868a7828.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe alg.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe d88299a89e28245ee9e2041338b815edc68f2d379c42b000d98fff6a868a7828.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2512 DiagnosticsHub.StandardCollector.Service.exe 2512 DiagnosticsHub.StandardCollector.Service.exe 2512 DiagnosticsHub.StandardCollector.Service.exe 2512 DiagnosticsHub.StandardCollector.Service.exe 2512 DiagnosticsHub.StandardCollector.Service.exe 2512 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 668 Process not Found 668 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 5024 d88299a89e28245ee9e2041338b815edc68f2d379c42b000d98fff6a868a7828.exe Token: SeAuditPrivilege 784 fxssvc.exe Token: SeDebugPrivilege 3512 alg.exe Token: SeDebugPrivilege 3512 alg.exe Token: SeDebugPrivilege 3512 alg.exe Token: SeDebugPrivilege 2512 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d88299a89e28245ee9e2041338b815edc68f2d379c42b000d98fff6a868a7828.exe"C:\Users\Admin\AppData\Local\Temp\d88299a89e28245ee9e2041338b815edc68f2d379c42b000d98fff6a868a7828.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5024
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3512
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2512
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:2412
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:784
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2440
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3332
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:3228
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5ddea5400da67b8394d528a1e2df3a102
SHA1b2d07c86d8579e5251933847886e7db5aec70168
SHA2565284dd161430c23cf9936c5d5a1ecdc935f522218b7c91981682793998190710
SHA5121743c930bd3a265733f2bc097d4bfbc386d52cdd3d6a40a4c5929d62de6e1ee2370a2aff660626d8366c3b4ec4eef78d38a1c47b0a336c3d784e603b684e064e
-
Filesize
781KB
MD543baad61d0bbfb59503fb8e098efcbe7
SHA1ecf1b8b2865d74c5810c715cee1cec05db5e8426
SHA256d08ab42405c9d5e63bc7bb9fb22e99717067145b71bdf9295b593318ad260496
SHA5123720c2954b3e3b307314a123983f2c8c6d1f38b0b54981404cc056c836d8e4eb2044a32abe55333c81c9531e2f9a931a49137135e4f778355718379e890b5354
-
Filesize
1.0MB
MD5649df624830035986410ab29e96d72f6
SHA1798d1299607df95e1e6b3c5d0f3eef6f08c1c89b
SHA256525184cc66b5449382dc2de4e542360558eea27e236111dac086fa3558d1d20e
SHA512e26154a0125d19aba75065ba3b415f32fef030bf72e151576871edd243273248dcc8a3e48520cd97cab7e4977240f8adef0c42f45973a20ae762f9a431550d8a
-
Filesize
1.4MB
MD52336e013c7a96ee9c6442a809dc4ddf9
SHA1a40851fc2f94f192819913b78bc037ed1636c990
SHA2562254d2b4a42fb1b9183288ea4ee44d049285b57ad41ef0c585eb1e21d37c7eb7
SHA5129ad46be80e939c9d6f3b2e4bda8e0b79957a7d6c4c824797ed789185942d2619313d7a34df77bccf081173a985c69417c3374d72c6fcea2253bf39c719b68b4d
-
Filesize
1.1MB
MD537f40a59ed458a0800d0265667e11db7
SHA1fe8411855a216cd50567ac6d389d1a14f9ce9923
SHA2567f9f61e216364780908edfc3ef4779151493f22d694c9e4120b8b0eaa38fc996
SHA512985bfaae9f333aecb422f920734b4582e09c762c19107bb711f1585358f55ce81d44dd5e8d8180d087ba6ca81102363fb32980b0aec0fefa47ad41f139a061ab
-
Filesize
583KB
MD55964492b114576cde50184edca941eb8
SHA1eb3cc585157504a85ab8b7d61a597eb43ec63ddb
SHA25674534d8dc0289a646255959feeae36d84bf977b2c4f1d895d85634a54dc0c5e9
SHA512d00ab36b41f26969b379d1cabea2d7f95c185e24da3c35e2c770e974f08a9ac8902986e54779b0e9e20500bdf2e0597078f8971a28a713308636520fad3be9e3
-
Filesize
840KB
MD51eef0ab81c1c4cda23528e08abf37986
SHA1ecf88617b80f379ee9babdc91b0167f12c966144
SHA256463c410332ff3b4ba37e89ed5f95071c518018aaa08dad56f5cd1ed011223ec5
SHA512cbe65b4f12c109382be8f32363548799d3f371d97aac721ee5c5878bca017f504a2820dfd58eb5283690f1bcd4d57e9752832dd8af92896ce7ec72dabca0d3ce
-
Filesize
4.6MB
MD50457c97d0e2815e14498eac741ce89e2
SHA15591e82acfefa07f75fae96c42994956d3ab4c41
SHA256170b8edc557fd27c16fd322b6d8297a6879e4997365c325cb188444a56df71ae
SHA512c55ef2e9550b1dc5ef378b7f5fbb008579ffba9508aa5021954c49efe69cb144a21423cecde264f1cccba3677cb86edbf06e70fba6eb02499c8268a537c431bc
-
Filesize
910KB
MD5ca68572949a364014fa7e7bdbfa13a7b
SHA189fe0b9ac1b70e53198991b7a1667d8d72739887
SHA25663ff7d44eb7e823f3485d067fbbaa91af33049643ce10be822cf940acf56aaa4
SHA5124ab458123a7e717d9aebff96eec0b77cc1a9f2b289fd11bbcd640bfde06692450b1dea4d3068a4169c6c88bf4d1c3f1ea52b1be11f7539a9c0ae46ff3d219552
-
Filesize
24.0MB
MD5ecb6de79062121f73040067537d2b3eb
SHA194e78fb5479c64e0e4070eacf47dfe0232a811b0
SHA25616da67b6a15a0e12c036e7c946705286697f48f5bb42d65873c360c8573f7245
SHA512881fa004bb83cefdc7da5cc5efa24e4c78ee2a465548abfa3946e3c87ecbfaa5ca25c2293eeff5243dbb2e5de2ee7af49f65d36b31924baeb785d17833e2bea0
-
Filesize
2.7MB
MD5e3132d79c4547a21cdba3e366a6b5176
SHA17e3b073ad07d2d5cbc55e9fefa82af1788452989
SHA256d1708229e689f84752bfd69223e17136680416cf3795365797fe3ffcce9d901b
SHA512f61aa75ab42a446f9c8dbdcdbe0e179225bfeaae6bd299741d4cc4c145b412bc03853e9080784f552680a2872590bc7c388818aaaac6eaa095820b52e9d092f9
-
Filesize
1.1MB
MD563fcaa432183a43a04829fd63b6de038
SHA1c45262522c8bf0e346a2b527c6dcbadc510fdf5d
SHA256dbc067e92504b51f4da5b37e1552e26cc3218427779e97a4f0738ab363f9b4fd
SHA5124e1a86d71ca9795571f86ec7321b82ef0748628d34c3df7e7e6c3f1715379c81689d873cf05b8893d50d88821b4245428ddaa7ab1ba0182affbbcb9bb6413dfa
-
Filesize
805KB
MD53c8368cc7a4b00dcfc150a41c1e102a3
SHA165cd506e9ffbbeaf19da11aa8f10e223325a05c2
SHA256f4be5200174fee962eaadc42032c061538a54de9a3f6cbf9ae139f6a97d7bd00
SHA512763429441365656d47f0dfe1aa9a8173db04e98cc6ba863781d0ac5895399e2a8f7955f74731298cb3284dcb611cd77e0b4ab661e52d9d92d499d01cef41af43
-
Filesize
656KB
MD5f7acb0aa5920a80dd9f1710c31cae290
SHA19297c5ca12cc9f2a5056d2b26d6e64552b2eadd2
SHA2561f294f1f5cce5e777e979f92965b201ba5244c078d6c75ad7e6c79a2724c2b24
SHA51262e8416e160d495e07109e315073afd9072526c6d54882072dee1cd505b825a9668f365d33546d9df30261946c5f6c21251867073c3af990593251f3dfea8d9e
-
Filesize
4.8MB
MD5fa3a76a25649127765f75c744a7dcb10
SHA19848ad54e1ed6aa5c14efc732bb5eb0668b4f917
SHA256ad175c26935d801009a473725592c6d8341035dde053204475903469bd79178d
SHA51298e1b08d737041f47e4d45806241f149bb299f458765755c7a041f55471a6f509b3717728017b6093c0cd09c1ad5853f710c0b1f6ca7ba1771b257ad61fb0ba6
-
Filesize
4.8MB
MD57c087e84fa6ee00cb8bd41e6704190af
SHA10a72cdede14234554a90a9531f2f57657d8a2634
SHA256aae3b4c68c1dbe5e0fc3ab5393429650158f83fa717021fda32ac2389fb9a771
SHA512d310149e0cd2a98c0798212a2bcefac77a5ce68991683c6a01b2c0eef025f4c4d59231299c49a344aa19b30441b9472a19ba8c72c3a67d709465751a2545675a
-
Filesize
2.2MB
MD50a6e3f1d53365bbf9de4ebd271315c12
SHA1f0b68fc35661ab581be0ec101a6056b93007b085
SHA2561c66fdcfdf41a91c3eb46ace4dac44fb8cca7be2b343cd8af0ebfa52e621df12
SHA512665d7bad7a7eaa02a9d156862ee757ffe34d1b6ca8f2bd97e569cb1c7aebd05f968d3f252f57ccbb1105fa0b5c279e7698eac6b2eabd89ffcf47d2b742c8161a
-
Filesize
2.1MB
MD54536c130c063ee6dba81e21418869b93
SHA14b8dd6cff4b3c5ed9f1f865f696e6f0bbb04b4ce
SHA256ded7756a41577749898e523ff8949cc608b11987f949330564990823f08ddf07
SHA5122fe9ed785fe0a1e722f95129837134b8d4e9b30541592713a52e7ee48989d9f26487a2b8a5929b3bc095b0fde37cd4a5f6b87f8d076d69198e665a60d82d6e5b
-
Filesize
1.8MB
MD5b7387a87ce5e9d738b5142086a1d1955
SHA14baee0ca71f35545d6a86000f5c0f97e9d01ffe3
SHA256ffa8278dd3af56e1421f49f7b6543d5c645ee851f141db82977c13b9e82265f1
SHA512563d0823e6341e742ea12084a36df5b308bade4ffd0b8b50f50ea310a5cd34cf538bec9e062a48ddc0e2fa2298392abc80368b0d6b95567edbef097d99da1d26
-
Filesize
1.5MB
MD5ec7ac61c02e502ee1eef19dc334d7e3e
SHA137d41e5e1ffaebc6e97464bafe554cceffdcfcd1
SHA25653c1b82768b02c5fdedabea27fac31829444a05d295b86de1acdfa97bc802efa
SHA5126cc74c5a1284564f1a55361564f6c5748b7809cc941c0e2b9d7e45e7206886a729bf3c7b1cd0051b00ad269bbd15efaa04d093a61c7f3fb279a2629d5cd2232e
-
Filesize
581KB
MD5248a5ac3432ffb305e8e16a0d45a30af
SHA16369dddc930f925457949b0bc252f259a83b9de9
SHA25651645b5028dfb40197f3df36e75cabb1f18e64ea04e3623f94d5854032cd4e12
SHA51270803a084194ac085881066a328e29b78684fe42aebb3b8abca11ba45971bdaa674f55030b1ba77132a6c50dc87f0e6fe8b3d7f952d0a5dc11ed6b0dcecb2e7f
-
Filesize
581KB
MD57c2a7e34492a007e16d4e190a836d287
SHA1f86a9f50f8c62ddec29cd1c436d167cbd92a2901
SHA256da91b10c91e34e5b2ff6ee39872d874fdb59a8eb6280406d3caa3fadf2a34ae6
SHA5129533b685ca2fd7afb1f708a4ce38d0278b4daa12028d9bd9d4982d37f684dd6f6b8f2a5f948b95a68af1be46bd0721fbc7360da478358dc2b2b29b561bd14191
-
Filesize
581KB
MD5abd565e71d7eb1e4af452e3cc9c50cf9
SHA14a0f13b1ec3288ca1dfd4ec3322bbcdaee49901a
SHA256a3bb5211958ba2204e16f7b9bf043ba8a8ef20779e68b9d4e5b9fec0b0b526c2
SHA5126b7c43798bf39c2bd8867f5ac933bfbdb0c78dbcf2422db7b8ed3cb165dff1495dda06129df747b6027cdb8b7fa075e1a53efbf06ce8c414a7b17694980bd92e
-
Filesize
601KB
MD55adb54d87b9ed2bb9511e1f109bafab9
SHA185699d858a0e2d9cdd1a2c1984045206c411057a
SHA25680f85e5868f51eb12f0cf60946e1b356ff1ae17f05dc06257d800ce62d46f3a8
SHA512cd8b493d20827847388b9e42b6513f62c093578189e39241e564419f2c66e0a261c4f1523874f2d58abc7549f311bbad207a9359c4e3669e08c955d345205591
-
Filesize
581KB
MD5f0091e58c468675a6b19c760a87ada1a
SHA186e668eb28c4bb5a4a53a1c9f9e11c9bad4361b4
SHA256bd6a51b1ed1069aafbad82575a54a96978855468772ed3ef074e206c70628f03
SHA51230e2d9467d2fbda368a5747e6e0b89c6b6c00eba95be64cfa4070997baa364626575a26adc38ae1e4d6aa75a2254b55ba2cf2af264705d60cc397f74efe1feea
-
Filesize
581KB
MD5276a4e1341929f6791ae09d38a96643a
SHA1fb74bc9d46e36bd0c3167e4906cf0dad5b895da4
SHA2566b1286c2b8702b4545bba7b6ac43291a50966c6a7a4c790c037c8922923c4305
SHA5124f42a20678147999bf1cb240fcdd9103c550872abfd0972a74102127ddb9423f71d5ba80f3da1e33d197983201dfac59a0449c878321679061a56f18bba97f38
-
Filesize
581KB
MD5c2f8c739c355d34e913ce7592b652236
SHA1a3ed5f0175507597db299d636f2fb00db18fd102
SHA2564b0e9a08bfa32ff9bbc0a7364c35c8005999a8ddf984ca5493103a57a72f545e
SHA512e82a055c9e6abda733172bb73f5307d59b454f7e08f59f7ec3846ec695b1c34470a8a16e69396d6c667d3ea7df9cb0f81dda1883ae9ae826566c452e360725d8
-
Filesize
841KB
MD5f4bfde09973b39309d2fb82d0bdebe5e
SHA192ed590ed805882ff65959425d270f43d254b861
SHA256051f0dd266c8846289c702f249d31fd6f39de8aec09aed67631ce2ad2e4474fb
SHA5121946c17da9fbfca211e481c71ee294014f7328eb797457d826739cf6a0824de75eb81917cbf6abdf920911140368191f5c1889e07c2748c18e00848fd358cac7
-
Filesize
581KB
MD580afe105577f0640fbc04e78ea899918
SHA1ab70a47cfe4a214ae534b95ee3da8acd00227dc2
SHA2560b11fb0067bb6b7f3cc887768788409dea1cd213e4cd6a29cd4b7282c082ccd0
SHA512435e7c5952c4d90846b905c4d51de188add73566139a84ab571d19241b030164d59729ecd976794c1de595608c6d1fa638d898d371f0b4e2bb962ea8326ef348
-
Filesize
581KB
MD5b367f7645a19d7ff95e9669487af2de1
SHA10d20a1e2d7b62b4e4bfd439d8d31d098f3a78ccc
SHA256801a412f842dda80b063a5e08979ae81f2a0ae456c20c259aaf54f783e604093
SHA5124abf5018b7d79314b608042c629b45c77b9bda84503cdc93c1a1159bbccbbfddbc3c06fae9283ea11dcef3e63cb8209883ae8aadd7acf18a7811d625cc36596c
-
Filesize
717KB
MD5e014a36805de9aa40b59282dd7e55063
SHA1db8fe7198db47147cb4e382dc72f5f5e7a6409eb
SHA256d410f5cec1d065033ff42787844c2d241a3eca6479f8de2a0444b1a7baefe24f
SHA5120249bf908065beae9027b4a18a38f0bfcff4980972c49af91a73837ba567474b592c2f900493a410129faee3580baff4333891193b57f7fc58ea87d3216fd64d
-
Filesize
581KB
MD56683bfffce7ee9f166217670a918ec6c
SHA1829c1e59fa5865a5adec7cbbbbc50b64ff32cf32
SHA256454d3a6020c946174611fa157dc8c7d2da91d6476c2b7a0c0d59778b00091025
SHA512f471ec1f47844b698d6856b52c9def7b8d001c4b006fccb2be819d9668cc46e91a49c4faa72d529779e357b130f3e9856040c93ffa61ada17ce7ce84ad84b204
-
Filesize
581KB
MD5e72922d40fac72b904f0f283ef1ff735
SHA1e05fcc172a3b809271624caae4251269a83ab96e
SHA2568acc8c0ad9ea25d2120e1317425936ad8a939fa1c0d6003a8ea68456c8e4092e
SHA5127e0bfb636a58eec9327914ca7f51440bb83e52acaab796e1947e365ae6c82e075a5e13539f20447ec53247b0565d0377eb863ad5c5352ec542501622d8b025bc
-
Filesize
717KB
MD585ca8d4aa65398b6c98de65fd85461e1
SHA1807477aaeef2fa1ec0438df649f54019cb1decd4
SHA256f22e63970cb58349c33cd664cab9629ba5fe0ade67706be91f6950d607e21f6b
SHA5128cc3c47b6b711a69e77a1d5a239986c7d3eb8e653206241571ad22a82c2d0f4212f68807385e111c19531710ac011e15727f6eb170a052f20dbf7fe09ba5f1c8
-
Filesize
841KB
MD5f06685eefa1b7d93c77c6af4cd94a50a
SHA183cb2de52089bdfa1b07359df673e6a9dfb9477f
SHA256ce3c5a28cf7798731002930b3eb4e9ed6c773b9b897980fba2c682011ca9c6ef
SHA5126fba9dc3d914086a56f8ec5cf6d8b800ead1fd508f9a541c57513af38e080c13690406eae66cc4e5c8bb41c26a4e86d1f158c993d1c700fec90533ce5a99f849
-
Filesize
1020KB
MD543d67e5e210c1f3a293e613f2077eb59
SHA135754ea00a479eb05425a7ddc4a8ca048383a531
SHA2564083e4fa0fec39442e51e24fbf3184050e17245ffc2fb0777a0f45a01833c745
SHA512b11e29316531fa50fbeae97d862bc872fbbefc701528a804b986d19f38a68341e59749ca48b245e84b14f5d74bc26d281dca0e04104ec5ff452d86a02270ed70
-
Filesize
581KB
MD5a6b27bc645f845259ba27b3aaa278af4
SHA110912f8372704e993422d826ba7f825eddd85129
SHA2566f57d80497df7d2bc8695fb3e39d4cbb9b6d6b0a47d75859f26aa6668037b371
SHA512c73e05407ea497a76e75f706557830ae140cae32e7c1cb12dc887e654752df97cc0f3afecc958a5f810011334764acd1dda6623a0f4f536d1ec72914cd542461
-
Filesize
581KB
MD5870dd9c68267da2052684a8b1359bfad
SHA1968b6d353f3218acabcb99eba87a058aff2f5653
SHA2567816dbc0c75c0bc5fff5a8129b789a345bbd1e0bdb5fa227010002ace9cf5372
SHA51259977dba567a600ab6e7255ae8d4917297994007064c85e923a4a4c9ae37d04cac389fe0208cba5187a0ad0be9427e9bff3f1f0061a40506ac0f97f4e0659957
-
Filesize
581KB
MD51dbe4795458705a45622d8e48693dd2f
SHA17f90a2b008d9ab95ca0dcdc101314313a408cbfd
SHA256bba05660bc79d29009f57aac472aa628b9336999d70db1a2193af5a38afccdfb
SHA512bf9d8692f807e4d1af818afe75c8b861dc3183ee461b1bebb76e6fd61c5432162dfa46c4fafaccfbcbd6207d5899aa645c685f7658160417f0f3bbb0730586b3
-
Filesize
581KB
MD5056a5add061f49f9f20b7c81c61bc9c4
SHA1001e8d24b96db092ca1e642de7f58fb9cebf2962
SHA2565abdddd01d13ca9021ef0f66d0ae63bc1bd507c445ac065776ed0f1dffcf8f54
SHA512b711ff528a65754f51ea0406fc582d9876346ded58e1551c30bcc87a1920091712b9801ee3bdc2c1dbab2af44fb638fafc25f51f458f32d063059d8b380d2d4a
-
Filesize
581KB
MD5d92bcd391e5a8057976c08f19198e34c
SHA109db24e0c4e6cdc7991eeb7236651b39fcb2693a
SHA2567ab7ffd8a97b5037e8c503758c169108cc457103660509a71235828f791fb781
SHA512ecd3fdaf8001115e88bb80b65ab2767a5c01f77d9701a2a220493d3b274b863a53b43e6cb640ea77b1267f253e7ed6efdad9f83f76a2ec0c884edee632fc9e3d
-
Filesize
581KB
MD50aa83158d667cede4ddcfb4510349145
SHA12858cf18e522951e62270155ba130d62a8372319
SHA2568d406163adbc45be853e64cbbc36e35df6b49d3b9412d2d7f6dea883bdf4c600
SHA512a4fd17fee74ecfcdc372e8d6ff2302014478ef561429f933d0e741c9a2d3668642cf8ab43301414c9b9919c20c5704870ac7ffdc90991eef906e9501be4aaa3b
-
Filesize
581KB
MD54cf114a0d1b73a9c7a4a10473a2693c9
SHA17eff854bd17e9773e9ae2926b3b2ed8d49043859
SHA2565ca4c95eafd686cc0936da33803573e9abac99a250ec1aa0bd444b7ad93038be
SHA51250676d4f16ad93673c682a2ec4e528cdf68d6029a1ed711dcd3893860de618bfbdb6b079f7f7981a80889517af2530ccbac47af8936eefe58dad4fe1dc517c43
-
Filesize
581KB
MD5c8145dacbf0e0a77385bcb502a8b58b1
SHA195b0361e07ea3024cde8dc7abe60b4f176d3ba29
SHA256a6d84126979a12d2dbb74f22e141d6f53607272faac660cc001e5ad9f16e627b
SHA51295524c77859c640f77ab27d28bf0659e92cf2befccd223631e1aede12521c0c9d2ea30636349bb5173c43adcb0d03e407b01d60e764c8194c7335c63791cbc18
-
Filesize
581KB
MD595a7af2601e800ed3a8e62ed8e337ec1
SHA1b026205b429f9ae16598e55a0698464588e40667
SHA256462059e711275650da9a6c01016051f7d70b1a251ce049f1d4db9b58af87e2ba
SHA512233715f611f343c2659aaad1299ed1bd69b4542479701cbc6e47edc71244c690e937f904c299aaf940219505831a1032a74db66b365b7a662b895ff434403a8f
-
Filesize
581KB
MD59fc9f4fedc93102a89842d482c5556c8
SHA19b89025fdfebeac1d8ae99b46d060f08fbec0d09
SHA256f11750c2c0e176a90b677e0330e1d74d3da778d44b5e2797800396d3703d14fa
SHA512cf2d890244c716d115df186902f7f8e844bbf58954a521fe959e5ecf3996f4c0ca44032077a67ba1b56a47f41aa6b640f79d2aefa077ca34b6f66f7411828d17
-
Filesize
581KB
MD5a078c43b6114c7cc9c08068b763d2382
SHA172ac2b46eb4588b1c5be9b7de060dfbd94db3b2f
SHA2567a8caf5635292fbb400f744425cae0a661e25c9b0c602800288eaa97f47fd9e6
SHA5126c563b06280b23d8468200ba66d445061459c6abea7958ae1bdf0da7ee8307ae7b31d98d4eb38c97bd049f68c9abdcb9a8465d1dbc10bdd038cccc9fbb9cb30d
-
Filesize
581KB
MD520476f73eef0b2fa405aa96cdca827ec
SHA131210c3f47a9eae118cfabde61d2fe61f9cd2f4d
SHA25688a3ec4433c8d9b46be0678e00a08c05dee337c42818b5d7f0fc137d002299d9
SHA512d60063becfb99bdb6889438b8b2a0a73e2cafa8413a60464729720f24c21b5613e6f47f7953771551b88ddd466ff9dd7799396cf420cf4e2159d09fc7d6410e1
-
Filesize
581KB
MD5ca04452039ca4a417e16a92b8d20bef4
SHA14838deedd07948c75b4643cd7d6ac1269de01f7a
SHA256d876890ea11208c725c797b632b29234b957dfd52e3156fc8823a3b70a5e4955
SHA512ac7801f6a7f545908b26edd9d41554d8aca0df6701109eee78bb88849e42e22e117b5d48b0fcb2e69989e706600b03a751a8aa541ed08cc10c3c105bef15bdc8
-
Filesize
581KB
MD559d1faaeba0f7cf60b53599ba6697eb8
SHA18d4f2739c44a1e0e0389dbc61f2e97beeb195aa0
SHA256e3d9f974327b91be3e48310d10430d35dc4fa3e3d703d1e7f28d19788b1624c3
SHA51265244523bd5e8f81049debd7e9c7ca118fe7d2ccc96c53a9d437ea6f13aaf0787e9fd9bddf4b6d37e3ea026b0642f8e92f3b9dea16d1dc15d1cd232ff225ba2e
-
Filesize
581KB
MD506b1565c2e7048b8749b33e0c18e7fcf
SHA1c4b5a0454f46f61692615f34023d8d34cc74e5b0
SHA256721d87282a1d12fc148a9cd03a6bfb651b3bd45abc3b59e351b775ced368fe6c
SHA512f04bb99d35deadff23db8665e83ca3b989df0628f998af02f51182c25c2574161cb8a221c90479eca9af0e180b775a42a9d510e3a9f72968c531b81b15c95e91
-
Filesize
581KB
MD5baaee89aa9ec2b817f79702493893ec8
SHA140b9de5c3012a626d9cf79996bfdbb027627097a
SHA2561f752e9a16eb0cbbd016d2eedb3be221763231fb67c97520a1a44542f3caafe1
SHA5127d5db47f04a950e433759ae7db33814881ebcaf86ef3f313932f349148a5280fc85e26e55d881599968cff95e958c0e6d9cf95cc8d425ab210f47e4099c736cb
-
Filesize
581KB
MD55c78b351edaa0eb2bfe09ce2a97bdc49
SHA1beff6a039c10df9e34f73f4bb49370545cbe1df6
SHA2567698868b864402c731368376a4e5d7a93bbc4beee1b4f545381baad56e1a5bb4
SHA5128fdef057779286ce436f8ac60c896a725fbafb1e081d24ae393f55c4a1a30346bd30b8f93e7d63a6b55b062472c1f192ba88374880aa548f90a9df561784ecd8
-
Filesize
581KB
MD543b6210c0e468bc09422ef9d0416dc0d
SHA10ed8b3c19416d54219fe6f5b7006c37cfd184973
SHA256455778bbc5f8a37853d9cdf7266d53862feda99394b659dd22d1da4dc00fc0b1
SHA512d1d75d66980a71d7e29a7f65ca4db49df02a794e46e7844b07d82520a3f4bc92438f2899f65a7cee30457155ab8bd51504b22a1f7aecc284e056cb8fc28509a6
-
Filesize
581KB
MD5a15d5f72e51b08134ba6aa65a92a58b9
SHA174e988d883cf095d58adcbb2ce347e0c44388217
SHA256539c5372dbef43ead928ca36306f6eba61239003cc065fbff300fbcf26ca7925
SHA51241efa7a2591b5715a680e4aa9f394201d0c52259ccf0c1f6638b18e6156b768f155719da58f01dc444802cead653d9c5be2f7921cf474cef7e2fa882a28fc790
-
Filesize
581KB
MD5c4e1b821fa8225acc61272a40ecc257c
SHA197391f85522d2bd1ac617438dd32950952ed55cd
SHA256ced0e70099e28ca0a025de97263ece0089d6bc2dc6a9c6239443ee68e1e5badd
SHA5120d8b2605676b436b36be4925e7f2390419313070bb8ef8905c75e15c605019a273c6befad7a41b74b490f1a82d79fd33c3409515f277c496d5adad05844cb378
-
Filesize
581KB
MD57b8237d6073fb34202166ba3086eb071
SHA11b009e3595d705acef8e3e43963df1f30945bbd8
SHA256f4c8441b7e111278ed8919e2cefb85d1e674fe3f38b51eeadc5f1a3992e658ba
SHA512876eec8f1c5b802fe9666760925205876eb73addc09132f63de9a4f5eac05e62733dede506c7c40aee2123aeae0165cb50150166310428cbfaed4e36b4e8196b
-
Filesize
581KB
MD528b6b3e58f39bec8b53628c3c1c3dc78
SHA18cfcf40c6c081881143ee7c142ed1b76149136dd
SHA256516e6724ed510686073fe0b23acc54531f532f858b75505a48ec3b7b5f689d8a
SHA5121451db1596c9ad044419658a50131394d908f5bdc0c6392ecf26f1b7c34e10a6a006b0abee536f7d5e60d4d4cda86ebddc60f91090a6bf2c5f9736d771233606
-
Filesize
659KB
MD58bc14e8bec7ebcc6a82f60782963eeb7
SHA1287d49b78498c5e94ca6489a4134ddadffb3eaa8
SHA2560e26abc565edc676bf1f9386f6ae03cb81a98f96ace68ca22e57044f69a866ca
SHA51265806c0c31414e44905ecebffa6a876d26ce5456eb9ef36ce92905f9cb2c8081d0540391d5867f25039ad003a81bf704c6fc9bd29dfbae976c7fb89cd4be68c9
-
Filesize
1.2MB
MD554aea5c27c1c293dd29436ef9e6f2645
SHA13a3017b7e55b4267ad42f07fd465e3ed4c773677
SHA256de5b7edacd49c18dfa590bcd5a991fa54e4c8bcfcd97c8074ccb7a8f062b4297
SHA512e4221b3e4f132df47ee9ff11501e5de738472f2d14fc90e07acc7a3b8f0c75aa49881a4eda1f57b859ce6f6292eb45bfa7aabf0402e0158c53f7071c83ee0b4d
-
Filesize
661KB
MD518e4c964352d4cb8216dfb73922098fc
SHA10e7ece616aa1816f4bb9e1cc0d2ac5ed26f80018
SHA25633f2a272fdd4e2d85b97ad70cc1e11a4b6e3e630179c69e97b8f4900e82e261f
SHA51200f94ac102f2f732730afc199d8312bf5147df00be0486eaa7010d81754cbf693351c184e58bb0b7946eceeceef7042e20a85633e76dde8bb4f1bf07cfdcffbe
-
Filesize
1.3MB
MD518bc100030f9f5b94be506070660bd4d
SHA11dd8efe0896e21e6d11412553260451e8472bbc2
SHA2568a2d38b6b4abe98d72f339e75a1aafe50f777b0cb163057ba855326b7caa590a
SHA5124b114df50b9b4d362a0d5b8a6771d3f36fc17bf94501529e4f6bc5c5c37d242b643f2f1501dc29c12c51573094ff12e3c8b06aa5a13b766a9b64419f64ba762d
-
Filesize
1.2MB
MD554aea5c27c1c293dd29436ef9e6f2645
SHA13a3017b7e55b4267ad42f07fd465e3ed4c773677
SHA256de5b7edacd49c18dfa590bcd5a991fa54e4c8bcfcd97c8074ccb7a8f062b4297
SHA512e4221b3e4f132df47ee9ff11501e5de738472f2d14fc90e07acc7a3b8f0c75aa49881a4eda1f57b859ce6f6292eb45bfa7aabf0402e0158c53f7071c83ee0b4d
-
Filesize
5.6MB
MD5c76e38279c21e8df55a0941d7d521947
SHA1b744dfd83e73a316f7e367c7edd93588e4ad5e92
SHA25680c18fb8c554e579fbf1344ca63799521eb9d93296fd9e128fe79510611954a5
SHA512b144776c71899fe77c99f2309d637c5d8c65fb20a9d31629813ff788add3783e1c300b6b8c2cbbc86977e1715656d8d42e41a0e2781bf77db96802a39304e0e3