Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
07-04-2024 23:32
Static task
static1
Behavioral task
behavioral1
Sample
949916bbbc30569165fd655ebf8e5b188ee170e6e6a3c4b5512664dfe510a4d1.exe
Resource
win7-20240221-en
General
-
Target
949916bbbc30569165fd655ebf8e5b188ee170e6e6a3c4b5512664dfe510a4d1.exe
-
Size
805KB
-
MD5
54425fc7095f1214a487b1a057b39198
-
SHA1
8749ead7231553bdd1a08959eea3b07cb9a839d6
-
SHA256
949916bbbc30569165fd655ebf8e5b188ee170e6e6a3c4b5512664dfe510a4d1
-
SHA512
50ec59575947afe0d43bc737721301d7edb2b623fdff98706552de07b12d57c043206a88d9e139d83a3754a8aa6745f377d95028ad7682c4287629deee72cf15
-
SSDEEP
12288:rlGp0BYJKQ1uBeAMlwesHU8wqy2VYCIbvpOBlU1RlgIDMCZgjtGlxHZ9/I:rXf1SwPHU8X31PfU17DhZy0lxHZ9/I
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
Processes:
alg.exeDiagnosticsHub.StandardCollector.Service.exeelevation_service.exefxssvc.exeelevation_service.exemaintenanceservice.exeOSE.EXEpid process 3636 alg.exe 1540 DiagnosticsHub.StandardCollector.Service.exe 3904 elevation_service.exe 3968 fxssvc.exe 912 elevation_service.exe 1740 maintenanceservice.exe 564 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 11 IoCs
Processes:
949916bbbc30569165fd655ebf8e5b188ee170e6e6a3c4b5512664dfe510a4d1.exealg.exeDiagnosticsHub.StandardCollector.Service.exedescription ioc process File opened for modification C:\Windows\System32\alg.exe 949916bbbc30569165fd655ebf8e5b188ee170e6e6a3c4b5512664dfe510a4d1.exe File opened for modification C:\Windows\system32\dllhost.exe 949916bbbc30569165fd655ebf8e5b188ee170e6e6a3c4b5512664dfe510a4d1.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe 949916bbbc30569165fd655ebf8e5b188ee170e6e6a3c4b5512664dfe510a4d1.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\482c189e2a644d7f.bin alg.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 949916bbbc30569165fd655ebf8e5b188ee170e6e6a3c4b5512664dfe510a4d1.exe File opened for modification C:\Windows\system32\fxssvc.exe 949916bbbc30569165fd655ebf8e5b188ee170e6e6a3c4b5512664dfe510a4d1.exe -
Drops file in Program Files directory 64 IoCs
Processes:
DiagnosticsHub.StandardCollector.Service.exealg.exedescription ioc process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_124281\javaw.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe alg.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3244 4764 WerFault.exe 949916bbbc30569165fd655ebf8e5b188ee170e6e6a3c4b5512664dfe510a4d1.exe -
Modifies data under HKEY_USERS 5 IoCs
Processes:
fxssvc.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
DiagnosticsHub.StandardCollector.Service.exepid process 1540 DiagnosticsHub.StandardCollector.Service.exe 1540 DiagnosticsHub.StandardCollector.Service.exe 1540 DiagnosticsHub.StandardCollector.Service.exe 1540 DiagnosticsHub.StandardCollector.Service.exe 1540 DiagnosticsHub.StandardCollector.Service.exe 1540 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
Processes:
pid process 668 668 -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
949916bbbc30569165fd655ebf8e5b188ee170e6e6a3c4b5512664dfe510a4d1.exefxssvc.exealg.exeDiagnosticsHub.StandardCollector.Service.exedescription pid process Token: SeTakeOwnershipPrivilege 4764 949916bbbc30569165fd655ebf8e5b188ee170e6e6a3c4b5512664dfe510a4d1.exe Token: SeAuditPrivilege 3968 fxssvc.exe Token: SeDebugPrivilege 3636 alg.exe Token: SeDebugPrivilege 3636 alg.exe Token: SeDebugPrivilege 3636 alg.exe Token: SeDebugPrivilege 1540 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\949916bbbc30569165fd655ebf8e5b188ee170e6e6a3c4b5512664dfe510a4d1.exe"C:\Users\Admin\AppData\Local\Temp\949916bbbc30569165fd655ebf8e5b188ee170e6e6a3c4b5512664dfe510a4d1.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4764 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4764 -s 7082⤵
- Program crash
PID:3244
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3636
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4764 -ip 47641⤵PID:5028
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1540
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:1744
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3968
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3904
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:912
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:1740
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:564
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD58ac6f5fbd844acff24d111d1dfcc85f5
SHA16753c6f875e14ca1f37050c21924ccde5d707393
SHA256b852a59812b64ccc7d19ae3fb9f8a1fb3f69bfb901674806327173835ae8a143
SHA51228a24433efe343b8d826831917b12e82fab877f24793567e698d44f7047428b6ebbc319e77f1723696a1bfd89610f980223c32f4e2ba0643675aa46da9808277
-
Filesize
781KB
MD587ec413faca91bb1e6637fc62aa6d761
SHA1ebc19295a361f1dee18063c78546385057af861b
SHA256a8899092167e4be9c872712f8c80b633993dcfd5b52f8da8ff0fe586e913c9a3
SHA512cdfb7b45ae88d93a7d9bedccaa10cbddf591d6d6fb4077da80cf1569731aa5afec3e619cdad862c8a12d9a9b32749d0fe4111e80f9a62aca1602a55474aca5ea
-
Filesize
1.1MB
MD5a2e6b1a02525c24f26f5dcaede35c075
SHA12d9c3c0efb0c7819ce9b5e7dd9c8efac7dcbcfcd
SHA2567f1f3baf2c1b0b4cd012d6fb0b9264b364351be728e8987478c98b29ea6eda4b
SHA51277a0eee68fb85ef1b5c8780363fee4ff1cfd45f8ff1190e2bf1461481dfe899cedb0429dd3517fb1b553f1d399fbd90f9eca2cbb4325dcef13b036ba814a42a8
-
Filesize
1.5MB
MD5690d36897773d465e0194795ce60daf0
SHA1c0234faad062b2cc1a391eac3f77c4753e3cfdf5
SHA2569be1ca865e6fa6713530fd9f8994c8fd2533548b8efff8576d13156897ae44ce
SHA51221e2b475f7947f755aafeec7bf15f4d64a1f8562f3df4a5d71a3265b97ccd6a3c379a8c85eeb6d804a6ef1d6c6286cd3ce1e7128f304584a599c6295ff3abca7
-
Filesize
1.2MB
MD581c76508a6b3d60f96e5667dca7727c8
SHA1a71c54da345b4ae999452df1cd7fd3ff40af8c52
SHA2561d2d025384e3a91c7db98ed9ee0c1f93195164d3b2c4757006d821078c14801e
SHA512737c0c64615e4ed57950acb99ef4f509c3d6e25861d144d353f51e8406e525142d59f33db06cf199a228e48dd389f79fd19d47a15d24345fcca7f0a43381348f
-
Filesize
582KB
MD5df91020bee45c3519f398dea2676a2a5
SHA1110657e275655b14676fed46b125a5486720d141
SHA256025992f2120e4f8e95920c1fcd98bd7c4c4d8ddce45735854472c6988ae54826
SHA51286104d2ccc60fd6cc3909d7b8385604a5c849581397b198c51e54dee0d4c889ba56f2767e1043010c74a8a9afbfdba391fbde346646e6c3a3eaee344433d0be8
-
Filesize
840KB
MD5584815d538d2244fd0958b58c72cf2f1
SHA154bb602420c7118c9c156ecdfac56f4b21d1e519
SHA256354e83c736932d88302ee4adaf099fa873fe274cd492a9bfd50f9f5c5593315b
SHA512f7ef972a984a8f1bdf59bdac372b6dbc1e652feb841d1a55dbc756754fce58059d1c02fcc2dfd9a0857170c0ed2f41ecba099047e1ab1c82cee5f15775b950d7
-
Filesize
4.6MB
MD535329e7a8c309dabd168dc1fa7f5bbe5
SHA17ea66e0ff8c8c5036d2841df15db9afc3928404a
SHA2565ddcadf0788a53d7bfd567ded773c6726dde558182464cd5fca110b1a46cc127
SHA51289b9f59b91b3b4da4f8fa4fd551112007752e4528a8da007da31eff25111112109df11f751adb33357582e26967cdacbec238a74e4776a290384cac61b126533
-
Filesize
910KB
MD56d3d42ea213e336801925d6b2563bcfa
SHA197b7f43b3c943b1e4c77ca457168cfdae6657612
SHA2561ec5943d353463cf041dc9cf761a0d06af052a56ad8e5dd1833120dee1a2c56c
SHA512ce23ed074ac46a55e365c7ab84342e20ef1951e616722179e8eb7e925c26c54d8da31e878c8feeabe44cafe32296d4aaf46d2b3ba1f10efe31436f578417caf4
-
Filesize
24.0MB
MD58db10c0742f34e54b974513f6cb36ab7
SHA17d62131ef51d92a621e95956dde78b1a014b931e
SHA2569998d1fb821b5ac1d1cd4ed2904c0afd4852f8a820f7700242ee4ebf7b43368a
SHA5124dd451fe3b9ecbbab6d6e988b0c1e0624746e80e526e271bc222d91df45c7695a2b60ef909683eba222662c9e5a1c1afbe262369523d29ec44738a3b06abe001
-
Filesize
2.7MB
MD54b1430e3f5c09967ca5b0cef3c58b711
SHA143e17903c009ec1af62edff7e8aee616fb494b2d
SHA2561f6ca7de409a36bdd0c39f3dce224d2ed41e269d647db3ca638f5c3767c3616a
SHA5128dc41b46a371a1e4eec23ce812f46046647c6a7f0d5b35853cfe7e41406c12a95a59bf788b8c846a3d78435136d8e28ccbaf466bfbb30e392a14ae5c00055595
-
Filesize
1.1MB
MD58d8b386c6464e6597588d133547a9114
SHA14ffc43f5d2514f3ad2c6638459cec40fe67339a8
SHA2567b53a514434332bc0a9d0c2702789b5e596cb32c2f5cea5165c5a0e14a9e9b6b
SHA512bd2977fc6645346e4ff6b2446c939eac2a26a08534de3f384cf2af12281efcf5d9660419190f755370a4bebfc16feaa12f5172ea98638a53413cc16a8ee5f194
-
Filesize
805KB
MD5be6c3536f3e7b76d976e829f0255c422
SHA118f1ddc1b36f8884ed5119cb590891a67787f13c
SHA256d6d8b2bb677e352e1a73abe70f6496a9356ec746a92c96a7ce0a4f17bac4ade6
SHA512f139b80c216764246e4e3000fa7e9399b5022f00d2922b3d9885028fbfccaf96975bb63d18b37b8449fd4223333f42bbd0cb76e0c0c27671278b5ad5e3ca22b7
-
Filesize
656KB
MD51d6d50b4125fd6c68cb52eafae249532
SHA1cc5fb8fd86b0d4c659f8f0eb230902962626b2a4
SHA256ca892979b32b4327be5110c5e42502a1eb94b543c6b8357428e70b144b73d754
SHA5122b3169a975fcca1c7c70f41aaaf96b997823b58d6b044ffd2c378a4a7b806739e0c34e36af4c5c50924b2ebbecde03f67835e666f62c1d4eb7437013e9c975d4
-
Filesize
4.8MB
MD56c33e0b31f4e2cec44bf0eca72ca171a
SHA125590daf44b316d1936b87fcd566f0cbc769ee4d
SHA25685684531667ec7f229a031ef41eb20617d05e077cad45baf8367a0a7ae292b0b
SHA51207af02c873255f8de0daef1aa963385ecc64190ee0929c69261c5ef7855c4548e2dc1144827bafd5bad30cb9bcc4adc0d59ee9a32b2921a72997348bc1440b02
-
Filesize
4.8MB
MD5aee69d0090df92ae94be56c357260671
SHA11beb1a909408bf7367dabbd263e34e667c84f8bf
SHA256fe3b7d8dbd4db900f023e68d1d88be2dec412731802d9c95a099a0a0ebd39987
SHA5126529373f38e318e5d081a3c311b52f25882b1f5bfb1b675d0709abaafe9af5798ea2f5a7fa2c9cfeaa91945111f24d661e60a5fa9577e21db58e58d8af47f334
-
Filesize
2.2MB
MD545298307b979cc48398aa84e9d964b95
SHA137a1559bf079d6009ef7b0cd85f9bdf6cac80bab
SHA256e0410fa71361453b61d6dd6dd3d7ab4b0219153760c2e3c9012ab9006beeae73
SHA512c8883f794beee24d22cc6ea6c3ff2a24921b32a964d5da0bc41098e6596a9d020cd337e873516dd6d0fce754e5126fe7cbecac72ad72ee589443cf828113f9ce
-
Filesize
2.1MB
MD5a35e6ce3a7fc26a5db71c9bb0c86c500
SHA1bc740616aa86e735b69c27ea1b93f84a0cf1490f
SHA256fa76d52c1a4b6815a091e9a9dd675335adc290f2211eef1d757ddba1d2c308c5
SHA512dcf3964b2441c18354c43043006f8c674ea45d5498d733e19a030481f73cd714de338592c776edc2158aeb7440371fc01d174a0e415dc682f995e2e6e4dacf6e
-
Filesize
1.8MB
MD55b016b04bdf498dd5cfa997cb815ec62
SHA19c93aa3fb2fa112826c1aedaeca9875d918d9b53
SHA2564d0c7f793ada9061605c93b9526156f2477e99e4135bca862546e19b7702a3e5
SHA512868b177d5bb65a7db69b15ec905e71d5007be4202c3d93cb4dc2d76c87713706dc35dc98dc15c4c00b5d3b0ca4f5e21bfb6723794e927c776e4fe6b9534bbd47
-
Filesize
1.5MB
MD5a6a1813b347caef94096a146c2c29807
SHA10204410c586668bbffc9ca7012062f4f9d91da77
SHA256af22d657c2393cd44fac8e7f147749dd75ae4b821c78fbcd5acb62a9388b4632
SHA512e39a0a267553ad359d7c23337cc1582dd7b9f3c9383261768ba810269baec296bad9051dbd81aa6d6aafeff087e0984ef138b0d336e6ed45a058ee15a1f4305d
-
Filesize
581KB
MD51d18275011393251a4aad8ce981e37e0
SHA1d59c8de43dd77726602bb5884e0a390ff64b878f
SHA256a48fdf2e691adefc43441074ce8b1b77a505ce4209ea6120c21712d8d18eba29
SHA512cc99485e9ccb34f66953dab887c6366b33427eea8c657e3f6c55eb37be8508503b235b01fb92603331e1fcba5c1f2f6318895e48689a431b5532fa030826c23c
-
Filesize
581KB
MD5cfce6da751658910c1836ac5e42b2a02
SHA12785ac3011873fb7aafef2fc44ff99626eb7276a
SHA256ee39bd9ccb6259a95f1b66deb97ed7c541554915178000562ee043e260ee4f84
SHA51264eae4293056f0cb2e60015cea751b0c080fe834bd2193645816ac4b0a69c2594af05b11ba56daa8875203492e4611ff89e8c65c871ccf669633be7d02af8b1b
-
Filesize
581KB
MD53cc91c1306efff5ceb938eb80b8e24d4
SHA1c0b941d7df156d61b8c31d4fdfc193ea1c2157a8
SHA2562404ab7cae4c554315b7369a9926a8aa694fd757ad6f869af6a49b44d6ba7896
SHA512d6f0db5a3d80c8a33c1ec7cd9bd272ab58a7fe42ea4f59b99ccb2f2f0b5722ab5ae6daae05188501da887d47381e31309e3416218fd3d86240b94aee78aaef26
-
Filesize
601KB
MD54dc197765d64b1df1176fb6505c8c288
SHA130e70283df39de838f2804075b28cbba01130687
SHA2561b09eb3441546f0d0832ce4795f78cb4ed34c6cb66d0afa47a9b08cc9d0cdcaa
SHA5121777f6ba1f385b26f173a3f937e0b08b258351204229e9519aa962edca8392b0215214994acb537e553ae78e844fa724db8bf10eca251eb187e5a2e935c56f1f
-
Filesize
581KB
MD57eb955a66c92a706982bd69c41e4afa3
SHA1402be9902295d4a613ffbc6ce0f399dcad0e48a0
SHA2561377e5f01ebd203345bb84c6a115dce5163e5927e02ab310cb37ff511d68dbe2
SHA512adf86785f3189c17cf6032d247d0f45937eeeca269bc83340057a289bf3f27ad2f2f12cdfb68931ea21d7c44933893d62a78743b1f75d62ad9946ff9d2fd6d2b
-
Filesize
581KB
MD54871a3af45ba8f97b75c77d49726f974
SHA15667928744925c3efd8e7d4a15a3bd889237c5d8
SHA256134af4083f95ffbfd7e3c736df959dbb95905975fdbc07e70ce5ed729a6cac77
SHA51288563aed3ea167bf63450b7e4dbf1bede788d05b01b207764ee50a3ded43961c8d19f60097080ce6153d1ca830ffb2563f334e49b7319a7d53a29cdedc6e09af
-
Filesize
581KB
MD53dba4e7b038b72c1340973c09800b0c7
SHA13523c80723c993ab31699ca0e936a3fe65a96d44
SHA25695a019629c397c310ac823c42b145175cf491ce0ff5496d2a351f03d8e57135f
SHA5120d5a1c4965f940d1190796859dc6e004c76056d4c399e512189ebad717b61f23477ccdaa7c267f05350d89b610162148c426fb6ee3ed816d78fb282f51d81560
-
Filesize
841KB
MD57bec20d0154435ba6bfe99a572d1cf38
SHA13563cc02b1ee516b767347bb425b905e13132851
SHA256fdc4f8fb10790181861053f6aa6cc628ed4db523550153d6cd70ba2c38ffc4ba
SHA512540629c7950616a0750bded32eee8e0cc37f65a292c85541e371f09f39c1d72fe9356d6c8084fa8b7d7d82c07255fe5d2e24f362701a299e50af2ee9c35d6e01
-
Filesize
581KB
MD5e091ca4d34265075391834bfa9d61369
SHA1ff517b62f3dc1487a3bca7efef93016b4148ba89
SHA25640fcd504bcfdfa9b91fac44e9a5912b5c6d7a2ccd78f557f2c4aa03f3d1173ef
SHA512152875666f199ea4c28ef6f4c7891e0059b3aac2ff9759ed85a99d955838ce5354fff83cc8cc0d8d1eecf276052d101357638ce5e70265a8ef95d5ed23a239ed
-
Filesize
581KB
MD53f9e1f022d9aa7d3e26b468eab81edaf
SHA1fe74bb7266d777259c0d77d55dc9a9a127c0ba21
SHA25678116f7e02ffcb3708ab8f8a262d9469611515d025c02f3f08d6371687efa2ec
SHA512a23806bf1ebc30fd1dd810411476e9144fc94d0ba07ffbb5208716b6a9b5b96ec594c5bf96ac9f63b0e492b463d73ebdf56adf1dca16d37b9da0774f69935dac
-
Filesize
717KB
MD5e81d96947f3501ed18bfaa421a8ac83f
SHA1db5fd3c4e9504c3ca59c0f39039acedf77a5d079
SHA256fc5f71e6f3e730e0981010a8d1d041d60d3eb14a4c2f486dfaba54627131ee02
SHA5123a53672f4d2cbdff2d88af63258af9394d0df7d336c22c311498e3033744e8549b528a5aba3cc5ad40ff9a061c3739d93b8795b1c6d7134adade7ff86df779d0
-
Filesize
581KB
MD5f056e71dd834a11de4390ab1c496abd0
SHA172f69229bb05edc948ab1ea763ccd1030aa42b40
SHA256ce76d793ad135bd27f4d35bf7649915e9828c9778f054d366fc3164f94a7a469
SHA51238576b5eaeccd45aa8e45097f20168bf569bd0c8308a059795f078f1bbbc9573ac930e3d6a35c0857060fdc73d951584e89e7b17ce46bf54d62ee0cd87ea8aec
-
Filesize
581KB
MD53d2a2c3f9cb3a8266869eeec8fb8e06e
SHA13fe98d4aea6257b32f7d2966b86590bdfa550725
SHA25678aff5395022edcf5943b17ce6603ed8bcf5fe0d57e2a26dbac2f3f9b872c236
SHA512027ebfeedf49bfd7407e92faf6fb9e7345601176bbaa91b0877801a8aa9c028a749b1d33476d56672ddf656cd27be0ff19421377ea688091d09723456b322e95
-
Filesize
717KB
MD536ce2af6595f1fedf02539110369b3d8
SHA1b5470f50268e9ab877c3b08cdcbac56f8581a3eb
SHA2566a4838ce11815c8b15f612955bbe4ba9a22dd33666dfa9c70c9d6b4656c057c4
SHA512081c25a83a05d3d15a0a36891dc80f4ca0f6aba0fb3f4579d996229ac5f779dd44a57831796bb22e9561f48ebed6fa3c0a2e29d65c8e349a42da0344df438ffb
-
Filesize
841KB
MD5fdc9163db851666afe5f57955d569de4
SHA16c8d7731b70f37fafa56def39008abbc0d8e0a59
SHA256bed87f1b834855d0a9cd199b25e0e083eb7250a4d2a41c131d0f3f588e2fdee9
SHA512f1821d04feb9077c828ef4f0c7690ab5f15f60a47475e4d5b7672e0c9529eba22f3dfc72bb1f58049c02d14fe2dab57594de37a295bdbdfcb92c4402f5670f45
-
Filesize
1020KB
MD54fc73e06df12278b4c93dca854188214
SHA1715ad7136de58ef3863aa2b32532f0d1cc1a64d1
SHA2566225860d0eb543943bc9c79008e216a2dc2ffdaee64a39b29eddf29d39c883ee
SHA5121d53fc1789a1a7033624ea21b7b93cff2281b7265ed3c3c80ac8bac763d42d19a83a7949a24764e9860f8d573f608e982d99971e7d3a8751b7413b46dcfe9781
-
Filesize
581KB
MD5f262fe614fcbfff4a94afacae0ade5a8
SHA1e76c220744efaea21ceef697c2c242bae95656d3
SHA256f5a858cbae7dce8bd300d01ca7a46b28f769348824d8e77eb57a9048e41a87bb
SHA51228b83ad843cac8988121b0859b52abb7d112659aab34d5a9ad968a0c8103f9e8a89a8bd5c88dfee1a1d56682cb90de1abaf823749f15832fe14722d684ac5d1b
-
Filesize
581KB
MD5a3e2e5d72584793c86532429439bcf44
SHA1bc052f8d7d55f84250b747f13d0e260b4efe021d
SHA256e5c55757919d686cf204d71a1e5cb77ec2f533b822f2e0d0c9cee8ee20e37f90
SHA5126440b4944b50be6744d68ac2b03136605392fb2efca0dd5f202fb5a9a3fd49f1abe18468195f2c98cdca19483c66784b5dd4f4cce176e804da4daf23a32ecc84
-
Filesize
581KB
MD504633d2f25f5961cd8b5bf1c8a3cee4e
SHA1d2f1ae14003ebea2bedb7b612094ed23ae1b76ca
SHA2564e71716b1e6e10882fb7b2eb9563dab7868f39519219dc467afda496a0f7a55a
SHA512c0d021314cd643772ce6d0f7e8c775c4fa67b73ce891340ff56fae46a94d458aa6ff7304c15df248c6c717d519d70486408263920cf699c55175bbfa424607a9
-
Filesize
581KB
MD54d40638fe47b171956f83754857e1ab1
SHA12017a910f5c0b9378f408dd0561c486ce66e0598
SHA25661cfc083d6bed27ff9ff6726570f6d010eef6abc97f69cd175d42838c8f69759
SHA512c62cea8a8bd621dd72857b9a3020476b9a33ac08d969357faed37f026d77f3e7a81d08b703d2df3301379bac7e4a6943cec42cbd6589dbfb71d0c45e6fbc7bdf
-
Filesize
581KB
MD5b0cf13e5e76244f0e52695b1e732e279
SHA175ce7b6db9ffcd2d5439d1418cde9fc0edfce745
SHA2562f29899998483a50c91ae141bc98456463bafe46f3bad77cbf494282b8a1ba66
SHA5124a5301695bbd8d3b376f3f35af14af7051d0ffce496c1f3cc34081486849c6cf8ac5fa49573c348f165d85e1f66e034b53f7c976961d5f95d9c2cc0820f489e7
-
Filesize
581KB
MD57e456faf80dfc29586d8d264ae4a67e5
SHA1b203897e2ad4a9822ff492e7dcb63b989b89240c
SHA2568e71b067a62dedf49153dd20fd3c9a90b08490b098354c8b3e8ab6a234b05778
SHA5129e8030b3a8e9001a22341eba9e2f92a49133626276edb04fb0d5b762fdb86e017c8cbb8795d7b277bb718412fdf37d72e95f50e022f8d482dca53f4c429b8707
-
Filesize
581KB
MD5935b0d18fc277d6a0ae77a9fdbabaad3
SHA13564637bfa2988d4a63f7238ef42d7db674e9481
SHA256727908f77a4583a54278fa7f5a80087d17b96f3404b842c185dbc530edcf4423
SHA512fe1122cd0451fcd55eba5a5fcf1cfea08c926222084825c3c899a11fb3d3d0300d7f12f898c93d13f31a058770b79c1297aad722e4989456409f70216f6a6e4b
-
Filesize
581KB
MD5146e1228cb4de2e384329e2e54f8de90
SHA15ec14156e47fcf104755ed9279b68d2270ed8307
SHA25686ac9991d5d094c9c2c49de22adf82a628b1e203fa9dd69e8ae939d2a9050e6e
SHA512e3052be14a61ec1a4f0d98b62f0754d8151a7aebb746c01307be36aad36b405ac97b61ae0bfdca1db6db2954342ae9c9a3826445c1c54ae224723876e7f347de
-
Filesize
581KB
MD57c76da3b5c862376e1893510680ef5e1
SHA1e4a1c90b387c450b5428ecedb489d9e5818cf266
SHA256c03dfb8865bccaa0b8c5a0abcb75b0dad4173e5e666ff551a4780bfd0ef6b984
SHA5128162b3e207f91276dd8939704ce40fcbcaa4729f2a7f0a18f4e803168f967c6a6b14b097a094b2e887de76893ab354a0712e58e3e644d00035f446539ae4016f
-
Filesize
581KB
MD5f1ee47f2a45525d6a93b724b507377d7
SHA1a54ec4149dd6e3bb8642a6b50db10f1b3fc82321
SHA25634a29e508bfe8f5188675a6a375806f654afe2fb4e0c6e797a5eef9bb292f61a
SHA5124661fb51f14728c5bef0bdf18c0c5ebbeb222b6deeda456e7cbc2b92be62787207d1b6aff60069c37ceeb543d137f6ce1845e964d80af5ef09278801c515503c
-
Filesize
581KB
MD5b148de7a8ae17e18092f8ede2f0c88dd
SHA167ce0df943a006c05a4e71c3d5847d7ed42a438b
SHA256806d75fd8a132040fdbc7a6a61226246bb98f125b0a5bcc7fdf6fc4e41cda7a2
SHA512a97f5e4e308e5abfed8921ddc512af231b35d5d8439594b848d1ac051a38f2a2da93b03681789c32b1c0fd103acecd6616b0beef45734a24ef65f1b40ac7598c
-
Filesize
581KB
MD55c460e4dbaf3e2b5a4bcbabc6d74aedf
SHA18bb86257bbe4a94c68da7f09cfd9db35c11049d7
SHA2560e13540f71393a3f56daf72bf7c75c57fdb05f3f41197972d2a55c8128dd4482
SHA5121c10ed986489242e282097b39689ec75f86f07d7edc5b38caff9fb743014c4ad805c0f8bce78b7e70ca76b4450a25d4e7f8435e1cdecf5fcdfbd7d9d275dbb0d
-
Filesize
581KB
MD54348bc50f3a7093ce2d3d842b0ab01ad
SHA18afda1f707deeeda8e2e96e6b2037d7292755ea5
SHA256944521561a887e3a8a6201857d9140ba4c550d9a6904d53adaf1a57a0d459687
SHA512447ab660e914950c3f01e5148382ca88940947df0cfacef46e7facc2446623b6a144e1392d76469b7e8a3a745da08fd2cbb5524a2dc6d06fb72a05cca6b0219a
-
Filesize
581KB
MD5463e38ec6ee2515e9b918fa4fdde72f9
SHA17fa2b9e9cd59725f2fafe57229661317067140bd
SHA256ad944d8cf85a5e07b6b42f9ce5253b5880f887bf2f819a7bd47048edf5aa7e36
SHA5125ce2304934758bb8b0b51ef0e63fceeb9b846d7eb3afabcd92b7bb6ec965dab1745c1f2f5afdea681a9d7255b95d4f36a9c4dae9fede00387ec15bfa2965aaaf
-
Filesize
581KB
MD583de327ae6530b10ff840ee95653dd58
SHA133c277459c86f5a8d16233792275f0352962068c
SHA2568678961352e190a6869d1e6a02aed6d06636cf2c559093dd7870a73f8f471068
SHA51211e1f0e1140c2f37325b18e60e9a7b7d4501dea4718621b4613f262c2cd0ea53419386f6fb06017a5531af5f62fb550aaadb924ba08260e8cff2fcdc0d86f6ba
-
Filesize
581KB
MD524bf8ad0a47b5dd86a6b607d21e243e9
SHA10da5915351985a29e3113249c109cd480b4bff5d
SHA2562fcc3ba6119d58e83dd4f19de0f92973afb753db55f717a724dd5c876402000e
SHA512f2df39b95415b2bd46aee11853922b7c6c7350685916062c67e9286e27eb0f081a68bb6b3c665e67d922fc56454da93223372cb13a75cab6b368bfb89623b64d
-
Filesize
581KB
MD53ed068abe812979628c0eda8891e0d41
SHA1434d1ccdf429f30fd343421520fc8d2a0bb9d01b
SHA25623b30caf3b4adbf18869c7ddd9a1382ee2a437a569a67322e48c419597bf92d7
SHA51276eaea8d973183c225707de1c383b84eca27cf43a991e2ac61a99f893a0018eae7ab42c4b9336c062990197fedfcc0f0b39cd68252d05966c8aba6f64a04d220
-
Filesize
581KB
MD5dda143751313b473132f7945d2113075
SHA15efd4392345e2263224c4c93d338a955983a10ab
SHA256e65f1aab029af49f920456b73d89627bdf0ce364af8a8de19b977d3fd96f57ec
SHA512bf679166fc5b178e998bf70e00841d05301620abc18f0624cf044815043ea4f5f5263445921f40aa5e5d77e0f46e6dccf4f1479eef738ddf6e4df17d11c0f316
-
Filesize
581KB
MD5b31e6389787bcf7e3742a35ff23b093d
SHA1f07236e61ad16e43f09a488083c0b3c1e008bc33
SHA256078e79f59e70eeaa08f071440cec5d2aad7c165158b47c450dc478a32442faef
SHA5124dec2471afeafc999526814b0766e8ba957c816f5286e323c4139a3fde22d08c8cae13fee8c707db1ce404ebed17f165b3a5e54fad4340e3c37930bd367cbac8
-
Filesize
581KB
MD5258bf88c8456a755c2c5d133be5c6345
SHA1915c05d7f01790b9f07a4652869f2bc61165cca5
SHA256f45e801f1101f6efaa0867bd5454a7e87542e4910e5a05f0c158352f003260f4
SHA512743a42289f4506c8987dbf8875e2df759b700807e189266bf23557968c4cfa26238b4eb540b5701131d57a35c5c9be50758dd652d48da61c97f9ad9e18d637cd
-
Filesize
696KB
MD5b990090da441cdd43dd0959d4fa0ed13
SHA1af84773d4b8e25889318aa758349142ee3fce035
SHA2561060ae3abab8a7dcea4f10a0487ab17ccda16f659e158f646c43cdf9ba6c5515
SHA512167054e0ef7750c17ffac78e9015197f4e0177646b8b19634cfcdb0770bcaf36ec70d7c3c5b0eaa7ad4d78a3f04541a3de44be1b911fe6ad6b7941c0700880ae
-
Filesize
659KB
MD5053fa0adaaed78f42a9551676b642f3e
SHA1063845bda7f3f91daad0de84ac0393ba083ada97
SHA256682bd7316e4bf77ed5bfca0c9937ae39d3798b84a753f4c87ebe1be1d593e97e
SHA5125d1223c50f3f2c71546eafa02840dc0400059c4e19e9bb7353869c66c251b7e40401dc844347b4d31da6f846bc12f085a6230ad085ede207d7079f26102e9d08
-
Filesize
1.2MB
MD511df199e48dd0c428944536bb5afe520
SHA1b7baaff1be33edd16f236c89508f1ddbeaf50fea
SHA256c8c84434b9c7f7df318b5447089273227b5f448d04a596f55455a777c2448f10
SHA512af5357df5c2a8fd379897ad82f5500f9be049b48c9d9a011aab96cc386e38532842047a27f9bbf03ae81b7dd43b10640f6ce442e74d120ff1ad4fddad969cdc3
-
Filesize
661KB
MD5dd173ea9613145a459a9c42b88dee710
SHA10b50b8b0d2ea64318c3759907d3e6f079af1d895
SHA2562bb2aa9f884babde42d69b9c4d2791564952710dd35bf0ad063da5b07a2c83fb
SHA5121688db0800439f9ef36ae464e26399c237315a0f53f257a02e1fc14e665060072565c349693e099a9e788678b6590a380227cefe47e2931217e815b64ae9c59c
-
Filesize
1.3MB
MD5d9832cf086b84a507f5d0dd94bedfa23
SHA1a485fee80ae760998ca468c86fd125d937cccd7b
SHA256957bbafc401b49097143e0c45be7344639a093a8a8f3486a42f213de3b9a8781
SHA51273194f9b8c112dbaba2db07cdcec71b2eb4e9db286603218bb93376f8b9f8118dadf7eac975593557c4aea0a347de05e5bfd0b9b4b4fd58f42e878cc8e6123d9
-
Filesize
5.6MB
MD53b1ba317249bf2d92c09979047272baf
SHA1e551dd17fd29718a1e8f35701794054209990bbb
SHA256b453bd7f0546af6a8d90ebb7d068bcd7b7702a325d1bc004218b8c3cf266d57d
SHA5123970ccd63d02d7082840f18837b6aabf97d8a0d88c88e68ee8e8fb38d4b9c3d3a8cb97d85e82532c3e7dd0bf004240b0bdbe6ba9c1d1e0ca18a5c72a7c5db482