Analysis
-
max time kernel
77s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
27-02-2024 01:41
Static task
static1
Behavioral task
behavioral1
Sample
5cddaacf9782c030db128e3ebfd8f301.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
5cddaacf9782c030db128e3ebfd8f301.exe
Resource
win10v2004-20240226-en
General
-
Target
5cddaacf9782c030db128e3ebfd8f301.exe
-
Size
162KB
-
MD5
5cddaacf9782c030db128e3ebfd8f301
-
SHA1
71bae291b66ecfad6ee79ab150c9b4bdc676f06c
-
SHA256
6d533c8a98cee42c8f797a0b982a0be0da8d7503da8c42e8da10a88bfee9bf23
-
SHA512
bee3cbdeac5a317f58ebb2d621740f8b7e81e47db236327cb0e908bc49886e320e30a95191470953177740f702adfe704a626325ddd2a33f10c8ec3060059797
-
SSDEEP
3072:pR3aImWaDnBilDV8X+Ld1VVuLtKsQfk1RoGJS4dNVEv:pIbWaDBilDVNLdJBsQfk77X
Malware Config
Extracted
smokeloader
2022
http://selebration17io.io/index.php
http://vacantion18ffeu.cc/index.php
http://valarioulinity1.net/index.php
http://buriatiarutuhuob.net/index.php
http://cassiosssionunu.me/index.php
http://sulugilioiu19.net/index.php
http://goodfooggooftool.net/index.php
http://kamsmad.com/tmp/index.php
http://souzhensil.ru/tmp/index.php
http://teplokub.com.ua/tmp/index.php
Extracted
smokeloader
pub1
Signatures
-
Glupteba payload 7 IoCs
Processes:
resource yara_rule behavioral1/memory/1136-198-0x0000000002AD0000-0x00000000033BB000-memory.dmp family_glupteba behavioral1/memory/1136-199-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/1136-335-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/1136-386-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/2864-404-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/2864-427-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/1020-440-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Creates new service(s) 1 TTPs
-
Downloads MZ/PE file
-
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 1256 netsh.exe -
Stops running service(s) 3 TTPs
-
Deletes itself 1 IoCs
Processes:
pid process 1104 -
Executes dropped EXE 12 IoCs
Processes:
6E5D.exe7A41.exe7A41.exe7DCA.exe8DA3.exe8DA3.tmpFBB2.exe152C.exe288c47bbc1871b439df19ff4df68f076.exeInstallSetup4.exeFourthX.exeBroomSetup.exepid process 2592 6E5D.exe 2436 7A41.exe 2444 7A41.exe 2580 7DCA.exe 2840 8DA3.exe 1552 8DA3.tmp 1732 FBB2.exe 1384 152C.exe 1136 288c47bbc1871b439df19ff4df68f076.exe 1408 InstallSetup4.exe 1504 FourthX.exe 1536 BroomSetup.exe -
Loads dropped DLL 17 IoCs
Processes:
WerFault.exeregsvr32.exe7A41.exe7A41.exe8DA3.exe8DA3.tmpFBB2.exeInstallSetup4.exepid process 2768 WerFault.exe 2768 WerFault.exe 2768 WerFault.exe 2560 regsvr32.exe 2436 7A41.exe 2444 7A41.exe 2840 8DA3.exe 1552 8DA3.tmp 1552 8DA3.tmp 1552 8DA3.tmp 1732 FBB2.exe 1732 FBB2.exe 1732 FBB2.exe 1732 FBB2.exe 1732 FBB2.exe 1408 InstallSetup4.exe 1408 InstallSetup4.exe -
Processes:
resource yara_rule behavioral1/memory/2444-48-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2444-51-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2444-52-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2444-53-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2444-59-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2444-62-0x0000000000400000-0x0000000000848000-memory.dmp upx -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
7DCA.exedescription ioc process File opened for modification \??\PHYSICALDRIVE0 7DCA.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
7A41.exedescription pid process target process PID 2436 set thread context of 2444 2436 7A41.exe 7A41.exe -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exepid process 2932 sc.exe 528 sc.exe 1472 sc.exe 1972 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 2768 2592 WerFault.exe 6E5D.exe 2736 1608 WerFault.exe 5F28.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
5cddaacf9782c030db128e3ebfd8f301.exe152C.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5cddaacf9782c030db128e3ebfd8f301.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 152C.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 152C.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 152C.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5cddaacf9782c030db128e3ebfd8f301.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5cddaacf9782c030db128e3ebfd8f301.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2488 schtasks.exe 952 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
5cddaacf9782c030db128e3ebfd8f301.exepid process 1956 5cddaacf9782c030db128e3ebfd8f301.exe 1956 5cddaacf9782c030db128e3ebfd8f301.exe 1104 1104 1104 1104 1104 1104 1104 1104 1104 1104 1104 1104 1104 1104 1104 1104 1104 1104 1104 1104 1104 1104 1104 1104 1104 1104 1104 1104 1104 1104 1104 1104 1104 1104 1104 1104 1104 1104 1104 1104 1104 1104 1104 1104 1104 1104 1104 1104 1104 1104 1104 1104 1104 1104 1104 1104 1104 1104 1104 1104 1104 1104 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
5cddaacf9782c030db128e3ebfd8f301.exepid process 1956 5cddaacf9782c030db128e3ebfd8f301.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 1104 Token: SeShutdownPrivilege 1104 Token: SeShutdownPrivilege 1104 Token: SeShutdownPrivilege 1104 -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
8DA3.tmppid process 1104 1104 1552 8DA3.tmp -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
pid process 1104 1104 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
6E5D.exeregsvr32.exe7A41.exe8DA3.exeFBB2.exedescription pid process target process PID 1104 wrote to memory of 2592 1104 6E5D.exe PID 1104 wrote to memory of 2592 1104 6E5D.exe PID 1104 wrote to memory of 2592 1104 6E5D.exe PID 1104 wrote to memory of 2592 1104 6E5D.exe PID 2592 wrote to memory of 2768 2592 6E5D.exe WerFault.exe PID 2592 wrote to memory of 2768 2592 6E5D.exe WerFault.exe PID 2592 wrote to memory of 2768 2592 6E5D.exe WerFault.exe PID 2592 wrote to memory of 2768 2592 6E5D.exe WerFault.exe PID 1104 wrote to memory of 2312 1104 regsvr32.exe PID 1104 wrote to memory of 2312 1104 regsvr32.exe PID 1104 wrote to memory of 2312 1104 regsvr32.exe PID 1104 wrote to memory of 2312 1104 regsvr32.exe PID 1104 wrote to memory of 2312 1104 regsvr32.exe PID 2312 wrote to memory of 2560 2312 regsvr32.exe regsvr32.exe PID 2312 wrote to memory of 2560 2312 regsvr32.exe regsvr32.exe PID 2312 wrote to memory of 2560 2312 regsvr32.exe regsvr32.exe PID 2312 wrote to memory of 2560 2312 regsvr32.exe regsvr32.exe PID 2312 wrote to memory of 2560 2312 regsvr32.exe regsvr32.exe PID 2312 wrote to memory of 2560 2312 regsvr32.exe regsvr32.exe PID 2312 wrote to memory of 2560 2312 regsvr32.exe regsvr32.exe PID 1104 wrote to memory of 2436 1104 7A41.exe PID 1104 wrote to memory of 2436 1104 7A41.exe PID 1104 wrote to memory of 2436 1104 7A41.exe PID 1104 wrote to memory of 2436 1104 7A41.exe PID 2436 wrote to memory of 2444 2436 7A41.exe 7A41.exe PID 2436 wrote to memory of 2444 2436 7A41.exe 7A41.exe PID 2436 wrote to memory of 2444 2436 7A41.exe 7A41.exe PID 2436 wrote to memory of 2444 2436 7A41.exe 7A41.exe PID 2436 wrote to memory of 2444 2436 7A41.exe 7A41.exe PID 2436 wrote to memory of 2444 2436 7A41.exe 7A41.exe PID 2436 wrote to memory of 2444 2436 7A41.exe 7A41.exe PID 2436 wrote to memory of 2444 2436 7A41.exe 7A41.exe PID 2436 wrote to memory of 2444 2436 7A41.exe 7A41.exe PID 1104 wrote to memory of 2580 1104 7DCA.exe PID 1104 wrote to memory of 2580 1104 7DCA.exe PID 1104 wrote to memory of 2580 1104 7DCA.exe PID 1104 wrote to memory of 2580 1104 7DCA.exe PID 1104 wrote to memory of 2840 1104 8DA3.exe PID 1104 wrote to memory of 2840 1104 8DA3.exe PID 1104 wrote to memory of 2840 1104 8DA3.exe PID 1104 wrote to memory of 2840 1104 8DA3.exe PID 1104 wrote to memory of 2840 1104 8DA3.exe PID 1104 wrote to memory of 2840 1104 8DA3.exe PID 1104 wrote to memory of 2840 1104 8DA3.exe PID 2840 wrote to memory of 1552 2840 8DA3.exe 8DA3.tmp PID 2840 wrote to memory of 1552 2840 8DA3.exe 8DA3.tmp PID 2840 wrote to memory of 1552 2840 8DA3.exe 8DA3.tmp PID 2840 wrote to memory of 1552 2840 8DA3.exe 8DA3.tmp PID 2840 wrote to memory of 1552 2840 8DA3.exe 8DA3.tmp PID 2840 wrote to memory of 1552 2840 8DA3.exe 8DA3.tmp PID 2840 wrote to memory of 1552 2840 8DA3.exe 8DA3.tmp PID 1104 wrote to memory of 1732 1104 FBB2.exe PID 1104 wrote to memory of 1732 1104 FBB2.exe PID 1104 wrote to memory of 1732 1104 FBB2.exe PID 1104 wrote to memory of 1732 1104 FBB2.exe PID 1104 wrote to memory of 1384 1104 152C.exe PID 1104 wrote to memory of 1384 1104 152C.exe PID 1104 wrote to memory of 1384 1104 152C.exe PID 1104 wrote to memory of 1384 1104 152C.exe PID 1732 wrote to memory of 1136 1732 FBB2.exe 288c47bbc1871b439df19ff4df68f076.exe PID 1732 wrote to memory of 1136 1732 FBB2.exe 288c47bbc1871b439df19ff4df68f076.exe PID 1732 wrote to memory of 1136 1732 FBB2.exe 288c47bbc1871b439df19ff4df68f076.exe PID 1732 wrote to memory of 1136 1732 FBB2.exe 288c47bbc1871b439df19ff4df68f076.exe PID 1732 wrote to memory of 1408 1732 FBB2.exe InstallSetup4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5cddaacf9782c030db128e3ebfd8f301.exe"C:\Users\Admin\AppData\Local\Temp\5cddaacf9782c030db128e3ebfd8f301.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1956
-
C:\Users\Admin\AppData\Local\Temp\6E5D.exeC:\Users\Admin\AppData\Local\Temp\6E5D.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2592 -s 1242⤵
- Loads dropped DLL
- Program crash
PID:2768
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\7428.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\7428.dll2⤵
- Loads dropped DLL
PID:2560
-
C:\Users\Admin\AppData\Local\Temp\7A41.exeC:\Users\Admin\AppData\Local\Temp\7A41.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\7A41.exeC:\Users\Admin\AppData\Local\Temp\7A41.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2444
-
C:\Users\Admin\AppData\Local\Temp\7DCA.exeC:\Users\Admin\AppData\Local\Temp\7DCA.exe1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:2580
-
C:\Users\Admin\AppData\Local\Temp\8DA3.exeC:\Users\Admin\AppData\Local\Temp\8DA3.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\is-13618.tmp\8DA3.tmp"C:\Users\Admin\AppData\Local\Temp\is-13618.tmp\8DA3.tmp" /SL5="$4016C,2424585,54272,C:\Users\Admin\AppData\Local\Temp\8DA3.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:1552
-
C:\Users\Admin\AppData\Local\Temp\FBB2.exeC:\Users\Admin\AppData\Local\Temp\FBB2.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"2⤵
- Executes dropped EXE
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"3⤵PID:2864
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"4⤵PID:2352
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes5⤵
- Modifies Windows Firewall
PID:1256 -
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe4⤵PID:1020
-
C:\Windows\system32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F5⤵
- Creates scheduled task(s)
PID:952 -
C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe"C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\BroomSetup.exeC:\Users\Admin\AppData\Local\Temp\BroomSetup.exe3⤵
- Executes dropped EXE
PID:1536 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "4⤵PID:1652
-
C:\Windows\SysWOW64\chcp.comchcp 12515⤵PID:1956
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F5⤵
- Creates scheduled task(s)
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\nso6D84.tmpC:\Users\Admin\AppData\Local\Temp\nso6D84.tmp3⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\FourthX.exe"C:\Users\Admin\AppData\Local\Temp\FourthX.exe"2⤵
- Executes dropped EXE
PID:1504 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force3⤵PID:2904
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "UTIXDCVF"3⤵
- Launches sc.exe
PID:2932 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart3⤵PID:1900
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart4⤵PID:888
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "UTIXDCVF" binpath= "C:\ProgramData\xcfonrchdkar\vueqjgslwynd.exe" start= "auto"3⤵
- Launches sc.exe
PID:528 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "UTIXDCVF"3⤵
- Launches sc.exe
PID:1472 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog3⤵
- Launches sc.exe
PID:1972
-
C:\Users\Admin\AppData\Local\Temp\152C.exeC:\Users\Admin\AppData\Local\Temp\152C.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1384
-
C:\Users\Admin\AppData\Local\Temp\5F28.exeC:\Users\Admin\AppData\Local\Temp\5F28.exe1⤵PID:1608
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1608 -s 1242⤵
- Program crash
PID:2736
-
C:\ProgramData\xcfonrchdkar\vueqjgslwynd.exeC:\ProgramData\xcfonrchdkar\vueqjgslwynd.exe1⤵PID:2372
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵PID:2960
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:1304
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵PID:1668
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:1208
-
C:\Windows\explorer.exeexplorer.exe2⤵PID:880
-
C:\Windows\system32\makecab.exe"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20240227014352.log C:\Windows\Logs\CBS\CbsPersist_20240227014352.cab1⤵PID:2664
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
3Windows Service
3Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
3Windows Service
3Scheduled Task/Job
1Defense Evasion
Impair Defenses
2Disable or Modify System Firewall
1Pre-OS Boot
1Bootkit
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD5be6df3d38e61bcc99c41c4f80aa3ef48
SHA102de2f7ef9d2f9e83b19f37b67fd0bdd1825832f
SHA256ab3ab0bac897a52314b6239cdf59973c80ccd15d54750ceb5a6b8a0212483b76
SHA512796fbf4c2bdce2ba8f16f7206d4c9fbbf59832fb93d98b99e476bb587db95348b6f77b368cf29bc6c763c245fbce7866bb711e0f7304a0dfed3ebfb4ce702494
-
Filesize
163KB
MD50ca68f13f3db569984dbcc9c0be6144a
SHA18c53b9026e3c34bcf20f35af15fc6545cb337936
SHA2569cd86fa59ea2d10f9b9f3293c132f158fcb7dd993fdb706944f9fe9fa409504a
SHA5124c3a3be5fda0f9060a08b95383b5260e4079dbcff73849d2fac88520ae625c33a73c5858b25b717fcccebf03c3ad9b19807de8bcfa7ea22be6648cc965072b7d
-
Filesize
1.1MB
MD576b128828f81877a5adfad5eb220a4fd
SHA1ea048c8f4c2e8c585ddf0e8f45597186b6bbaaa4
SHA2561ac611ae91a2b51544cd72ede52d8357b95ab618efc8a000acebf5803c2ed2b5
SHA5126a3b7f032aa40d119415adb87aa14ca9f6fc816fc84cb8f9f8e981420d33510129d9b5651d8af9cdc00c55cf94afdfdddd2246c3b505ac9c8276e1f725aa2746
-
Filesize
2.0MB
MD5b8bbbebf6a96db29f8a6c2c3e2726b72
SHA1074958a02f3c65261dfe5d4c349b7af4849ee707
SHA25625acbb3a7b3a4932482dee31862427ff7d8bb58035d5864a6ea8e6e4c653ae39
SHA5121f63650dc10cb4c074387e8df352c17b58a05305b363bc4042949872aa4eb9221e831a5ef17e73fe8c24cab2715361e0629e775f7b5c790598a7ee5b075c5f74
-
Filesize
3.1MB
MD562529eb440decb9151687caa9728c97b
SHA1101814c05cae4892ebc2de787223ca1f4dcb4aed
SHA2560030bad31bb465a35b4ca0ba5a21eaf0f570f54e7a3ffecb1d98f76ce728e728
SHA51282d7f0d5a032977ccf1bdf7a2672e58c0f2e41a7a159e654687974e88d557362396d047e3ca3e1aca125e3d59c2a66cd667232f7a2ba3c0b5caacc9921cbf113
-
Filesize
3.9MB
MD5a97b7709ded87e52ee06c4b8b181034c
SHA1b9d7b8477766d6316329c395eb38cc9fd914a00a
SHA2569f470f144df5ad788b012450bdb5ae2007221434974ae64390081ec523e30169
SHA512b8b9af25459da9e60935a0ffb807d8e3df291e7003f18f1b904817562c345c7652f249121d4ceed48c2d3d013a72393ed3637b74f91f602a6105ac60e55e53f0
-
Filesize
2.6MB
MD5adb29a2b3d4aae105be1eca35da10afc
SHA18496caa674d5bd59c37340e949871e6a33a6a6a9
SHA2569bc8d90c27922ab30615548b2e41d62f15ab2749290713bb3714b53ae21ab4b7
SHA5127dba52ac5bdbaa9dafd8a98503e60636ab8db09ae99faa725b768c739147ca5dd42a6b78c3879b70af9ce7093ac8f1e23d706df7f53e2d64f66de5d13e958df9
-
Filesize
5.4MB
MD5eb8346a0216dc0e4d020f86a5b55e039
SHA1bdeef0988ae0d98cac6c70c4df21cadefe50b84a
SHA25644577c4679dfee2b8e52f18ceca68928b340e4d3e4d112c64e05a39804656d47
SHA5125e1d2fe839820c1beac51feb638ecc6ba7d7f0457deb3bb2f959ac630798809fed32f18ca03f4c6b117f6dec36880951b9a64f239f58f400e2d044e97f37258a
-
Filesize
4.8MB
MD56e120337ff7bad2c1a87c123ebdbaacf
SHA1ae073d52495bb9c4ee9f52d7e510aa291ad5d693
SHA256488971b3b35bd6ee6b330d67fde5bdd489dadaee06a91858c8f4238b45a29ec3
SHA5123a62e8d8dd90a8e4808d27ed7152a5cada55338d21dff591522a3eed330be181996ba2e2f11f186e1bfe4fc456ce0670a340aff0f8120fb86dd96b91ef63c4a3
-
Filesize
5.8MB
MD5e4c1d55bbdff10de1b0f44297551178e
SHA1513c257cc4f51a76d64315675918dd02948373bc
SHA2560cd3cb451b115f3cd9e255aec4d55e62260d201ca5a7972b222395a968c2d3f1
SHA51203d61076e14d08d2cfae4c7a8487e1bc7f31b4e6dce11b57fea883aaad6e9f10c2aac8030989d6c9dcd1c00251c8bdfca58b5fc2670a7d82035f4bb474974f9c
-
Filesize
5.0MB
MD50904e849f8483792ef67991619ece915
SHA158d04535efa58effb3c5ed53a2462aa96d676b79
SHA256fca631b3198194fcc0c619b5690dbde2e9f38afb1b978bab8ea3f92b572ce1ef
SHA512258fc59050aa455ad56167dd1bbe5e098eefc0f3e950c90d89bac2aa74abb5cfa1710d866c0e28e58dcb2f914736470a4dd9838dd6412b633aee87d71b867cf5
-
Filesize
2.0MB
MD57aecbe510817ee9636a5bcbff0ee5fdd
SHA16a3f27f7789ccf1b19c948774d84c865a9ac6825
SHA256b4ee4aa0b664fe673986399de8105c600330339971bd8583177fa38dddd13aac
SHA512a681efb97745aed5f73d197730049ff80798d133245d8e8bcb0faf3532a9ef440d1687016c9f666c1f56479c7db003b0388e0a69bb2626f34c86046bc477edae
-
Filesize
1.9MB
MD5398ab69b1cdc624298fbc00526ea8aca
SHA1b2c76463ae08bb3a08accfcbf609ec4c2a9c0821
SHA256ca827a18753cf8281d57b7dff32488c0701fe85af56b59eab5a619ae45b5f0be
SHA5123b222a46a8260b7810e2e6686b7c67b690452db02ed1b1e75990f4ac1421ead9ddc21438a419010169258b1ae4b206fbfa22bb716b83788490b7737234e42739
-
Filesize
512KB
MD5724ded619685ad37a52e4c5df67ed089
SHA1e35e67dd8806a1e8683a44bbf7c2c7094361622b
SHA256b0219ae324f2acd400a39120087753eceb6d3f2e53ec5b46240bbe95b1b7bf6d
SHA512caa18e031e461d96c4e9abc5531a5d5157fef1bbf7c79477df421c76cdcac137be5efe2ca3ae5633eaf58c9dff2c51d867f895aa84e0de6935587914881397bc
-
Filesize
560KB
MD5e6dd149f484e5dd78f545b026f4a1691
SHA13ea5d0fb2de5bfad3dc6dc1744708ccd31102df6
SHA25611243641663323721ba21494a394de70ae70d4ea23c23f2e2a397fcc3cfea1a7
SHA5120defb358d59221c56731745a25250dfea49ecbb411f11f31a92ec20fa2123646f4aaf9fd4999898c39e4674f616bc1bed7ef2368b61a29d595dc7b9340dd058b
-
Filesize
2.5MB
MD57b96170ca36e7650b9d3a075126b8622
SHA1311068f2f6282577513123b9181283ffb01d55ce
SHA256e85d92a87e4bc4fd5062e9b1ff763ad228da2bb750e98fc9e29e20075f3d26f6
SHA512e5ad08aebfcd41ac76de3544bf3f7b720c36ab2a0c8d2ad26e2c5e672d24dab22ba49aa94e47f90c6014f42b4a23d0f644b0b91a02242b8dd3b7368940d56bfd
-
Filesize
192KB
MD5ef1a808dd52f6a60f3decad399efc547
SHA163a81c82975b871239bdc61fc1c22fb705f263f2
SHA256771a763f010cbe0f5e8091541e5942bb4ec4a685b25fc125fc7deb7fef1e0ca6
SHA512233a0c76cc0c2dd7cc7ead4773539a2043f7a57e9c108e80542d13c9ee5abbe2f57ce0bd429b73336672ab76e45804eeafea4f1f3d04d0ab46615cba9d4c5f24
-
Filesize
4.2MB
MD517558b05d8c1b74da7640238b8240500
SHA12310d0cc2e8174e0fc3dee507d90ecbc22f7d32e
SHA256a239217b8a4b0ea6bc796a71069fddd2cf40d6ceaeb8c105799a28244d6f1eba
SHA512ae3d83c15c0f26ae70d1427ad11b100c359cd73c1746e146d81d18434e5045f75f1c766428e318cf89a53dd52f308f665aeb4a6e7887fb4e43100cca0736f07a
-
Filesize
64KB
MD509daace6074ca06ea3737d622083d5dd
SHA1eb5e13591e3e86cfd51c0f284ca323aace0d1501
SHA256bb7d28c3a4d3efc1b473a7b07c4d4af8ce775d1461eae61f6913c81b745997b2
SHA512b5eff759b219614869d18b50fe80490a75a76db474f5f55d783b991f7fb5ecbc7b904a956a42badb6e6b9b08921b9dc00e567ff786b7ea315a9222c6944cc541
-
Filesize
2.5MB
MD5b03886cb64c04b828b6ec1b2487df4a4
SHA1a7b9a99950429611931664950932f0e5525294a4
SHA2565dfaa8987f5d0476b835140d8a24fb1d9402e390bbe92b8565da09581bd895fc
SHA51221d1a5a4a218411c2ec29c9ca34ce321f6514e7ca3891eded8c3274aeb230051661a86eda373b9a006554e067de89d816aa1fa864acf0934bbb16a6034930659
-
Filesize
320KB
MD565c145064bb3e087c2ec0ae6034c2df0
SHA15ec0f6d5fa4a931f5964c709ed79efae1520fefe
SHA2562d8e8d5d3302cf18163d55b4e452c95fcec38931dcc8acf3ad2e0c2d8740376e
SHA5127a87a15a1df889f38994f9a26313ab040ae596a7faeeb07faa556d932235486a295a2039fb3b70c0d5c806e136dfdb2c0ccfd58a17e7a68b1594559c59933f3f
-
Filesize
192KB
MD5b45b646c5c3131dbbb69c15d98255ab1
SHA1391cb13c4a7d43b683444f6c3a87305de5004a37
SHA256e107f6f456b4f9c1138e7e0f1c7d4b88db97f62cb5e624da3e574d59681dd7a1
SHA51213edee5cc6e7a05339aeb9ac4c91f7c787ba887192523f977a4eaac61aeecaccad01791ebee78ddf51196563397a3d52b064af0c897c241e6caf0466c9b7f479
-
Filesize
256KB
MD51756d6fc7bf4213c8f0a521cd42d0ac6
SHA1871962e45061751468d940000ee536794c269532
SHA256c4b71ffb200f4b41f95b23aa3a2b90e6f87e5cd7ca4a9234e33ed441dcde7594
SHA512694a8b76ffd5a1b78d63b628680e8997dbc0f06c4524804cd9da4e4d015c586c5a9145190a6dc44464592ac717df83ccce53401d68cd48703f932c6340e192ad
-
Filesize
192KB
MD59089c5ddf54262d275ab0ea6ceaebcba
SHA14796313ad8d780936e549ea509c1932deb41e02a
SHA25696766ea71dc59a5b1734aba76c1ab1cbc8459a9ee023e9875359667dbf51ea4a
SHA512ec71801feccd0c900132425d6bc601bcae6e78702b708df80783a752d08c8bdc49f0b0c8e7c37b15a02b381369b8a3c1114d7385796316b834738045f7dc053c
-
Filesize
128B
MD511bb3db51f701d4e42d3287f71a6a43e
SHA163a4ee82223be6a62d04bdfe40ef8ba91ae49a86
SHA2566be22058abfb22b40a42fb003f86b89e204a83024c03eb82cd53e2a0a047c331
SHA512907ad2c070cc1db89f43459a94d7f48985d939d749c9648b78572a266f0d3fde47813a129e9151dbf4a7d96d36f588172f57c88b8b947b56ed818d7d068abab2
-
Filesize
384KB
MD5dd76b1ea2a8bf2f7e800e0a11f01f5e9
SHA1d31c1ff5b3bfff45af20f5fce0579b80819c5390
SHA25698ddd0a4e39f3693a0bdda3844934a3211e119eee2d5155e17778b0af18e6b89
SHA5122b3118524ede04678a6306af55dff202a5dbd1a5443bd815dc6a7e3122518ca3593841b942b46b04c3053e553cf20c8baca39461f27cc7fe5d293e26050b2508
-
Filesize
2KB
MD5521b760d731a7579746ef6c0462fe5d2
SHA13bbb9d536f70345ce414cbdf6bef0edc3ffa4221
SHA256469152509c507b6ecd9bff94ac2cbb3083725b75b28c93d5394480a846bf42e0
SHA512d061c8bca15d9a229fa79a3a587d15f1856d7caf1fe6e6f1d346ca70ac71d46cd83ffdc5aaeae96a4f888921ad980855c69df1915264679b8f2ecedc81d85ba7
-
Filesize
4.1MB
MD5d122f827c4fc73f9a06d7f6f2d08cd95
SHA1cd1d1dc2c79c0ee394b72efc264cfd54d96e1ee5
SHA256b7a6dcfdd64173ecbcef562fd74aee07f3639fa863bd5740c7e72ddc0592b4fc
SHA5128755979d7383d6cb5e7d63798c9ca8b9c0faeec1fe81907fc75bbbb7be6754ab7b5a09a98492a27f90e3f26951b6891c43d8acd21414fb603cd86a4e10dac986
-
Filesize
1.3MB
MD5192c2bee85452b62bbc7b9bd93b24b07
SHA13ef36ceccecb900280aff4297c8136a3746f024f
SHA256cd989adfe10e50fb4bc10dd7b1cc24bc0729cc218a238cf3fb1fc268ad530ae4
SHA51207981649ef443bce9eb1a5815321999dcc99cc96539dc2540d953b8208dcbbda24243ed4e542f6c9682a3d76eb7226d9fd6205e9631d96de85490b85f38b4b2f
-
Filesize
1.2MB
MD593482d73c7977a8486f8d1d59b8a5775
SHA1cf17a1a776ccdb3993901f0e48383ed6803b3996
SHA2564b47d6feba365f064331a63afd8132d95b9d6ddcaf3b715e17615774fa301192
SHA51280885ea4aaacf99c1577dfe1c0e338f78d6543881a032eefb052be3c692e2950576e0bf21995c336c40b4f35f2cd98197f3fb1830d4ee8964b9c6b3c762b0094
-
Filesize
1.2MB
MD5540e886ceda4024a5e88f092e8a319e9
SHA193e348bc5866518b4ecc3ab851d17b7d767916fa
SHA25671ba09da1c16fa522855a673dadf2ce9d85c532229317e3de2a62dad2ba39703
SHA5129d343574b59d39beaec2a484abf314d91fc805acaf3f9b33b099958a535751d290986532a7f86d7f18cdfbea3774104eb62ab7756f0dfb8f98684f9daa046184
-
Filesize
2.4MB
MD508020e607d441a30c943110958c3c119
SHA1e10917fc4dbb0129c257104f1bbf657eab313f49
SHA25615e1c0272cd04b5cb98d2234ed32d17c95a3019b7ca42e29ea886533663158f2
SHA512a43255f546abaf8369591714efcaeee5b6031fe79d466c64ebb0141a25859332b0bd59079d9f275cf23be2b41de2461cd051d8eeabc32e4d966b6b806c8554c0
-
Filesize
4.1MB
MD507da0de9d1e1f35c7256751066eab517
SHA1c0725f8aa5765b0b822ec64e8c05bff72c973245
SHA25604ce9df48f74b6dad9f9a0dcf2f4390bdc1c5a1ff287508759f260f052f162d4
SHA51264600ab629dd0735736bc410b52dbe799bb48fd7a8a4de9dfe70fed22086e138d89e7a7cf025bad5b18f21c300c8caae471ec95eec5e92572dabe4bb3a11375a
-
Filesize
3.6MB
MD5343a5d9559a29d25e91a890b6db43cf7
SHA1ec3b5d5b6edff0a048af32d02f0ba7a410c26e4c
SHA256d00b3e61019fdbdf38b95240dbff0d4c740f068c6dece2df8e5e46744a1aed17
SHA512925ada47b9561d16649153f4049d1e7fc8ce9d23dc4ce0f8eaf524dad645cee1a12e0be15b0c521d9d337fa8e29839dd930266c1ad68d70e8499061053d41767
-
Filesize
3.3MB
MD5b8d1a5881ae3c792b819b1a043c0631b
SHA1e837a5104f49fa6159293ed37c2a809cc6bfc875
SHA2565474b5e83578c8fbd2ab9f82b13c85041306228b56cf1edf74e426d2c7fdd9cc
SHA5127f0eefbaa5760832eb2903a151cc89d1e3461c01357560740b9536817aa90bf7411cd36ff521a0727e58c9fd5220069b2090a16bd1fea8c481cbe760463035b2
-
Filesize
320KB
MD5c63893c98236d8df8e0dd6363b504ebe
SHA1876082f00af9318877dbd19ad499b268e144ddc2
SHA25641c42d40dd28ef8db44ed6a04d058e6082016bba29cda362c38f98d4eebd9b17
SHA512078badac8f6f81f91f44c617f50648a5678aff3797f84c75f16c57af3ed34f55871d6ff0938c3ac56300e7405929dc80d4dbfa6e8ad45449d1d0b920832bc4de
-
Filesize
256KB
MD5c66156682cd08ea200547907b7e5e1ea
SHA1f6778e34905907b10fe0788e3ddd5e1766a7a205
SHA256d1605c5bec82ffd54eeff6adfe5c1a700e4633232d27e903655adeadddab2347
SHA5121a3da2b1c45a1a1a698c55a1dd09e1c88e174e13b7ed40dbda41f6a69077d613b7758f380dd28f29ebd9a41bc95e13e13c6fecc49c61d120e6671a4ff7fd4e3d
-
Filesize
2.4MB
MD5c0a62641779a00a6ee4c01686de53107
SHA11cb45213ea856f778f2dd76983420139e64d17ab
SHA2562312e31bb06e52e177d4a7ff2bc2d508c44ee1959dfc85ba99c0c5b5f80b7fdb
SHA5127a1cdf556bce31591885812c48f013f3d5250ed4f0e2eacd239bc9366b42a48508cc92434138cc31703a28add32a9ce3efc11a289db1b5848a75ac5c33c39303
-
Filesize
704KB
MD54b0c012a59404fe817f1f6b79b83aa74
SHA1645324aa66bc9b7b7074d6d0be8f917e05e0095e
SHA2569f982dd9649c268011003f805c41db3d2e1df629aefd9c35724626c87bae8f44
SHA5128821467c4fc3768ecc6d86e8e1c8e9261a9b0d3baed0ebe85bb0b36bf884657dbdf5a24b481cfec21408cddcf39db3746248c7edce3627bda07cbf3b44aaf56a
-
Filesize
320KB
MD538005377c4b89dd0f8d6b99610fd2871
SHA11f8ea24cf01f4e416fda0f44d9b6bcddf6631125
SHA256e619a8b063287c5aae0ae35ab7ebb569a720f401a0e8c1fd6483c88d217c069a
SHA512fc5f8d7006ba7227aaaea8fbe740d80d6225b804a98083f73d0c4efc79b4609b535e00c3dac5e8eefcc515e0e0f0cef0e0a4c619eb9a31bb9fa34c0ff7d314c4
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
25KB
MD540d7eca32b2f4d29db98715dd45bfac5
SHA1124df3f617f562e46095776454e1c0c7bb791cc7
SHA25685e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9
SHA5125fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d
-
Filesize
726KB
MD5c9f33f28eed7e5ef28539d920e5685f6
SHA1bb13ffd57496502fcf29f1b2401c7920147b6e5c
SHA2560f1b027e2fb53cc6a328eef93796f2c84ccb35831ad10ed6b2cf8e7a8e0e1059
SHA512eccd54e3d743077b2c1af665d309df3c53cb47e8b8798900d87e98e4ff99e662719aff3353b6fe5f818cdcbeb36bbb0e1c0318a4a2e5029ac12a55fa9c5af2bc
-
Filesize
439KB
MD5e11e8197f21bfdc9f3cd6513c691cee7
SHA11059b05c18922862fa877f54fa7ac6dfe0159c52
SHA256d9af93732e02f73dcc88182f58feef91c9821c9f6e40a97fb3b07dd3577fc55a
SHA5123a454d5c5b8100b0f07431d15ef343e611b55009da359a2a5a8ed2830ed7285765b64c025fed5c559b30741fc28e87fab1f14adec558ce989b870d017960e608