Analysis
-
max time kernel
2s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03/04/2024, 19:31
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe
Resource
win7-20240221-en
General
-
Target
2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe
-
Size
24.3MB
-
MD5
49fd5408d3ee1cb489f1ae99a470c41f
-
SHA1
1b427f363614dd390a6fb32d80b0ce9b455ed474
-
SHA256
57c77203d652e29271161fa8a32d47ac569d548c731105e73971df36e0885170
-
SHA512
e7529039619d14c17afd503ef8043da6d0dd60fca36fab3ed8887ffccdac725872904cd4767e48226b3aa955f0b991671783bbe332b30cbea4221f37bcf5e289
-
SSDEEP
196608:zP0Hj6JigboXZDwqY8a/qVwsEXX1KOgCu3JK1Op3H2SAmGcWqnlv018n:zPboGX8a/jWWu3cI2D/cWcls1
Malware Config
Signatures
-
Executes dropped EXE 9 IoCs
pid Process 484 Process not Found 2124 alg.exe 2808 aspnet_state.exe 2700 mscorsvw.exe 2476 mscorsvw.exe 2744 mscorsvw.exe 2196 mscorsvw.exe 276 ehRecvr.exe 1756 ehsched.exe -
Loads dropped DLL 4 IoCs
pid Process 484 Process not Found 484 Process not Found 484 Process not Found 484 Process not Found -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\cc2a43e62a37835d.bin aspnet_state.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe File opened for modification C:\Windows\System32\alg.exe 2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe -
Drops file in Windows directory 19 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe 2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe 2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat mscorsvw.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat mscorsvw.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log mscorsvw.exe File opened for modification C:\Windows\ehome\ehRecvr.exe 2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe 2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock mscorsvw.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log mscorsvw.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat mscorsvw.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock mscorsvw.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe 2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log mscorsvw.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log mscorsvw.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat mscorsvw.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat mscorsvw.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat mscorsvw.exe File opened for modification C:\Windows\ehome\ehsched.exe 2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2020 2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe Token: SeShutdownPrivilege 2196 mscorsvw.exe Token: SeShutdownPrivilege 2744 mscorsvw.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-03_49fd5408d3ee1cb489f1ae99a470c41f_magniber_revil_zxxz.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2020
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
PID:2124
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2808
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2700
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2476
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2744 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 1d0 -NGENProcess 1d4 -Pipe 1e4 -Comment "NGen Worker Process"2⤵PID:1620
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 184 -InterruptEvent 1f0 -NGENProcess 24c -Pipe 1a8 -Comment "NGen Worker Process"2⤵PID:2252
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 1e8 -NGENProcess 184 -Pipe 1f0 -Comment "NGen Worker Process"2⤵PID:2468
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2196 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 1c0 -NGENProcess 1c4 -Pipe 1d0 -Comment "NGen Worker Process"2⤵PID:2684
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 1c0 -NGENProcess 1c4 -Pipe 1d4 -Comment "NGen Worker Process"2⤵PID:2692
-
-
C:\Windows\ehome\ehRecvr.exeC:\Windows\ehome\ehRecvr.exe1⤵
- Executes dropped EXE
PID:276
-
C:\Windows\ehome\ehsched.exeC:\Windows\ehome\ehsched.exe1⤵
- Executes dropped EXE
PID:1756
-
C:\Windows\eHome\EhTray.exe"C:\Windows\eHome\EhTray.exe" /nav:-21⤵PID:2816
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:788
-
C:\Windows\ehome\ehRec.exeC:\Windows\ehome\ehRec.exe -Embedding1⤵PID:1776
-
C:\Windows\system32\IEEtwCollector.exeC:\Windows\system32\IEEtwCollector.exe /V1⤵PID:1100
-
C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice1⤵PID:2980
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵PID:1064
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵PID:820
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵PID:1228
-
C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵PID:2564
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"1⤵PID:2620
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵PID:2420
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵PID:2900
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵PID:836
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:1328
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:1508
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵PID:1948
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:1492
-
C:\Program Files\Windows Media Player\wmpnetwk.exe"C:\Program Files\Windows Media Player\wmpnetwk.exe"1⤵PID:3064
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵PID:2928
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}1⤵PID:3060
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
706KB
MD5bd78d024310dbeb2898e66c391082573
SHA1a8d8ed42771ca2719e93fc2e9c5446b790d91e32
SHA2563f3a93aa8f7e6b281afcc002d27cf3596a1c069ec1b4b8e7e56956570e0fc33b
SHA512f636039a3956faab99d2564cec5686f5394cc32e3f73a66876b777ce951f747a3073632d69c1e381171bcb167680dfa582dca84145ef05eec048768cd9259d14
-
Filesize
1.6MB
MD5c01b2ae5f085deb4dab8d101406ab998
SHA19b676f6e34a57945b20aed0061780ce6cdbf857e
SHA25648c61e54a44e9f7e8a809b6f3e946263bce10201eaf56cae627d9425246e3a9e
SHA51211559e2024839f3632aecbee0e7c9eb94722f5803dca1ec382220e33e3918d449e8f6202e45a0c187b9c04dfb49327351d6b64ac4b20b4c60439d29b06c18257
-
Filesize
1.3MB
MD5c5ca9cef484e82faec6d6bff7ac3843e
SHA12c103f33ae6bfd8c8dd3bb2df20bea1deb8056f2
SHA256e7e5fd933ff5ae534b1cb7337256a36c614c2cb258318726508cfad30442f5bb
SHA512a57ec87b999b19d4bc830da67522fa9ff47175c7b6572e7bf064adea18ea49a14dc25352db9e39cde6983fa846932cae91d6a4a84d29c24cb9250dd043527f4a
-
Filesize
1.0MB
MD51806260fdaa2076e5130c226379dfc26
SHA1f3e1650d3e0539a75ace990d12c82f449c9dd8c5
SHA256d1c0fcc2771336ad0afd5673c414ff395dd09810a21ad7ae8a54a4a40b07bf6e
SHA5121354ea3533bb54bf6e3c86eec3aaeca042c99add97f10bd76ee9ced395b0f60578d8a2671f13cf55b01a88255f6ec0849f2b6fe382267def3eabcd215fce1534
-
Filesize
706KB
MD5f68a7fc906d6093ec459ebd1675c47b9
SHA18973a0767b4536057327b3a09c429cdee5fd402c
SHA256ca9eda5e0511b42b7396b97bdf9ee74508cc0f84079b2dba2dfd66b2cd70a388
SHA51273976c369ac909e95cdc32df110fae14234c1bc74d9de87bb79e781df29bde0f3613f34141b3ea6a9e21478f4e687ae293a32a5fb570bfc70cacfc8c3876153e
-
Filesize
30.1MB
MD5dadd89b91d753c61ee9c6d8b40e3b05c
SHA17a5c94cb9dd209794b16f7d61aaa8ad79d4279d0
SHA2567cff57126b8235aac997798416f9f67373d3c69f39748a3f63105b14d469552d
SHA512523d9bfa3ec5e7fe060c5f86928946b3cd65c5e1e944b46777c6f1735ee506142df6f3ee883f188b7bbff2312ecae8eb2ed4ecb426f05a31eedf7ccc9f9e0465
-
Filesize
781KB
MD567b5fca758040984eb0be224fcbe55be
SHA1f35faaf3a119467cdb73569336e7eaeff490a1f8
SHA256904c73e637644fab3cd7a1cb4c9a25128605fa3bff86c7e6f28a3eab6a895c82
SHA512803dbb1e7a4b0ff3e033cc983c2ac4ab54128838ab00f1ff2c76986467edbf2d68921feff484c8681f2d8f1a1812f070e3f3fc0ab67a8a5af88288e68d1bf26b
-
Filesize
1.1MB
MD5ef0d212137bc35d94782d7e365acb8b0
SHA1e57bc921a55807ba2024cd84d2e57f6e7d5d07b9
SHA2565f313d2bfe7664235da0101223f6d66bb9663a759f3440489fc9b2107094b1ee
SHA5123d114af1bc3c7b1ec46372d1e832142df8ce3e0dc689319dc0acf6f2014900b33ffcaf75abb6919961ed7fc151110e930c84b18dce93cc876455ae91fc96ff8d
-
Filesize
1.5MB
MD505ebfa53971857fae39ee09cd8b6d492
SHA1f3cb096f6a9e79a559df7744bc94bfd1eec9f18d
SHA2563153af1c31dc6ee4471b3a363c894298a8057764e880e97c1d57858b7f377c61
SHA51289e132fe9299b95e08a384589b09c10767a1eba90d2cf983ca0f064b0fa041d918291a012af8bed3179209df3d28706e335957a5beb22f9d2feecf682928f118
-
Filesize
1.2MB
MD5c0fbef16e8677b48baa54e61d3669250
SHA140a337d24b554bf760f2162c1c5bc00758b4986a
SHA256615333253c6c5210e52486112ab9d1ab14daa2d4ee8451b9b24b211231fe86fa
SHA5129da478405878464b0d9a199f600fd384c449333889bd65f442c0546e96e94f2ed6e61ef54005b4d52afe31a296cda0381ff95bc1f6b11d9728d10f476cb1dfc8
-
Filesize
582KB
MD5db72ec4298088172197e2c51c962dd92
SHA1b4bafc217beb65b36a8bd2892309695e897cdf70
SHA25698340e5432da268c22966ac93ee8d3fefa7d1b9fd4c1e001759501b22475984d
SHA5123a864e36a74a1cf6a30dcac47a980d0dfbd111a96effaf4a9ed304623a62849aa565e7a99ebdea857b82190a62773bdd1f735c6cb292aea78a97d19b4fd43d43
-
Filesize
5.2MB
MD5889bcfc3b5bd687f849f64ddc1ce6099
SHA1a75af82dc38f882a2554811de2346b693188636b
SHA256ae4f6ab3e25d0c21f2fb327dd92484aec9e144a28828ffbdfedeacdb6622161b
SHA512e17d384a0220fb3e248007841e281c7609632b80dc719c17be1d136e347f045c0d196e166cf292b0954b9f78f66f7dea8f2d3eeecedf69a06bcaa8a53e45bcac
-
Filesize
2.1MB
MD5fc33acf5d1cab55ab85f535c185e92cd
SHA131ba360f63a46363b2430031dd482a20e15c9908
SHA2569b2974a8d40c854f59328f65808a421c7c819ee8f9d793a0645451e3164c87df
SHA51215a3bebe1d8088ca7163fe381b09ca97cbb096009bd14d0b91e9d7bbbd87f52874943b880df1f9cfc0effe39a29e3ac0e0aca1d314ff22b9413c958da95bb126
-
Filesize
2.0MB
MD5f925aa79923f3bd75e8a7a1555833f0b
SHA1e507cb586d3988f6f170575622ddfb9260c457ba
SHA2567790c70e31a74b8d972a15afee3e55976e44074cf2a7b62eb6ec52a84b7bffd0
SHA512041df7a5cf4e60b49f91f7492608806b5bb3983650b37710c5df21ef6a36ac951493b965a58d987bd29f42eecbe9dd50785749bc8ecba720f26d532d19293b83
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms
Filesize24B
MD5b9bd716de6739e51c620f2086f9c31e4
SHA19733d94607a3cba277e567af584510edd9febf62
SHA2567116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312
SHA512cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478
-
Filesize
648KB
MD551565a9c5457fbe4254e2338b3e03bc1
SHA1d5c28f47da34291d81186a552bf35a1d006e08ca
SHA2563483c00e1705c0dda36a495ddbf1aa12a881ea70cc51e9bd040b59d2119da5e5
SHA512e74025fed1934ec4f34971e7f5a9243ec147ca8d75f4a894e8f3ae9cb688cda57c8a153098243e8592f398470122954da4e42fcfd29e23859e761f345aecd819
-
Filesize
872KB
MD59e48270ee52bf713c0f93ef87baa3cc5
SHA176798c9697424d3182dd5cba04caa971a2bede2f
SHA2563ec6c640ccc4aff9baa49a83546039a9bcc72cc1e618197a30c2ea50aaeb2602
SHA512413d81624146e952d081b5d970cfd28da714341a5f1e8d1fa8cb3411671d6a85837cd4c697a5700739042ce739bcd1a4e7e45d4c0e7ad9cb217da88967736dce
-
Filesize
678KB
MD5d9e3cfe666606fca3d2fbdd3e3e83c98
SHA1e43dc83587ff619254636875a1ff0e445e51fbf4
SHA256851cd8ea6fc99ae1a56f96cb658de766e7fecc6c8d6a59c26b1c7a7abc0df67e
SHA512eb4e14822b1a86c044ff60d7ba8c17d93b568850d9b65f8ebd83d17ac27add93555c60f78a51cc8dbb00ae2aa78e7fa8ae5a68308cd9a0632c1a1779859ac1dd
-
Filesize
625KB
MD5e7154bf33839ce7ac15f3689767764ca
SHA1af2edfb9a198aed44d8c5109344fe183ce6621a2
SHA256e2dab1c5a3dfce7346cab71792c389eb1e26ffb89c1574e7647522459ccef952
SHA512255c8185962670ac08b05a671c792e3c17482d3d05ee8644ab3f52b244ce2d8eb5bc64025fe04903aa968e1506a3f1913c35a72dddb968f41ba19e1f977e31d4
-
Filesize
1003KB
MD5aaf886f9c1ce3a84d4fb8047fe67334e
SHA1cb0a9e7f516fdf9fd3a67159a676582815d5a18f
SHA2564814404ebd2affa72cfa9c5a7e2111a9b6ae97219bf2eb39bcb9f57eada0058b
SHA512d333a0c4789550fc329794d360c4f5df767478535508555d75bad87391708dd43122d6fc378398c3a26e2f4c542a6437a3767acdb4659d7665e1742b8b58e638
-
Filesize
656KB
MD5cda7e491e8597ac26c112b16c1a09d0d
SHA19b52dad7f7fe4b2716e3591fa16a6b4e6e5acf80
SHA256641090001b5bdb67eecc1dc7c89acdd554bf4f1dec7e901d66adb1c8fa79a10c
SHA5129320c3f3ea6a589834b3da462af77aa714c1098ed16999180951ae71700a9dc73bb7b692bc13662d9dfe401a9ad07e7e547328faae74d39f24401171a16a4a4e
-
Filesize
587KB
MD5e3dde1b9b65dfbdcf62da999be2fc857
SHA10275b55abf2b7766ccd3b52f2c67b134441ee6d2
SHA256437bd7cf602ab432573474ddc0c2124372bef733a59f0f4d1d8c054607214bfb
SHA512c9d050a278945164cced026027f6fcdb03c9b889fa546fc437486062b3e1967a89b2cd59cd6292d5af3992a047d451580f0f632222920fbe6d4995f319851a4e
-
Filesize
577KB
MD5c66dc71ea817f0d9235e5c02ed6f3fca
SHA13c383fd966fe321bbdce3168b529da597b50d4ec
SHA25647691ed87cf6a81314eca63f063a86dd8073cf7e2b60a9c7d8a2814a70fb5464
SHA51243a320806b5e80c5efbfde26f40107408473a45e502cc43da97233c4be54247f23af3b374dd1a56264569b6fde77d8fd21d528add13a69cb6c377dab9a84b759
-
Filesize
1.1MB
MD52a722c274c9fe20f7a6c785d48f9ac6e
SHA167735f847add3b80257e393d50c2ba1effce01cb
SHA25672cbeb5f6ddecce1606f70e199d7e96a4a786d0428cf00e12337543e2023d5c6
SHA5120c276b8965d8e09591762845262f46280f741134bc3692d74d659b315cbd7c46ff2d84bf462eeb4b98ecb86dd93bb8473ba0036541893d8a1efc0f5b493d785a
-
Filesize
2.1MB
MD501c568622039e1b1175840c63f070816
SHA13cacae9a5bbce0bb49188a0160e11284495817e2
SHA25621c3a901dba71f0c7328574cff8e9a11d205ad0824963eaafdca9ccab6789dd0
SHA51286297084bba17a0aaedd178df279eeaab8dc989f2366671dc2ce48a5a3a39e93bdbe6d4d3358fdf71c5cc0d1dc91d5838f307ecd60f2c83040cc0b907c6d9b2b
-
Filesize
577KB
MD53c2519368705f6724767c3375afc259b
SHA1b797199a6e871619684c1d9db6e5ffaf9a60868d
SHA25619363ff1ae7328e34e34aa31c08a5a3aaf23748a709178a5117c36d89ef1f580
SHA5125ae3947bd1672db8654267cb14e8a13d9bd72e9863e8adf58b33cae620c66b80d023c9267c63e9c5f680e5067de5b07981b33db9dd3269732c8b95cf1ffcdb4d
-
Filesize
674KB
MD54870ffcac1f6fd9d45dd37a4920d4cc5
SHA1fc2a47ef6f4bc4b434d07562ca6de6a980eae79b
SHA256fed396b5bc83a225763bc237ca67fd6f3f764294f25a46b73beb2a1424ed8b1c
SHA5123a852e3cdcd498caa13dfccd2f3a19397eddd48ea192ca95d10c86a1dc41fb055595669fdb57714ede6e505dd2dc574ecd88077756a15b5e513e4dd444f6a230
-
Filesize
705KB
MD57c1ef73de9ecda783ff8a423ad2f90d4
SHA18a5d913718938c5e800bc6ce8b88b090b18a3bb2
SHA256a2d7680d1e6a18be04e9067c879023e8918b4866accdfa1d202cd363c56bebce
SHA512d78531934c6fb567625a5d7cecc29fca106fbdf6e54b131617f288839a4333164db7aa8f46265078c6f33364f5e646400e40c1ee3d1f823325a11ce7fda9b92b
-
Filesize
581KB
MD5409fbee854848c28df1daeb536beea33
SHA1526bf66021d748690f33dfd1f0c9722e4e3f0d4d
SHA2561374aba08590130cacecd3848ce361373e2221e14385fcfa3aefc9197ef1369b
SHA512d598596e8f4a4af60f666a379eecd71b2a901a41e8869c4b9a307ff14d15e5f0c8461dca1ea25ad3d3416dd3ba8e78fe8f12e8664e958e72bdedfee24bb0c8cd
-
Filesize
1.1MB
MD5634a133bf3c61d71421c7736bccb81ba
SHA1ccad5933a170a700dcdd005d04d93036983d13b5
SHA2569fcbabc6dc30671c93668eb08ced6def5e12469083568c6bf1f5b711a620b176
SHA512860bcaac6e44e2825f2caa57fdded11ff2b3b241c99c4a402bc353d4b9e0bba1f7df3e506abe367d86f50443f581c01236efa0e81ecf57304b0b7059de0ae946
-
Filesize
765KB
MD5e1de3ea7d875439b0a4d0cc7ab83aa0e
SHA19cdabfe2f72b410eb7b7cc1772aa3c001c3e7cec
SHA25626a0a53b9b2fbaa3d0a8796a9da6fab96a5c81b962895de037d62733189a3af2
SHA5125060765a46f7707b258155f73a07caf1603578b98568d575ccc40781e1b68b6f750c3793878054289daad87a74be37f62783643ff226b02172ca02fed1a81bbc
-
Filesize
2.0MB
MD52cca33842f69b62b48bb482c697183fb
SHA11a00582676b8db9bf4d0ba5f0aa7e7d4ce2e3607
SHA256c9c7955dda7cb18b1999fd0cf6be0c269d6fb01f6f75ad8d9d27aa1997a7d77d
SHA512e1aed4fd225086cec719476b0626fc740255d4362e313a0aa75f0159e9bc8b18489f12fe4c2841dde5bc6ecf23a233a30e8ebc5edef886caaaf6d958b6b4ed32
-
Filesize
691KB
MD555b335340acbe47226dc1cdaab5bebc0
SHA1a8009482cb195ce9b6002e5863c8d7f28b69b5f2
SHA2560d202afe4f2166b1f793ba6b92aebe342e43c25c162d4774206278cdcb7b2402
SHA5126bf407fa65c08fc35806fa9168a8c46bdf2d0f16ea12eceb3f12142868e779831a7c9d65649f9e700dbcf63cbd6a4cd0ca5f8fb2ae123f8d5666e48896b6e3aa
-
Filesize
1.2MB
MD5d8a03f90c825d4163329bc9ba077fd9b
SHA196b11773d43fa33957daffc9ded128d8c6e982cc
SHA25618d0fb08709cccc5e8684b0c578c7d6c85ef0f37d098941391df564789a25192
SHA5127702d9faa3fa0bfc2f671516d33223dca70ff0f7bda8171c74a4fb57df8c46400e35b6e15d80074bb811ea2611daab13a149743313546aafbac1e59e9b696236
-
Filesize
603KB
MD50144e876a3f6d9f796da0105a931383f
SHA100c57073af96a31b7bb5f2a41e7bdeb76277cce0
SHA256313d5d49790ad028fc66d6b3544358b19be14ac7560d914c650950bf202b3369
SHA5122bd73c41bb2931a30a2d4ace46f9da488578b73133154ad96326cd93a0a98e7b8eb094f98e3d479362a6ea6f7274318dbcbd95a91bb62e02cf3c726aa34af395
-
Filesize
644KB
MD579b9a92d156387a6f111ddc94d556b89
SHA190e3bdaa88aab7c4541f77c5599fbfd8fb78d9de
SHA25660ef11293d2b1b1a182cee1edb64527d40c5858e74c9a7cd5e9105946a2be0d7
SHA512fc2da9efcea87a13ecf685c331c0f8b7e5a8deed3f3da94d0325b94d8b0956363e583be2c9d5dee7df6a49b2c6f83055faea7635196796a7b5384d0aa0aebe02
-
Filesize
691KB
MD5270cf271f31560bb33ca586d4bc536aa
SHA137e5fefa5c77665e5e647ae228a181f36cffc60a
SHA2567fc6683c7469a5ccddf821bc28fd066cb7791b85443a6cc9e5b2a72042147ca0
SHA5123fe0eb9cb069fe8dc363d3a8e93afbf7a4892b13fbee3e366cf6ab9ff094401ab0f64455be6bfe96fd00167d273c96731bb0f7c2c494648cfb1d4bbc729a0ec9
-
Filesize
1.2MB
MD50bd871210310ea3f9f83d0b110f367f5
SHA1727bd921cb04af55ae030f8e527bcec1925c0431
SHA256bba86357b7d6ea90ba91e3c9dc658bdf1745c49d25cc4747e63bf8157764122b
SHA512afc58b8680c047eb0a2cfeaa88446b7fbc529e78bd6d316656c1d9d489eed59a340c2e5b7710b59739a383180d1dfd695243f0cc27e15ba7fa5dfc6d40694ed3