Analysis
-
max time kernel
152s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
01-02-2024 08:32
Static task
static1
Behavioral task
behavioral1
Sample
f38670977721f01f09f3a838d1584cb53feb9fa21dab38c31da74c05f35cd351.exe
Resource
win7-20231215-en
General
-
Target
f38670977721f01f09f3a838d1584cb53feb9fa21dab38c31da74c05f35cd351.exe
-
Size
1.8MB
-
MD5
a3b63f837716154075bc4df84c0d7bfd
-
SHA1
481554565b90e612e890d466cc3966d80f9ac877
-
SHA256
f38670977721f01f09f3a838d1584cb53feb9fa21dab38c31da74c05f35cd351
-
SHA512
ede843143cdab99e1dd4a8fb9ffb6c61ad89719c1681b1fb14563ab896f78ab564f60f01caff2376253b797b0a3215f212f7b29d1c0ff35e611886c0f25bb854
-
SSDEEP
49152:ax5SUW/cxUitIGLsF0nb+tJVYleAMz77+WAEEjhMjSax84:avbjVkjjCAzJ9QWdO
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 3216 alg.exe 1116 DiagnosticsHub.StandardCollector.Service.exe 4960 fxssvc.exe 5020 elevation_service.exe 4512 elevation_service.exe 2708 maintenanceservice.exe 1348 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\system32\AppVClient.exe f38670977721f01f09f3a838d1584cb53feb9fa21dab38c31da74c05f35cd351.exe File opened for modification C:\Windows\system32\dllhost.exe f38670977721f01f09f3a838d1584cb53feb9fa21dab38c31da74c05f35cd351.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe f38670977721f01f09f3a838d1584cb53feb9fa21dab38c31da74c05f35cd351.exe File opened for modification C:\Windows\system32\fxssvc.exe f38670977721f01f09f3a838d1584cb53feb9fa21dab38c31da74c05f35cd351.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe f38670977721f01f09f3a838d1584cb53feb9fa21dab38c31da74c05f35cd351.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\4ab9c2c314007a37.bin alg.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Temp\GUT9E35.tmp f38670977721f01f09f3a838d1584cb53feb9fa21dab38c31da74c05f35cd351.exe File created C:\Program Files (x86)\Google\Temp\GUM9E34.tmp\goopdateres_id.dll f38670977721f01f09f3a838d1584cb53feb9fa21dab38c31da74c05f35cd351.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Google\Temp\GUM9E34.tmp\goopdateres_ro.dll f38670977721f01f09f3a838d1584cb53feb9fa21dab38c31da74c05f35cd351.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Google\Temp\GUM9E34.tmp\goopdateres_sr.dll f38670977721f01f09f3a838d1584cb53feb9fa21dab38c31da74c05f35cd351.exe File created C:\Program Files (x86)\Google\Temp\GUM9E34.tmp\goopdateres_th.dll f38670977721f01f09f3a838d1584cb53feb9fa21dab38c31da74c05f35cd351.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Google\Temp\GUM9E34.tmp\goopdate.dll f38670977721f01f09f3a838d1584cb53feb9fa21dab38c31da74c05f35cd351.exe File created C:\Program Files (x86)\Google\Temp\GUM9E34.tmp\goopdateres_it.dll f38670977721f01f09f3a838d1584cb53feb9fa21dab38c31da74c05f35cd351.exe File created C:\Program Files (x86)\Google\Temp\GUM9E34.tmp\goopdateres_ur.dll f38670977721f01f09f3a838d1584cb53feb9fa21dab38c31da74c05f35cd351.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Google\Temp\GUM9E34.tmp\goopdateres_fi.dll f38670977721f01f09f3a838d1584cb53feb9fa21dab38c31da74c05f35cd351.exe File created C:\Program Files (x86)\Google\Temp\GUM9E34.tmp\goopdateres_ko.dll f38670977721f01f09f3a838d1584cb53feb9fa21dab38c31da74c05f35cd351.exe File created C:\Program Files (x86)\Google\Temp\GUM9E34.tmp\goopdateres_ml.dll f38670977721f01f09f3a838d1584cb53feb9fa21dab38c31da74c05f35cd351.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Google\Temp\GUM9E34.tmp\goopdateres_is.dll f38670977721f01f09f3a838d1584cb53feb9fa21dab38c31da74c05f35cd351.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe alg.exe File created C:\Program Files (x86)\Google\Temp\GUM9E34.tmp\psmachine_64.dll f38670977721f01f09f3a838d1584cb53feb9fa21dab38c31da74c05f35cd351.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Google\Temp\GUM9E34.tmp\GoogleUpdateBroker.exe f38670977721f01f09f3a838d1584cb53feb9fa21dab38c31da74c05f35cd351.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Google\Temp\GUM9E34.tmp\goopdateres_hu.dll f38670977721f01f09f3a838d1584cb53feb9fa21dab38c31da74c05f35cd351.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_108328\java.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe alg.exe File created C:\Program Files (x86)\Google\Temp\GUM9E34.tmp\psuser_64.dll f38670977721f01f09f3a838d1584cb53feb9fa21dab38c31da74c05f35cd351.exe File created C:\Program Files (x86)\Google\Temp\GUM9E34.tmp\goopdateres_bg.dll f38670977721f01f09f3a838d1584cb53feb9fa21dab38c31da74c05f35cd351.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe f38670977721f01f09f3a838d1584cb53feb9fa21dab38c31da74c05f35cd351.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1116 DiagnosticsHub.StandardCollector.Service.exe 1116 DiagnosticsHub.StandardCollector.Service.exe 1116 DiagnosticsHub.StandardCollector.Service.exe 1116 DiagnosticsHub.StandardCollector.Service.exe 1116 DiagnosticsHub.StandardCollector.Service.exe 1116 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 676 Process not Found 676 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3592 f38670977721f01f09f3a838d1584cb53feb9fa21dab38c31da74c05f35cd351.exe Token: SeAuditPrivilege 4960 fxssvc.exe Token: SeDebugPrivilege 3216 alg.exe Token: SeDebugPrivilege 3216 alg.exe Token: SeDebugPrivilege 3216 alg.exe Token: SeDebugPrivilege 1116 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f38670977721f01f09f3a838d1584cb53feb9fa21dab38c31da74c05f35cd351.exe"C:\Users\Admin\AppData\Local\Temp\f38670977721f01f09f3a838d1584cb53feb9fa21dab38c31da74c05f35cd351.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3592
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3216
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1116
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:4036
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4960
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
PID:5020
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4512
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:2708
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:1348
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD50fee84661a000777c90429b175bb4710
SHA12345178f49b7389c9e95476d42afc32a1f0cf564
SHA256e827a921024fd186702168d5bd376fe1192f477a9e185557233439ffce584faf
SHA5127398074ae7147af9bd39be0d8468fee58132a1c2999c766e2155d03ebe1ad3b42e036ea90e91ce0c6f5fa24002e7b0e145df3bad080cdcd3e7048fc3106e8c2c
-
Filesize
781KB
MD51c8d9ed8d9bef0e5c19de1229e543151
SHA17f4b3b370a183301c7cec85a9b2dfdae96d51e83
SHA2561308017e1a4b6c92ac944e4b1ef263a666c60342756cecfc4786d3ccb43198b1
SHA5122fba5eb0a624f6bb1ad7db6e1b7df69bca7f17cc1e73ed3da8ee50b588d3d1fa0077e0832c7635ff3dfed7bbeae03835da3b97640ac1c914006a275330cd88be
-
Filesize
475KB
MD5b10e55c9585941d2afe16068e6ca4826
SHA1731da331b3c673f4f1fc6ff735b8a1fbb4cb5295
SHA256e731ecb98d5ad1e0dab3e871925527592d04cceb68f2921e1c783c5194262ec0
SHA5126f885350160f0490c897905255f3ad288e6131dbdb4edf37406ce6269bebca0098a5a6a36301b4a624f4425384e50e0ea67b6c8f3c0589581b9097ed8f3faf7d
-
Filesize
1.1MB
MD50b296ed8ca2a293aa3a26e5125411f6d
SHA1bc341d9eefbf42e36a87c966ca843b60e6d8c98a
SHA256be57071240ae6b386272ade5fc8f552824b042db922bd429b93a1cd77f9b03f1
SHA512eec336e8b97a688b88d5ff892b783c6a3ef47e69694518cdee4b5b3dc40e798301561c44940d3e8d64bec674d53cbd9e1b10341187f0918759060305f8a27d49
-
Filesize
1.5MB
MD5314a5b48f814b2da59e846e0f69220b7
SHA1ef6ab8be0614f556237c8fd96e256258a7f86158
SHA256bd24b92da51271c9ee674ceab27c465d085fb88442acafb9c014dfd2d754577c
SHA512a6ccdc52aea82e834617755aae5bc0e93feeec0cbb2ed17d78d810f8267890a464129bd5218f96b4ad587584313e5e3b923c808bc6d06107d426050bfe32bbe3
-
Filesize
1.2MB
MD503fd2167ee1176cc48ca6c8e90d9bc03
SHA1e5691b344313659fb5109b5ee65941ea9ff0e208
SHA256e3c665c5000a5557b6223b8a373933bdf4114c78718ba5539e4c605366cfda01
SHA512a1e17a1fb468581d2a12677d1ebc78d0f4f9d0356f6e1a97d5f41df03c12ed40455503f794b01292468b0a1265365569dca68102cef39949596db2a8a1137eb5
-
Filesize
582KB
MD5ea98ea66fb63b937e8164c6a612e17f6
SHA13b47616c263500591e9f79d267a3529d6143b95a
SHA2564b328946336b1ac7b74ba9c7a28ef2b812143851ce0f1f6cba622582f89a7655
SHA51271b4c976dd14b7ea8cf1f21d596c693b7f21ac8d42a6fe5896e0022b348409e03c2a230b89a58155f3448cd7e5e080936cacdecca892cc78b07aa5e31b0a2dc1
-
Filesize
840KB
MD5a3a552ac1b4078557f6f44c084fe5f76
SHA15bf7419705a8c30786eb1d118921cd49981ef22c
SHA25609f68d039fe2d0d1206c33454307362cf4e462b018e902f5ab6dede95e52d657
SHA512853927424020f11fd74270d43149e4f30345b4cc803bb8a8ea9b6dae5f832689adb743ffb194187362a525506ce3d408e662abefe86ffa986a2a5f5bd555f73e
-
Filesize
4.6MB
MD59785f9fd6a28af199a0ab9995fcd2907
SHA1de198146bf2cd4cc48776d550befdcb842c1c425
SHA25600deac005e77e5cb55ce270fd65811299bea4d106f5bf25799e9955360df8164
SHA51296520b2e394810ed27240addc5e6f339e3d920a88ebb6a4837ff40749f9a8819328d51711f878bcbac6632019aba03b9aaf51b4c2b8f35add61eeff72d4d0309
-
Filesize
910KB
MD5c542d9c5b34a260d6eb1e2e8b5182cca
SHA1f63d6262cd73442e19aa780d2a16af96cab9061d
SHA25642523d5640952707f9a412e595eb87d0c860bc564be832dc93a4ee80fef3e075
SHA512df798438d788727ae2fdfc65653ef1c014579c1e1c41b77762fe6bc96dda8e15a8a631cc0fecea7a16b3ac973832da6df890688f049538ba0be1828a1e862b3a
-
Filesize
431KB
MD54f3d9ee12cc6f747b7b2e260c746cb16
SHA14053c96fb4e02651cae6d803a1aeb100d502d7f0
SHA25625eb3aa5a8c8af6cfe2ab587336d7fc657733416627fb0d2e35eee8314c813be
SHA5122e59ca9797e3dc53539721dab47dba22234cfc607fbfd7945f006f19bef0284ab70d10b0f11bfa3d9fa0b5a75e74f992a6b223d531965ee65be3e641e7680321
-
Filesize
219KB
MD53923f93af4836de89bfabe696326e053
SHA1053a3dcdb3dc76eae94cd342e5c8ccc718f4b376
SHA256d112001accc3ac38fbfba3e33d4ed78815758611ddda71f7d95ee7a6dd5a9560
SHA5122c63ce48c719b15269f66aaa67284a103267904dee6e3f2887490c140fcbc59602727052bb254003dc85021fa1c773cdc59e4983164b88e521e5dfc49cef817d
-
Filesize
1.1MB
MD5b7497e747cd2457343b2a429475abe2e
SHA1464aeab45ccd053fea8178feba23849c704a9720
SHA256927f8e8f42d6ce78af0d9606f2618e808a7e1561a61d9186feb0eeafaacc2e3b
SHA512b6570afe10794bcb1d036ed808117d041fd15cde1a8ede9af48a8d3f7d4839e73ddbf3fbf0c6c677326f2823aed57a194e9dc7a3d8d16da25d508a05fcf9b0aa
-
Filesize
805KB
MD57d52ff9284ca2860e5722ebe93bd7630
SHA1c8d9ff3d8d5d30630fcd1eed7245a0f1ae97fac1
SHA256ef44bfe1d7b8aa85f0f9c67e3d861e0b74caac820b7aa255469f1dbb54586332
SHA5122a188b9c12294a222fbe3d7851a90927c71976df1d7c6a5cad767d6f45aec591d8ca2ca401e08bb233623ccd01678869f1dd45b0f0961902d81768fb3a98f894
-
Filesize
656KB
MD56f990478199cea7db2ac9fc682095f90
SHA1606141f681274e357f875c66bd3f8d5e7eb582b4
SHA256ae35edd99a49bd233e0bd8cbdc6c93f848d81f9842c01fd9994593d10f618ae0
SHA512afc9349554d43ba87bf7a4267366851e57a6cbe6a222e9ec04bd441a0fbb43fd790f5488091da1839047f0ef11330d7436a356b0625345db98ae89743d6f163a
-
Filesize
4.8MB
MD5c39bc3999ab7136f7d913af7565e173f
SHA188f49314edd2bf6e8e54cb2e2e64923f383dd6a8
SHA256ea7eb416e67742ea679bfa55d24cb8d952e5125fba638bc626bac2174c46a80a
SHA51208b27d62002a24c7c7107bb777c9aafdaee8e7c585adc566ec6ff959b7ca10f34a789a9458457b48949aef7097482256505b79f1d019ec0777ab335cc5ed5e99
-
Filesize
4.8MB
MD53ba392cbd5d03eb35ade85ad0a464bbd
SHA19df8ea6e01bde7d57bef59b9312eccc8b711a739
SHA2569ec15a6c8048a1b3ee036d23a6c09a8b6febac649a6f1a65ed6d174e06e9f1a6
SHA512671554f035c9c88d94992a66773484c6a94b022ad8d48d59d8d9af59b8c520522780fe81e1b9c5a704e2c9432c61a64ba7ffeaa3730145ceb601af45aedf7d2a
-
Filesize
2.2MB
MD56a1ebc8f2e8256fe19b18b529d1ea615
SHA15bce47b4c4ace42b0196e733d6108a22d0eb3176
SHA25675d7c565c0322f226137447cf17b8e6dab4022b728ba408d707188cd21d5c572
SHA512e2b8f8be5fce1ad1fa99fdc4d1fd97fd5388b11f67772d17c7338c31a89bb6adce77fc2a88e5252d70bee15ca12fde102b2a858ac35a0d6cb48b5dfef606436e
-
Filesize
2.1MB
MD5f8f28ee1a4c5cffa186b8353d8ff8c97
SHA195f47fa8d5b6596728046e3ca8bfc671b5412ff2
SHA25665669b4d7ca52ed7ed511c606b24dca159c39cee4338c03ac1086750c3f3007c
SHA512a2823272574e29b2a59b1b91ec451d34a54b28693b32ce7f0c5c940cd3645526ef692c87e5b14c081d33fd6da8b0c4728c9084b225aae01a9975696757e114f4
-
Filesize
1.8MB
MD52594400403c48061d7a7be095b2ba761
SHA19bb611849ea27ce182b74811b470fc261479c102
SHA2563c28cfca31729023bdae3e593292f8aa0bd9d617ce6266b0bf3176a42ed0f4ed
SHA5127e3d6016347a90bd0674c0711b14b3b7d27b1822c90c405655962857693451fffd34f48f8964690212d45a5a1f9598bfe0da9df827f403b1530a29cca18fa044
-
Filesize
406KB
MD59f1e654877c84f8ea7b8ff0122cb1b53
SHA14c6554f63f9f6c5187b89bdc7d3d2a56f2c96513
SHA256ef8d0fa65e9c2107ad00aa41b92502b11a1facb8eeaa15c7b0084536d77fd140
SHA51203169ed8c85272beea00cc38dee31781f235871c8d610a8290e56ecb9200ee02f663f118e2aebb5545daee13b41280936c9bdf25081eea768b8d324444a32fee
-
Filesize
581KB
MD50f5944c3aa53333f596a62459c60e484
SHA1e925784844338e28e17dd1320184b8679c505641
SHA2568623baa70ad40d384b6cf13d65e4b6a08b07040932cf0b1060ec9969c1f02661
SHA512d5f84421461c863568ad6d2a1629e7fc7a36363881869dc1eaf504e4cadae7ab28da0c2ac8cbd55de9a5cf4d935fa2896bc04b81fd659a19ff42eaa586767b80
-
Filesize
581KB
MD51c69bee9edc110d17f9c6c8152c47071
SHA1df31fc42688d34bfe6ee8556f3c62262ab731aa1
SHA2560490e95bfa499ad2604697cbc302cf3ce5916c72326b3dcfc6db4723674648fa
SHA5126130287f0634db55a903f4d6e1692f24c0db6b4f518394a79e0d3a815b5360113b3cffbe5ba372bc6c1f342084f751ac82b8a26dbac15bcf8a00c1c2d8e5f34a
-
Filesize
581KB
MD51c9d79e22498fb5570d67ea9f572a181
SHA10f37fee3ab756e581cd68b0840d9d5152b300bc2
SHA256a0dbb3d8569a90d0a892199d2183a90786d207380106f59ddb1ff04a20cafdf7
SHA51284b67d796c65f3cfc3b6bb5b87a1ffb7ee27ebd8d913dc9bb41da3083b68293753be15023dca9a3006cd27e6c56faa942b6eec61e9f1b45e31b619bbbacd44ec
-
Filesize
601KB
MD57fffd833e72c7957fb961c0136e9200d
SHA12e114ae43bd24f8481977fdd8deeb9f711db9352
SHA2565226db997b35503d167a8433edd98136c03d8ad7e4eefc3af738e9bed35ee05d
SHA512d054dff3fb91532ed6d6e457e0da4b9c1c33edb2ff5e837c0144cb7fcacf3d706874a0dc143174b23952ee906ed917407daaf2294aef022324844695cb7435f2
-
Filesize
581KB
MD578e02d9884371a9bcacea22a3970e38c
SHA184f95b574e0921ff62fa02f98dc3c2865a293001
SHA2567ffb5bd716ef8a67edec7e8714974c30bde734422b62c25681cd709e4e2b3e2c
SHA51266ac15d03dfdee4c4267605c48dc51433ba06f13236555aad490d7a471e85df7c0aa32a8f1fdd300e92b826f75e51489c4b7802e6fbca870db04061d7fc7ab53
-
Filesize
581KB
MD50c5f2d0ef23651bebe9f7bdcec921736
SHA1071f7967c240cddd11856b8a30eeb10a54ad6d3f
SHA2562da70d7a35bbbb2acc94f8ce0e0ad9ad2aeef4f02878c479e9d27e595d176d52
SHA512ea2acab497c62c335ba246be1e37d8bdb9de970e41640028e72779c0738362660486fd91e60986cffa206c278fac9a311c4a8a9ea2da0a245ca61fc78ac4757a
-
Filesize
581KB
MD57deb7f442aeac55690c5cbd75c93444b
SHA13478b26372b74c852fb826bba431b8ec609d1713
SHA25628726a7b5585487a61e363c7c0b9619213802e1c0fc9bb610f28d243e5827c78
SHA5126ea43844868915eb9415d0d72d7bd4378d25e72a0c0886ded4098b7983752e52bbb4ec565bf52d06dcdb47199b710f5809a01ca031aa2b4960bb726b4e0a7157
-
Filesize
841KB
MD52acd4e515a7faa0e059406f6722d2030
SHA15fca68d10095291f441e6da37be4f25f38391f9a
SHA25661a6e86de1de9bfbb813d5d8957db1624b1c5f724216537a116bfbd5f4b82dce
SHA512b9107c209d91665dbf16c1234b72d81499f7852d5b4046b912050c636f8d4afe301a55251f3425775e6eedebc24a6795b5facf69a7719aea90fe68ddbaf73264
-
Filesize
581KB
MD5fe186f749a9512f5b9ccc799b4e5463b
SHA1f9ff9b878c05436151d998c636b26738616869fd
SHA2567c6382b90ea8bdd28b96cdfb677802a597c1fa3429ec565cc1cde9069221cf46
SHA5120a5c8000e477e4ae51586c9aafa4cdf94ffba12dd56ac6c77860420fb241b0fc29565e05117481e62b2058868c578a125668bdd37c5d0467968f8ee2743771ec
-
Filesize
581KB
MD56b769e92f38d4353013e925a9ded4979
SHA1a461e99166439b90139cb25d2a453bd9f08bc489
SHA256cce07e54a503faf709ac6eba4be8918eb410a8babb6ad23eb87d1a0f19fee8a0
SHA51293682d15fb4288089c89a601b7f199ff2ae83e40776f8bd3e9a0a4b17b8108dea036f80d495de58acd0a5bfcd921b4d10a148341d02963092f8226584857058b
-
Filesize
717KB
MD553620fac5dcb8431ce7daaf6c0168488
SHA1f44813ab9c17165632eb7f43148d46057f3a35cf
SHA256a116a4472e1fdda328f07e04a42eb003199575ed266eea4fa29d207d4f86a45b
SHA51293694f9d857d17c05c6a747bc5465f496eccc5a6b96e3b5706a59c044ceead9e39b8e41a1ed72a652356b2fb65d61cbb4a0bcb8cd17e2b2156a2e3d69c8c601b
-
Filesize
581KB
MD581ea88cebca65ddd683dc9d4cb955e8f
SHA1874ab9a01da87f8a7171d6a22bb46375e72e15af
SHA2565cb359e755c71dee746f8a131f7f661cbffae82e63a0b9d52a50f62497eedd04
SHA512282fd1a55d2bc76f8274d2487b738e44278fa52a8461f99a609d6c8a4488aad85bb0a55efe564d378103f40bd782d570eea5fc03b822cdc84ffef5b680e3039b
-
Filesize
581KB
MD5b0334546528ffa3e58ac3c97f02ab864
SHA1bc101b700a22cab2c7e48a4d04b7cc9a26f8f416
SHA25685310444877ca8d0e342eabf7e2b9dd5cda71e83a05431462b287a671e8c46b2
SHA5125ae5aa78ee87c8aa381a54af596917531a28b5515d9e498dcf2fbda174afac16e6066c1e306b5236297c28a93917a872bc9235cb72f895a7590f632dc26ab128
-
Filesize
717KB
MD56605740dc9adc6b601419dafe2801e25
SHA1801a77b71f6222f1372f6b486ca990462cf91e44
SHA2560c4952b3025fa153139935abf211b60adb21f187cacf51ce3635001c9093092a
SHA5126689512d1c5a133c7c2b32c7abe19bfdf5f23e69f9af6ded997db32874fa98919bf8da43011b3b41eb7d03404c54d67786afcb4531d576cc491fe57e1824f126
-
Filesize
841KB
MD54a283c65c82226bb8d66423e747fb6f8
SHA109d08a81af23ec0ec0d92b85b89de73049378696
SHA256b8e538737d0b13aff54c8ed104dc160765702834c4efaae6bfb368473c4bd344
SHA5122765ae63c2d486f5026aa319a14455b9b5c0757d69bff306f826e9149340eaad04b9beef4f346d8d555535d75f6638f2007aa66c19f3cdd7fd9ddbdcc4fa58bd
-
Filesize
561KB
MD5c89de030112073d174f639077c355ecb
SHA1443597ed23b84e37f2beb6f850ae29b25233332b
SHA256aca188f277bf93463645cc4fcc18391ed71836c99c28d0721374dd65b7f95529
SHA51262ef9f85fff9d6b90eb6439833c466107c23980fecbffb43bc71bbb13964ca371e68462bbbc6bbeac757d8a0a1c7c6ad2ca2fc92aa9ae2c9ff7b515384fee6b3
-
Filesize
464KB
MD5f42416c4c1213bf75abfdd43c44d7f15
SHA1eb53fd44c4acd1232b636dd00ad4f10bfa5788c4
SHA256d9150ceb9553ea5b52d1bee199e6f6e7702c6c3ddda7b0b38136fec26985482d
SHA51262e0adecd1099b40c888e8bc185a6838750904860eb086a7f272d9291e785e4482b17ee30ee22585e05493a237398ce65c6ef938f0a7a909fd7f784098cb75b8
-
Filesize
417KB
MD551cab621e4dc8ac2a25e85b0a701cd6b
SHA1c4c8f7dd54334ddc693b0f4fbea1d740931de1bd
SHA256a65e2449931cffff7868e21583d11d272578418d1ef56914cb96730a08cab7d3
SHA512331cd7cce7cfbc7018a7d711009dffe791a0cdbaf7c72bef1fd15a8a15b7e70ad05831be0e00649f5148ceabdeca444b1d7f2670902f4f089b5443e4c2a095ec
-
Filesize
407KB
MD504dafc6302ba5395e82a8419686a2b5f
SHA159f6ec2ac00f629c3a54822be8b15dd6090305e6
SHA2564f126b33d33d9442e604ae2a1038f664f104d7ea55311a5f765c2e3a8f5a52ce
SHA512e91fd1dd9d050c414c5477974eef7e8a1037caa375e7a0fe65e8f01749712818f700b732ebc154b3c69d398ef327f9608679ece5f767b25f2bb4687a2790774e
-
Filesize
537KB
MD5533bfa8e50e3efd9188a2525fdaa735d
SHA1e88f759496236317f8d1cf77796aebaeb1a5fc88
SHA256d4235e882e96672ebc08121f71a4e9659b76bd7b6fb6dfdc05c17975f0dd3695
SHA51274373023c0480a009a6ca31a877c28e32576d2dffdb8c9064e6a84d159b60a22cff91c784f7cfdd3893c7b1544c69268c3e83e7bb83a6a768b38bc52320b3b7b
-
Filesize
457KB
MD58be2d90077501929fd4da00dba1f2347
SHA17f7d52c98af68c0bb9b123578dd1ecaa3d0656b2
SHA256d5ca4e02733da11294a59d390717e31b2e44742c15413a4e7630fac8f6ceda96
SHA512bd65985dc886c84dbecf1a6b1b4ad032e7c3d8cb4d73f8717a47af83d89b79167101da81fe49f2800ad67a182ae90e72999d7f712a00f7864c72002b141d0bf2
-
Filesize
343KB
MD58c373cf6dd47686759b604be632961e7
SHA1cb61744718c07f2107570b8a3b4694a5e700c076
SHA2566c9bc68c67872c7b0858732542d94699e28f3529164651c6ac764201f45fdce2
SHA512e41c59e66a55cd0d208dcc3d95dd2cd1d590781d361b0b58a05d5460d9710cceb8960b13a803f02da046b8121d1c30183ad3226980e0add3077b10f0a619a08c
-
Filesize
372KB
MD5711a3798575caa77eb1a5ae32a03e2c1
SHA1a57cb5478aaf8a219c82451a14f385aa494bdb9d
SHA256ef8ee762bf44fa21157acf75a2144a00e9a73961d8b1947478bf01ec50dbdafe
SHA512d4913f1c384699682ae83eb3339db349e9e40264f5dcbdfdbcdd45232ec23a9b84e90eaa6ab34f3b04e2fb95d48abde15c59e26904f1b90d7705f6561e6a989d
-
Filesize
196KB
MD5194d560133d6b7de92b9316b083ae624
SHA19bd36d565deb8ac6a5010ff35d11577442f32911
SHA2569b5974ad9bfefeff64c2451de4678dbac53a6a8d1f22bca497490f82ef21d0d3
SHA512246247e970d135b22e7e7543f142311e07fbe82cae66801aff3faa692a1364ecf625cbc596c27944ce3438754cca514fceea5a7f1bf595e5a542cec0877e88be
-
Filesize
326KB
MD58d7da0d5c852e10174ce750ffcec75db
SHA18e5cd0fd0ffc5a306ad08f2a4643d450f675d0b1
SHA2564f5213ed9e32dce6e1af2925adf3149c89af5504413fdc2829c29852e7df1297
SHA5129298fec0b4113c5e0bda72cb57a31a8f336ddbca9f37b786c3da10e034d0472ec723fc6b64110dcfd9a2df44ed9e812ed1c98ab63bb787bd67656c6c7837ccc2
-
Filesize
397KB
MD57afafedb05d0f17b5dab5a73804d26e4
SHA152e69b9661cacdcbc3f74f3d546fcc49a50c1522
SHA2567a3970cd73f5a1f6dcc4bb78542aaedf71b37e5d7db0ebe8ab0055edb4f57b2d
SHA51265deabe6426bef0aaa4e87a80a1727258d6d9db64a52f90e7dd0a82edaf52c17dcfb17610d319d55feada83a68c14f603622babacada6e710973f745c2a94ae2
-
Filesize
339KB
MD5707708b68cf963377dd5808c94507825
SHA1626990b6d676a45ce5cde491f7616487ce49a9c7
SHA2561afdef061ce7d7ec873742f886ecd4e65747d533b870e2423cc16b5315778392
SHA5122469eaa4484e96255c22d5b91b7fef17b695375893819bb1f679390b96b9008195205badfa941b643b25ff6c6d140144fa8d93b4f84cd5b51b65934da0dc2a30
-
Filesize
384KB
MD5f02dbd3e3bb2b5558a36fe926ab5a075
SHA147744732081a7a436d38508c7d24e54cb47837bb
SHA2566b5c7ac13c51a0bbc9b86d3c1883de50710bbb444fe841de863ed449da923aab
SHA512a21551f3d699c00dba2f4c7cd8d7e21c352121da51165214b2b1834dc4e174ebecc044dd97982f3961a095dd06046396d6542f3379b9484614ad00110bd6d738
-
Filesize
223KB
MD5567246fc7569d6eb1bb13759a1715209
SHA170c801cfbc59a302af41de478306b546740de061
SHA256a31ad679935d93ffd215f7cf51a4a9ced50705090b3b523ea60ded9e68bc42ca
SHA51290efe06fb014e0dac88a6852ed034f3108fcd6a69e573f4ee7cde043373bd47adb077151f3ca76080ce3b0cb88c0ecfa508061a789985e24d0d4c65241fc4714
-
Filesize
336KB
MD5ec40fea2446ac540b6b6fc24a1a0dba1
SHA12719dd0950d80f9d38a2c47076bed1b849c4ac8d
SHA25658b21687535f5b0a72b3ae982f0cdbfd7546c22c27c055dd4946b09289063498
SHA512fa3742c4c5808dfb1f22f6ecb64d36153cd27d999d9f6c25191f246e807723216412399c5a4fe1d788690a5d5b8f41a1e900f05438da80a5c723a541215a6583
-
Filesize
177KB
MD5886e04e075eff3e823052515484ae434
SHA143864fdc53a64332f2aee3e3da1da308548b607a
SHA2561066bca2c040c592d3b3eca6f633c979dd47fce15e4534af0d7148fa193ec294
SHA5120f0fc6cd6e7b1bf44686a00b546fde2cc570c3ca32083afc9d6837051c57bf182bceff0608358aaf86f68822398e3ef0ba718c39b532d9303015fad0d1b9758f
-
Filesize
99KB
MD5c393eeb4104bab968dd530ae1683f734
SHA111df53ac85e861bfdbe4522633250562ab3ea9da
SHA256e59d4893de2498b5c73eeb87323cab6b42df50a1239e271dba96da2c26dbff49
SHA5128580b59cfab94d4386fde443f866b8b56948007966a1ce9410a20ae7a9191f7ca03a84d4615b630346cdf1aec2f1f8911c4c0724746c2c113de47463ce3c2392
-
Filesize
238KB
MD5d7e8fc28b5cfafb6ecc5aedd2348b934
SHA17227803f460507866eab1403f6c78053f4b7f81a
SHA256e9d9c0e630508a79747a5a9b4b4802c5b603b9d2274f04a293ae09ec245eee0b
SHA512324a93402a3452f4699a9dc51387e1a1617ffb3e7bc6f473b174df427160b6bfb66678fd258576bafae92ecd2c9f1521014704055543fb52847d9a80bd2b38de
-
Filesize
325KB
MD5f95f43540b06a42bd33850c0cb298afc
SHA133b8f8508285538d0bdfb0bd501d25be41250ac3
SHA256a377b3904375c551f06bb54f75054db63e0c2f4927196c4b08dbc5c1a71bfd0f
SHA512843c775ac7f48fb2203724862581a060a0bc0e199e88f0c3dc123d282836538ce997104ed079ddc19c6380947ed1c3ec43544da5a8e19dfcb40ccec16c994119
-
Filesize
269KB
MD5176ed454bef3d79aeff73996451b1f4c
SHA161671bda9945fa3a9ff660dc8b922b358a62f523
SHA2565220b4f35f43ffefb8ef27d58bf413e5c8ef6ce19cde948af08ba8f06e5ae895
SHA512054b55f5bb9f7abf9b8c39a710fbc1de72e57a3a787b108c73b8b22be788827eb0284e89ba096681b109a437767175f31636f7a38296c9677a0939b09e8fbaad
-
Filesize
171KB
MD5872e812c58c49e722c3205e0b9f0dfd1
SHA189ec292980d0e3648f74bcd4561b1c4063e5f56a
SHA256a7b0a4089d39014443e9e9ed74ad16e98e661903ece2a9f80e348f971c5b306a
SHA51244efb1ae5299d69d487bad57695a83132ddea4def1906ac28596d2105a6c86fe160d815741c54b8a19139d0e58009b6ab929d07810962c6a395749e26afcb23a
-
Filesize
696KB
MD57741076f524ff100272165a31924b644
SHA13240bdfaf225c09db48ca3858646ad33136f2bb6
SHA2565cd2d799fc29a357e22a2c82e094d8257930facc708af3760487f11f79320771
SHA51213a48d228320fc1c41533730626036e9755da6ce49b4d327ffd3d1f41640e14d49cff673950a8df7829b06882bf286af61be441f4d98e50ac985542a09c0e1ba
-
Filesize
659KB
MD56a3adef401295d9cf30558a1c6de82f2
SHA1f008ff3cb8aae6bf0eed4ff063a487960c70ac6a
SHA256c46f160a526638b3181f1814076e0cbc2393d717aee18f26c94aa8437f091fab
SHA512f9eca503e1532ecde767912f669b414ba13adbc12340cbe70f2bafac6f730a18df9ef5db7fda478f4978d296dbf8de41ba56431675699b9fa3fe18bc99b7c587
-
Filesize
1.2MB
MD5944cc2a4fb2405ed7dd08c4d77cdbbef
SHA14c69fffc30ea18c3ec7bf0f77fab8cf405a58c5d
SHA256f91622c60b6e477acb6f4d7e0c30b293244566df38bff689fef1c7026e8f1234
SHA5127a7b86b9de17493683aa2ff1c753f052ee0a9f909b1b76a19925e4a65fe4e6aac6858cb8d361609b18ed376332939dfe6193ca342226e73e67a60cf2cbf75c35
-
Filesize
661KB
MD52d70acead20cc86c8c1547e8db75791a
SHA1499e64795fba168c7689de3b29e9e85db196584c
SHA256ab4886c0529907ab326ce8a660c740b7f340821bdf8b407ccd014d3a4614fa15
SHA512d2dfd245b3ed917356bb6c25150de2c93ee9876feb8ad7b83a763a1285a12c0c2d1701554a6bf834e7a3fc1868064fbcf5803a04b20fdcd5fe60159a4e3a9535
-
Filesize
1.3MB
MD5049b17d36193c76dd490d24109036f78
SHA177e9e616ac1c29a5d0980e328386cab4b4a196f8
SHA2566db29564bee6b7379f80459cab3e93d79862241e686583986273bc322bdff1d4
SHA512dd4270dcaed1a3721ec3c1d9248e92dfd0394f1c622653b00624b44e089f3b5e347e384a120b7dcf42921d6ca2dd4ce9b4b7d866a7277d3ed3624e026f3cf04c
-
Filesize
352KB
MD5081728aa303510a0fefc547f981b94c9
SHA16dd05c29f8a9f7364ca103c627e120a1c62af0d0
SHA25693083e2c91d8c2fe981da04fd61aa2d9de344e5adc28c30e21cf7f76543f6767
SHA51222a984fc8c9122275d5dc3df5e02d2ba013f735ffbca4ae3b43d25c932fa7df9c1f612c47f260524af451900627f79f536be4b6211ff5e14945ba1f61dc8259b