Analysis
-
max time kernel
158s -
max time network
167s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
11/03/2024, 03:01
Static task
static1
Behavioral task
behavioral1
Sample
cf9f6c2c07b73a1a02de7c5fc9e4ae675e122ccf35db8ab13dff6b53067a94b6.exe
Resource
win7-20240221-en
General
-
Target
cf9f6c2c07b73a1a02de7c5fc9e4ae675e122ccf35db8ab13dff6b53067a94b6.exe
-
Size
706KB
-
MD5
c8b34d26726d48210ee5c90fd23f4d5d
-
SHA1
b1f69cdc0bba7a423fad301f2b677e5424bc5a6d
-
SHA256
cf9f6c2c07b73a1a02de7c5fc9e4ae675e122ccf35db8ab13dff6b53067a94b6
-
SHA512
5c4f961714267151780194a8475b2ce94af22ce2b39ee035c29552bf2260cc9a0d8dd9c669bce9fc16f6e55b3269b6f3b67c9b1416041041e1bd389a2a147d33
-
SSDEEP
12288:zWiB+tjFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:zWiBw8NDFKYmKOF0zr31JwAlcR3QC0O3
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 1648 alg.exe 1308 DiagnosticsHub.StandardCollector.Service.exe 2520 fxssvc.exe 744 elevation_service.exe 4376 elevation_service.exe 2840 maintenanceservice.exe 4240 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 11 IoCs
description ioc Process File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe cf9f6c2c07b73a1a02de7c5fc9e4ae675e122ccf35db8ab13dff6b53067a94b6.exe File opened for modification C:\Windows\system32\dllhost.exe cf9f6c2c07b73a1a02de7c5fc9e4ae675e122ccf35db8ab13dff6b53067a94b6.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\System32\alg.exe cf9f6c2c07b73a1a02de7c5fc9e4ae675e122ccf35db8ab13dff6b53067a94b6.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\2dc31340b3e2edcd.bin alg.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe cf9f6c2c07b73a1a02de7c5fc9e4ae675e122ccf35db8ab13dff6b53067a94b6.exe File opened for modification C:\Windows\system32\fxssvc.exe cf9f6c2c07b73a1a02de7c5fc9e4ae675e122ccf35db8ab13dff6b53067a94b6.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_156609\java.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_156609\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe alg.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 1308 DiagnosticsHub.StandardCollector.Service.exe 1308 DiagnosticsHub.StandardCollector.Service.exe 1308 DiagnosticsHub.StandardCollector.Service.exe 1308 DiagnosticsHub.StandardCollector.Service.exe 1308 DiagnosticsHub.StandardCollector.Service.exe 1308 DiagnosticsHub.StandardCollector.Service.exe 1308 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 672 Process not Found 672 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1492 cf9f6c2c07b73a1a02de7c5fc9e4ae675e122ccf35db8ab13dff6b53067a94b6.exe Token: SeAuditPrivilege 2520 fxssvc.exe Token: SeDebugPrivilege 1648 alg.exe Token: SeDebugPrivilege 1648 alg.exe Token: SeDebugPrivilege 1648 alg.exe Token: SeDebugPrivilege 1308 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cf9f6c2c07b73a1a02de7c5fc9e4ae675e122ccf35db8ab13dff6b53067a94b6.exe"C:\Users\Admin\AppData\Local\Temp\cf9f6c2c07b73a1a02de7c5fc9e4ae675e122ccf35db8ab13dff6b53067a94b6.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1492
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1648
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1308
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:1376
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2520
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
PID:744
-
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4376
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:2840
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4240
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4032 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:81⤵PID:3296
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD53a93b6c009d9482521cf4783f8112b3a
SHA1f9c99cff93198f36d84182c1ed220db1a480feaf
SHA256ce7603cce362e0255cec059f47fe76335d8859c14b19d002f7f4a69acfa83ed9
SHA512b1572195e4faf43da2e6dab378b1323add7dad0a521baca5a46e62a2c72cd2b893deeb40de9bf80df5cbdb9879950518be2c869cc7ce1dfe87aaed8e55e1b424
-
Filesize
781KB
MD51e7357f49cf715aff0ae80551b6ad661
SHA161302383433f406beb8cef39ce9be7e36d7c6651
SHA256a34f499cfce049b3e3f36254ab81fe1e7e465cf8c3aa271398f10da706156a0c
SHA512bd6c5c5e5b1b103b3ae4fd7be3a4ec879b2eced6ac2a78f974a78e39746f9ea8c28d226f8a8f0208cbfd3d0917a89a16ef57674e92fcf8767758f34df878ba2e
-
Filesize
623KB
MD5b8bbc2c5bdee4718f82e38b83fa0aa34
SHA14f0298286bf020cd523847521e4c9182807243e4
SHA2561e543ce807e48d46450991d6d6f403273f4e3d011c064f90c5fc38cb436c4bda
SHA512331ca05a1cda4442a6123c87733681c3f859055ba9f26abff3b8a2effcd6a15a44343cfeca5fc7c093a158319fcadf54c6bb3f1ab21f5421e0584fad7192be84
-
Filesize
961KB
MD5b93b21fab510b4359c8fcbb2634fe2a3
SHA19ac555fb2ac6a6549592013b26a8d165f7277cdb
SHA256a6a6fa54eb69729ddba2e343d2c851a1184905e301525f4bfed50a9df4c97566
SHA512fbe68ce54f0d154891481df7ea3d8303237e7cd8fbf841adce626be40ab11c1ffb92b4de16d7af1af4b39d96a66f382fb9ae671a11dfce5661255fd1f2bb6754
-
Filesize
570KB
MD502c02f5a36541e20d95813fa1e56c0bd
SHA1e502b70f121fbd074b88c3370b0e38f0bac64325
SHA256bf6c6fc9664556703cdc39f8071836769b7dbeda3fcf17693f6732b54d9c5cec
SHA512d55a34bb63c6a4ef42cd87c49a63cba2d9b8db54600eed22e0dd9be2090fbe011dcafe4bad1bfb26129380b6a273f6a0d651bd47d4a2b274e10df64c1fcc0621
-
Filesize
582KB
MD5926f9823257644da86b1ad27e36caa13
SHA12c7b419a1a7b44e480f340fe3314302894e282d4
SHA2563d9e1e93e2ea5f6ed1b36502cd4006d03a88eb3281426311b5c175d384f21f5c
SHA51261d67b8da4305cf55969e688c8a52165e6170278312e34ae8c0c33a6882678bd92192cde2d1c801308b78d51c6e6b9cf11bb1c136850397c3c798b7ba2a66eb1
-
Filesize
840KB
MD5ac6a46f5b002601b590259e0ff2dcbc8
SHA1dc821819aefd22a0ec1de9e7d5bfcafa79d24890
SHA256eaf56f4d95f53396f6c3a418316a5c38cb5baa71a0c6c2ada53cfd6ed3102a28
SHA5120d437a95e55b10730f183729f4d8f1ae05d85082c8622ccfcbc0adcd5dd46cb0f1307c75acb5baf6d17134997dff6cae9a7136a8af90555eda45f9cfdb974248
-
Filesize
806KB
MD521fc3cf2e9aa5bd7ac205b2522f36638
SHA124ae9ffee42937ccf1bbeb0fa3d8083df5119d0a
SHA2566fb28d76d325eed37c5d13bf5ea6d81951eadf632abdeb06c471d8bec927b2a8
SHA512ad2a4a2d4bb906d0aaa52ec83162b1e6c07313f1e80685a407d6fcc69f4416eef8f122f0f7058bc2ae844e9db79db65fafbae2ad1c4361a665a3b6eb28bb9965
-
Filesize
698KB
MD561c8cd02276d79671e285bcc698d56e4
SHA18c3cd6e50c8daaca89f51414196780f63ee9a0e7
SHA25635bdb92185423192e171bfce47e1ede4cbf3097d5608a582d8e502fe48f84a22
SHA51242a14607292fa9ac2447c41adaef974e0ac5ba26167fc0eacd7047c8397c7a685f0a953d7bdd574568314fc249e2f4ad73f8908878c939253880ef06e7715392
-
Filesize
466KB
MD5507390876fcd2da075c6ff230f0281be
SHA1c879ac0303806358cfcc47c64f1477f076ecfe82
SHA256397384100b523cf89e7ae5f2ab32108dae05d60ae4699477e983ae89132b12bd
SHA5121e633234727883559ca12c0bdd97a7663b1a89d1a95a118e5af36369cd5561cf7b4a65531d57a9a0371814490618162fa19c5158836f9ffe00a32130b244d6cb
-
Filesize
867KB
MD508820fa5f60d3898866c471f4b0a39da
SHA19633cb0adb188dc87d509f6b1902c558a87278da
SHA256e6b9b7ff1f2bf99afcbef618c1b61464b0b69e6e5ab1e09699b08be8c9e50d68
SHA51248b41113e298fb0eee789dd10b52657e78075244c86ecdf17e663138e36b2255d5f9f42a0cddb9300498af8324d53920d18bb8154dc05eeba6f5d742dea372e3
-
Filesize
550KB
MD57defb6c2aba4a4edd7d3b455ad5eeb84
SHA172eabfefad05e4b68ad10dcb2772b19848871709
SHA256ee6e08e7c43ca6e18c9ab843f221239cdae1450ca56e9b97ecac80f713cda92d
SHA512741d281090060de15b55c30afb9e196f5049db53b77917a1456ef77e23ba77bf2438978ca8c8811c1354402abf3e96d56fe1a6ef8e141aa576c46fc7525df038
-
Filesize
805KB
MD516b91f03d7e24bdda1577e7ee471956c
SHA1ee29ec2374677ef879957a63e27a1d7cee35190d
SHA256bd0223366d44a5093cd4e436d0b704fb0e9be21ca6de9c9f1a1f9f505878acf5
SHA512eabd864a049aa0dc809d0f8f60be5c4fbf9a632fdf914e514a355eeaa86f0dc9023de5094e87bf14b88a0c7fcc2167213f731bab1b22a49cc34a0ded83d1078c
-
Filesize
381KB
MD52729f6a9a82833ecc0f4d37222fc7256
SHA150e3cba43e59acc1bdb7a27390e8b62b3499adf8
SHA2562e6238d4752020ea4674b35fcfa032069934bac8d94aa09105e39da22745d490
SHA5126c8a6a06e315942876d942701c0f5d458ed56d40d48ebbdeb34b79bbc4998bf2a92dbdb92a2745575b7dba64ff2c7a319d257eb09053c64b51ef9e7113eb7ee2
-
Filesize
282KB
MD59a0eb86800409ea1ad143e39f0d4f08a
SHA15ba9a73d6481d6cf9103707d23c39134fb012c9d
SHA256cff917e504df8583f1d2c7cc1bd6cf42eb3c4c8925319b853954b48135e9cbfa
SHA5120ecd4c4965eaf0fb81ee51a406d357598df016a40e3528fbd1843dafabb97b4b7e6486ff32e994115b5daea1024cabf51f37eb0ca335ae771c19c8dc8658de83
-
Filesize
275KB
MD5838717eed1cabb05730dcde648b04aeb
SHA15989e353a90494baf20a2a6ee3672761307c0219
SHA25661198994f3473d86cf74c1f4c4e65555351f820b1a5ed33f3592f65b8b35fe74
SHA512679a1d00f8488612fb06827166ffdfea6b86de5fdfa1fcadef4319f6779633483b1a2a0dd2e2f8fad4afac9ce185240422bda96cef85bea0ed770b245cd34f67
-
Filesize
236KB
MD57f1eaec1438540be0a12a9f54511d488
SHA13a2feae1eb91edee3ee80840106fcf90b8186f39
SHA2567c95aac4d95b849622c51fbaaca63a5702e976bacdb1eeeb3678144dd41c3f84
SHA512201c29fb10277f59030c312c487aa79db4403e324a82b2092e28a19e91383ca8153624dddeed8f0967157b03e0c98d5ce99d347ba20e792d22c61d44e689a8bb
-
Filesize
1.7MB
MD5405f1cf81313e8fdd6a3b3991a81616c
SHA1fe9619dd23cc15f28a8937d96a44e54fef24885d
SHA256541dffef3635095ef12ba62bbc992067ba3e5e11e10b36060dca85c09dbc7054
SHA512fac9e03fb467fbb8f8aa4815575f0515119557083913514987d24f4abf4bb3122b58a0266e953164041b569ca47a01a38a77b9a3e4bd752f716d8fc86f330212
-
Filesize
379KB
MD5520db93659cad393bf86a4c4df8bb536
SHA186f3a7861aa691c57fc1b332acda67a4fa741727
SHA2563511907153229535a7cde7406aab8b837d5a2b73a05c8ebbdec0c493218f3e61
SHA512b01fd188a95b439b6a210b8276c3b4eab20a8e610fe75e5b15f08541b17daa2bf0330aedf623d054515beee1d7e298fe065b5e6e8a97e975101c6d900d5e6b0f
-
Filesize
908KB
MD59607cd4649992b940b983afee6ab0863
SHA10687db65d2ba1d4637e54fb3b212a543afb16f23
SHA2566d18b415dba6c40e9362dead80f796d5d72b8ab58ff8e30128be6e9fff091222
SHA512d72659e9818c6b312be858cdd0da8a9748b049ea2a432765b650975e07910cbc4c5c96f6c084e9326e67ebf95778331eb2f76ff4a04a3b2e1ba3f9cc5cd3076a
-
Filesize
581KB
MD5a873a427be4da125aa1f273dd4a5ee92
SHA1d52419d8e5d2f96b707dca4bcf763b43cb27f615
SHA256bb4a2926ff40c88b5404df43de6727a4c946f99b2db6f4fb55f213e3aaef979e
SHA5121a05f5faa4b4a54b03713e64b875103948925db9c387ff8495f273a234bff1fd712ecb0e29233d32ea56822ae3378842fd20ba7852354bc0ee2003ec3609d30a
-
Filesize
581KB
MD51b72c8530e24ca8f153a098e5bd4595a
SHA154ccc3c81adfbc15be1e1b3ce4fe4d206af5c8ba
SHA256de60014f1338f4441b862c462c979679352c859610bab11700327a443386b6bc
SHA51202ff369cbdfbf69de165c88c0131e8c9af088a3a4d5e5804e40ae6e502825c1ea39df7217dd41e858a6409170028728296fff9e81978b2b97f7593d670ff501d
-
Filesize
581KB
MD5ddf01f09e94777628f2ff875b5253f00
SHA15dc42794ab5a06fa5bd67206c5b544c0950fe8f5
SHA25627437e4c4ff8aaebff0222e22b4a101677f7aeb3a92d53f1f2ec81d440e90641
SHA51289573757a01c410e941f355f0967128ba053f247bc2248dd07e494c3594fcafe3aa5663991bd33b6a5076f53ac537d57c582908c343b06fae87845e841b115d9
-
Filesize
601KB
MD5c751a8668cc2c5774acbf40495df982d
SHA19e9ae26400fb83ed8228369f96f9bd4f79080e16
SHA256c85976f5be8e1fdf7f228aef420225cd255def1b392b067125c30a9162884f3c
SHA51276babc364dbd993516fd8792216516fc933f73d62be16003b078e0d9eea76b61dec93d5d4460a09dad40bcc4af70c99dd50ffaa89077022a801349e42eea3f37
-
Filesize
581KB
MD55851785c15d48cb5d8a08448c71e978d
SHA1a3383a2e6e43cfbccbd3270e2e444ce2c7ae8bf0
SHA256ab4d4768f813d6c4690538a5c8100971a04153754fcf47971a6e4769a4dd519a
SHA5127620c88f77084afe8263be5e53581e0556f3b2b6e487510f96cf20ac946ab57894de7ac4518ef7535f133cb9ad79a22d4798dae13398928f5926b1953644d0d9
-
Filesize
581KB
MD53fd7068b622dad82de79e69e90fa6991
SHA14aa423b099bbe42f9c0be9ac65f71fa76950768a
SHA2563688a1cda8f06b261eef0fef70d396a78fa2b20ae48199ba09c8377a386e384f
SHA5121fb2a858d301ef03a6b5fa10787ed0e36004e7b3e0dbff68540890115ee6f8ddeb6a8690a7b0d12dac6baba5311141bfc97488428fec5a54999e2d0314e5f4e4
-
Filesize
581KB
MD513f37d785656dfcaa03bb3dc04b4c092
SHA13fb8fd82dd4af612bd61794aa72faadc5cfd8154
SHA256b62e872ea58a3e61793c147542eb53c1eee3766cb4edb1248beec65b277080af
SHA512f1d9b2834648cd6ce30537781a02c7496013f84d566082cc6d4661b719f97f6a540c9a5b0a286ca57400906b465144aa01c4e113f20d41f9955771436e6050e4
-
Filesize
619KB
MD5bc884df14cfb42b19a4d39a29e9c20e9
SHA1cd063c4ec9042288c611350a909e696d15721135
SHA256c3a54b25534787c6d210736dc6ffa8331c30b98fb048728bf7d48c1d00a90318
SHA5121a7f936bb950d31a01e8b72b56d89144b89cac74700c8cb5919a08823ab9d5cd20a183664b8a3e4cf0882919e7ee1fc37bd41feab9d4deaf9a25ad88272a572b
-
Filesize
522KB
MD5dce32347b5b5a696d53406b15e0047ae
SHA1b569a5138256e0ef3279ba62d483d50e70919979
SHA256a5c721c697e9ede227987f29c204b38ce598d3ff76eb4d8c1aee0f7f2a9f33d3
SHA512a6ecc04fa4b3554715e230c095f8cef06b494fe8106a46140ba09521b1643995682aba9e961280ef2247fd673628aedf56c95d8a63d3ebb6a8b78ac24331daa5
-
Filesize
581KB
MD52f694be6c8165105ba6ca90ed98a9bfb
SHA1e67ddf77fd02146cb34faa18ed4ddced4767d178
SHA2563843409bca9596f2e2305c100ca15fa4df977a347d4f71f8e0b7a7eed8ff4973
SHA512bc801aac7788b4d945ed8c1d422e8ac179164a904fe926601eebb3bb356551ee936f338a62fae52e0e042ec7d43c04403affd2fea4ca446b240d8e7a544a0c9b
-
Filesize
313KB
MD563a94245a66c5ff4a55ba2e0baf8ed44
SHA1371cb101256039e02ba3adc5a81a2fdef85b23ec
SHA256c76f7d41e5a2a457bf0383b8372779879d049133609e2435ebf8083d795b15e1
SHA512c82a287b1550a931bf91ecde9c9a546940b5d99305bdfe8b42970bb0ce430b83f62d0dc173672b0b1a84ab727ce67030a7dd1512622b484c8ec3a13951d0fc28
-
Filesize
372KB
MD5f526e179392553d4bbe0cfe2e1ed7559
SHA142f29c9a53450d27021cc22bd543dd6c98976d00
SHA2569cd2e9d81ab738aceca729c93c10dc045ba25cd79dc3029713a4b91f3fb8480a
SHA5125355b6909a2809f1b94f3468f3b45f18829a8ddea1a6c42a99096de398bcfc8bfba45ebe5b98048d71dc5cdb38cc1da2d48e32c1f3d8e8e900dd37369f3d82c2
-
Filesize
74KB
MD5a73b975513020910dd4f62543bd9795e
SHA19fdc66117a568e18bca8148b1b32146fff9bc036
SHA2566284abc38e517be69cb0d25adb5093e3892c90356939c3ab631caf285c17319f
SHA5128528c6b7aa093d5f09742c641963514aa3610b9e3e6a19dd8e262eb6b79bdae14f18bda801e6c82e455911b1f92acd192680b70bc7ac50f80bbb5a94a23ffafb
-
Filesize
390KB
MD592c1a7a7d694f02856d0882379915b41
SHA16ee6b7400c1af7f10052996b84905ef11c5eeeea
SHA25611a2ff65110e326528fa6777ab128ad0d784d674c347f86dc264a7ee95e3fe00
SHA5120231ed85a0597d56348baefaad665e47b8940519791449fc508abbeb10a595018a4d4128370b7b3be98cdde263233acd900c3c52d3dd2cb00e87b721261dbc93
-
Filesize
403KB
MD50dc6365edd26fd7013a5393b110a615d
SHA154afa1534605f48c3c55e992a1912846631f42c7
SHA2560aa03826461c4d75659e0f07f9add2cde144880adda3f660901c8a91bcc33d9f
SHA512e2cdc93fed0d3ed3f67ad0d638932e92f0eca3126582e082f69ed727a4a6c3d1910e3bc4a68d7e21b83fdc3fe35b2a9f8ed43e7fb603ed881da3f9a8ef23a795
-
Filesize
315KB
MD5d0b3807d805c9eb829ee325d621e34d2
SHA1cdfb21ff1a3a4538c54b7205fec580bd3aeceb33
SHA256bc5039165c8e2973f6aac913906d8a296084ad0dbbc5def584cb935c09796fef
SHA512574ce6cd86dd90e8db7263c3011aa3fe63cfe25b70a4ac0c95c1a4004f7c627c3aa0cdeff54147a7728ad198a748501d33e2861130d96a617cb707fb8522e449
-
Filesize
463KB
MD5399c1597e52255cbbc349d23509ba663
SHA1b3d23f5855c657a32124194e16e4d1c59a7d2c64
SHA256778683343f81cf90d59f4367a86f1603b88ead2d9bedb0c1fff79eea0cd7a290
SHA5127e0fa69215c21e7cf62a410a61411777ea7c69593d51d337a034938f0adc3965faa3354c712cf083a65ae0ce8082becdc3eda7bf45a7429a58efa940b6fa856c
-
Filesize
230KB
MD542c898b12255cea059a22a319254736d
SHA13bd3d9c260713a64f11a4a037afdd8d4209671e4
SHA2566c946a00740eb601d3371c5db47bfc2d55f650c227fe52cde5accd5e5bd6112d
SHA5121ed14ac0fba3a52f967acfdac8c44beb4ddce38dc58825a4937b96fde71862e26ffce804ca88e829b85a1956b27a92320eda2aabd1f1279940d1efd5288a25e9
-
Filesize
320KB
MD5f146a7a4af07648070c7aa6c320f3744
SHA19cdd066fe4d64f9aac628295ca860115122368a3
SHA2564f0db56fa4c61b054f4c578162385ca78be6c9ff1e9038a231b596b882918398
SHA512fd75369211128dea2b786618214b23d5c6a06308d09fe8f9a463db278f25be89d097b29adbe5131a660ff7800e0806749107ddd77080a77bab6c213085220f73
-
Filesize
352KB
MD5dd76a29b2fbd08affa962baa174805d9
SHA1b571c4006789ba46b8ab2ccb7556937137340ef9
SHA256a325e630c1c7953d235b2f3a76616cb150387e4570890b431c39c28bfd6171bb
SHA512079e2fe50a5505da4d1983a4c9f500bb69821c6a2b7262a72215f174274988261e7e1143bd1d033e02c638d7f2ac7fc6f5689c6f915940e7a482e67597a7b9a4
-
Filesize
413KB
MD55499fb08c0fc5bd69b2517a7bf82e66b
SHA169de6985dc213d4aa92de3c9b25eab0a16d78729
SHA256b92a320fe3d4628dcb63d6cc521d1e563d4eb462bba2ed795694443003765eb3
SHA512c49562d8dc3236bc8bbbf82a1c36a616e5bf26fba9be68360f5e66574113ac9912f30cba0524a3dbc7a71fbe05cda483ad18c2a94a1e95844961d0296dde91d8
-
Filesize
318KB
MD56989a197c6da7be29c479f9883ff6c3b
SHA1b0c1eb5d4bc06e29c94eaad8a842bfc44a32ade0
SHA256c781cb2788d7802c37ebc0883d0c9d0ce62bf1aa7ee093fd5d95315bde337eab
SHA512dafe517db2ce6d586bed37d0e8222d467ef37f012db988e0a0bbba3cb601d8f21335fae96bdefab3bd01452feeb72ab9891163e9d2744bfdd18df4bf063826ae
-
Filesize
273KB
MD5d6add3c6b599412df602e5ede013237a
SHA1e0c5a97ef658b34aa84d02c88d2231eb3ccb4085
SHA25619e8484744ee32697448c6960ce220272bf969a2df8dbd6961dcf6ed65490814
SHA512e4f945d6fa60a419f82e224e7a1d908a0bcf4707a7a55b1ad99167e9c37c0141f0775b55c9c845096e9c2310e2b3da4b3bc65c53f4ef7ec67cfb618e676daba8
-
Filesize
502KB
MD552e012b3ea256eb176b584c41aae235e
SHA147e6ac8dd8574861b1ceb87bbbab2220fbd43a8e
SHA2564717b1b8c515541555d07411bc475dabfc5e2041cfdcefc2eda914af1334f959
SHA512fc046d014e72526d2f7309e9bd50d9a03c56b0d68bd74a40629711f6bac9b20bea08d75b30be55d2cccd0a96be12b7bd948c377a72631192e31a65b46068874f
-
Filesize
247KB
MD5e5dfdb4f7a1ccb6d9b8f5c782a77c3cd
SHA17fac63a0f82c19f5aed4a562f39a742d10587978
SHA2560bebfa338273c1b39175034037c1df201e1cc5e2e59628962cee7c6bd585a312
SHA51252954119b7fa46e2db6f7e962ded29d19424141a629f1eba5555df2dca067a0632aa65e076d952a351fcb5b766755ed92378fe6276404c194744dc16e2f92711
-
Filesize
360KB
MD54a8f87dcb8972337917fec66e130e9b9
SHA19191a5cc921ce8284209b75dbacc18d30883baed
SHA2564a10f928d536d2557a7137d6ffa09015edc4052683a0427b92659761a8e385e5
SHA512ef482adc34bfcb0a56827ebed79b12e69d71ef66d9d810a62f8c011a660a1a6e669b2cf1ac1e9e284d8c134440f0dca25a701608486ac33e398ed4bf87ce5604
-
Filesize
320KB
MD5e9caf985969e718a354359986f991e35
SHA1edfd208ab890e07bac97e762b22c1495b806d095
SHA256f88b8e01701710155fdb6f7d7cd5fdc62a9f382c4e5f9c4bf80b9844300335cb
SHA5126b5c04e379b4bf62a37ce4dabdb195d94b517ee29df56150c5c1008b787c27352b6a54ded5c7210e7557097030eecf80ba6d8f14fcae026980c206296859119b
-
Filesize
407KB
MD5ace2d85d5a1a5c156aa7ec1cad16416b
SHA189330092d1d8be103c22d16a459e81ea5d181bd6
SHA2560eebb951e6b9ca4cfab934cff6f541818e5fd1dca8cae6f35135df86435e6997
SHA512909e3f86c53cd0f70d09ce70930a116d45731deca7bc7ea868c0eebf8f1cbdd167193e9956c4fecc6023b8c57a576096908597b5eba7fb3bde9484f47901dfc8
-
Filesize
398KB
MD5e6fd09daf48ce850475a1506b7f03948
SHA1cb56a930ab99d2743d60ffd74de0f143b79405c3
SHA256711ef44f3a02e870c734d0cf81fc25fc5b7dcb416b5455ace7f1e8334f59edbc
SHA5125ac9994d11734f89fb52d1450083876f333a6047c782ee10693f373b713156449a2e1a1c841b2c62bb211bf4ede8cfc8abdefc94f69f3387720a7a627b7562c7
-
Filesize
278KB
MD579046aa8043a9a1a00ee8e16d78b9043
SHA13708ee43c5e62ed94d35618ff1999363f8f22c28
SHA256f7d78cf8ebe0f046dd26a8e2a2495f030a84a35222dd3d249f648d5d2f8295fd
SHA5122e64e2d6fc88fcec27fd5cbf57c7d547389b62f4febef9a15d8221270c13a1a6ef433379637842130c647b8896099bc506dfb6a0801b8712e9b19f260cfacc5b
-
Filesize
165KB
MD502e144632f0c006aa16468c71f01a743
SHA1fa92e11fdcd8e31210215dba7ab1e3162570c0c3
SHA25691867956582ff5ce82f7f7648b27185f224fdbe0959f187d16f949e5d5140eea
SHA512b31afce310f488581de9a3729bcfbc4202e533dc2e0e015894e2fbae987a7830772daef4c56d51e4606964436bb71f82284275f5a17ad7b68f785b715ef04119
-
Filesize
72KB
MD5abfeb50f0c4b012068af6074e35bc89f
SHA129a618d2f31fe2ca31fdbbe188bfae41fb251fd6
SHA256efa99071a8776fe3de3dc7e0bc124e442ab4d2de0f686e03fdcb8052d76cbc06
SHA512439d38b1d42001d62d20dc13ebe37f57f119a4451d88b2c90a20e3cc8af6cadcc47507f336c49613539df265479457f5c1676f67ad125ec86664265a4d9cdc86
-
Filesize
86KB
MD59374c2885aa15ff65877e9f8addb3f41
SHA11264645fae36ed62ec6c6fb87492d93b8d5abde5
SHA256d24358fc6845eb6e08f22dcbbb8b6045a00c8d9bbe13059c6ba68ee02faa949f
SHA512f1e6857342f92c0336b6e0958675d731c7b44339baf14e4e7b2a1373f00a9fd45c14d5d85adea650cbf38215d167cb55c05ab5646a85e4d43f0f48a3f8dc6356
-
Filesize
109KB
MD56ed8827f3763d2d36e3f82a19efbe74d
SHA1a8a7b1622136139fd3ed3d19d646efefbe31ed67
SHA256ac6695ef1c08f637c6de2bf57e7be50eeefab93c509c81062b64434725a588c0
SHA512296bd5c6b21d4ae6f29a9051bb595dde5532afc53c56397d3dfed19e4344697586f71da0cdb75b390c92172962036c8cf8564c77b66b4d9ec2402f5a397620fd
-
Filesize
20KB
MD5f41d12249cbc4ea4c4b1570854c54b37
SHA11d9d108b51b22222a4426968298c3c6470b3e97b
SHA2566ae1098ab4ee8f0c47ee8d3ab7d32e6439d21a070edd5da0ccc528de837a3acb
SHA512e2ea7ae13e1363261d293d81188b233a7fe1fa76c70699714f81d3381dbcbc29517afe34b034a134e8ec6324c1641b01b9ffc13ccaf022a6b0910531fd6110df
-
Filesize
92KB
MD5b628f9598e209e1b5b081747535153b1
SHA1c1a428c2625724dbc129e4e7c60099d93e8ffc2b
SHA25641920ec791e6659be92c0ddc8a50b0805ceeb1848f7fbb45543eba29c152544a
SHA512a2d7cd61d912a1fe9113f8287911acddc41b474244590de3639da1c9275cd0676f7170408b391fc2e5ec58b2c77f52f79dc8bd6ab45a61cfc4d330b73d749aa6
-
Filesize
544KB
MD557bbca781be6c1b97bb9b9215a042658
SHA1d2e0db6fa2ea458576bf2008121f18302db8e225
SHA2566f15fa2322e6292c798abbed7f6ccd72ebdd2bef01d779a224b966f303c8a6e6
SHA512ea5a8eac1de069170bba6fcf7fbd12c303b303fbf9a3c294494634d8d2bc8d785c6d23752f669a9d0c48dc89d8063007f8dd06f1543614fef480967cdf1c58e5
-
Filesize
659KB
MD5977fc653d591b2b45a20a7e3c08e5f8d
SHA1c450675f258d4fdfe0f7e85d298439c0721cfa3d
SHA2563ab0633f057e49affc19c32b44099598d41bd73398fef62d0d384c80743d742b
SHA5129382e531f51c9ec3ee240a7fbc6b13ed1822c4b9fdfe1ce82f6f17771a0f3fdd30ae196e038144cd578be3bfc618ef741c2d1c9c15b7ac15365a068c04df57c6
-
Filesize
1.2MB
MD5ef954a7938c6ace3a7691cd60381bacd
SHA19a3510363b20c5b31a43392163f6469b2d3ae130
SHA2563d7a8dfd0095051a88a53737a897727d15cdb00c85a7782c9202a6b98aa6252a
SHA512997f19eb329c7f9a277c4ee147060d26adf2abb6d18215c4ab0255637ebf4f265f6d2575bc6c22d0086fb648ed6f13c8261545888360e4d5fc973f54ebb291da
-
Filesize
661KB
MD518aa6d8149d0a63c0afc6712f17de89a
SHA118a2efd693e3700d8f28ba6b33514032e7d2faa8
SHA256c3cbe32c3dc7471953af82e4d5c689d7cb2710b73a5687b3448390222609316f
SHA51224d6fba46fa4eb9ed7431bce70ca961c9cf060e6370aec27e81993410af2730ad2733adb7088ce47d6fdae0025aa2be2890d1a0eed6ff911098a7400518883a6
-
Filesize
1.3MB
MD513ce575e77bc1ab2790f7ebda46bfdc6
SHA14018db99fbb992ee5565f760a38b0af9f04fe60f
SHA256b3df9e0ad4ba88da3b64f4c334b2f4e4f5c348459487d5600eeaa106d0ba90a9
SHA512ead8300f8b236bb6888f3e7ef4a66e3d0a42c8aaffb265a23a2c6446849b1893e882385eb70b78938648d31bba19b732dbd76b2002f3353d45f681f1243cf8a0
-
Filesize
779KB
MD591fdd850f8c4be2ac83dc9555c65b996
SHA135031c5780222ffb053e08070a4b7840d29853a1
SHA256e6c077353f768972afdd2dc9196d570f60759fe5acda32e324bb565cb490a447
SHA512772b14ee6ac285d97c0d7d87fe0dbadb29a4c2147234e83d3381a886b3461fe645065f14501e672b0a6d77474f89cbfd824831e070ec2e590ec33e9c1174324c
-
Filesize
1.3MB
MD5dc4a435689a44328256890e51177a9f4
SHA1cb3ef1f36bf70f26887dbc55fb799ff363079ae6
SHA2560528d8a1db4aa3d6402e5f1743f5340d9c3dd7bc1905ae17529f44c902065add
SHA5126d92d9bbae34a217d2f7070d1c1b0cc004412bc9f760ac82247984ec197a57111506d24f82c5c5d39fd376ac7a270f075b876412ce4c81685efc8e7ce803abc9