Analysis
-
max time kernel
158s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
18/04/2024, 15:22
Static task
static1
Behavioral task
behavioral1
Sample
2bd2d3c53b7fb1b4e0e4b5eaf4d81d216408273df955bba77e5af72c5b0e834d.exe
Resource
win7-20240215-en
General
-
Target
2bd2d3c53b7fb1b4e0e4b5eaf4d81d216408273df955bba77e5af72c5b0e834d.exe
-
Size
1.8MB
-
MD5
6b17ca3105104dc7264e576a5ddf32d2
-
SHA1
74f700c18934c530d3a5bb64bfa11f766e280e87
-
SHA256
2bd2d3c53b7fb1b4e0e4b5eaf4d81d216408273df955bba77e5af72c5b0e834d
-
SHA512
f802f59f905c15cd173c50f100a0d72c044eae3921d69b6e04b96fda14d7789091636839933fb9dc848efe7227ca7d51b94189a9ff26731b9fd628aabf873254
-
SSDEEP
49152:2KJ0WR7AFPyyiSruXKpk3WFDL9zxnS7gDUYmvFur31yAipQCtXxc0H:2KlBAFPydSS6W6X9lnrU7dG1yfpVBlH
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 796 alg.exe 3080 DiagnosticsHub.StandardCollector.Service.exe 2600 fxssvc.exe 4972 elevation_service.exe 4252 elevation_service.exe 1880 maintenanceservice.exe 2988 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\6118a8cf9ef887b.bin alg.exe File opened for modification C:\Windows\system32\dllhost.exe 2bd2d3c53b7fb1b4e0e4b5eaf4d81d216408273df955bba77e5af72c5b0e834d.exe File opened for modification C:\Windows\system32\fxssvc.exe 2bd2d3c53b7fb1b4e0e4b5eaf4d81d216408273df955bba77e5af72c5b0e834d.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2bd2d3c53b7fb1b4e0e4b5eaf4d81d216408273df955bba77e5af72c5b0e834d.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2bd2d3c53b7fb1b4e0e4b5eaf4d81d216408273df955bba77e5af72c5b0e834d.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2bd2d3c53b7fb1b4e0e4b5eaf4d81d216408273df955bba77e5af72c5b0e834d.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Google\Temp\GUM312D.tmp\goopdateres_fr.dll 2bd2d3c53b7fb1b4e0e4b5eaf4d81d216408273df955bba77e5af72c5b0e834d.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe 2bd2d3c53b7fb1b4e0e4b5eaf4d81d216408273df955bba77e5af72c5b0e834d.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_117781\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Google\Temp\GUM312D.tmp\goopdateres_te.dll 2bd2d3c53b7fb1b4e0e4b5eaf4d81d216408273df955bba77e5af72c5b0e834d.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Google\Temp\GUM312D.tmp\GoogleUpdate.exe 2bd2d3c53b7fb1b4e0e4b5eaf4d81d216408273df955bba77e5af72c5b0e834d.exe File created C:\Program Files (x86)\Google\Temp\GUM312D.tmp\goopdateres_th.dll 2bd2d3c53b7fb1b4e0e4b5eaf4d81d216408273df955bba77e5af72c5b0e834d.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe alg.exe File created C:\Program Files (x86)\Google\Temp\GUM312D.tmp\psuser.dll 2bd2d3c53b7fb1b4e0e4b5eaf4d81d216408273df955bba77e5af72c5b0e834d.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe alg.exe File opened for modification C:\Program Files\7-Zip\7zG.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Google\Temp\GUM312D.tmp\goopdateres_ca.dll 2bd2d3c53b7fb1b4e0e4b5eaf4d81d216408273df955bba77e5af72c5b0e834d.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_117781\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Google\Temp\GUM312D.tmp\goopdateres_sv.dll 2bd2d3c53b7fb1b4e0e4b5eaf4d81d216408273df955bba77e5af72c5b0e834d.exe File created C:\Program Files (x86)\Google\Temp\GUM312D.tmp\goopdateres_is.dll 2bd2d3c53b7fb1b4e0e4b5eaf4d81d216408273df955bba77e5af72c5b0e834d.exe File created C:\Program Files (x86)\Google\Temp\GUM312D.tmp\GoogleUpdateSetup.exe 2bd2d3c53b7fb1b4e0e4b5eaf4d81d216408273df955bba77e5af72c5b0e834d.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\dotnet\dotnet.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe alg.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2bd2d3c53b7fb1b4e0e4b5eaf4d81d216408273df955bba77e5af72c5b0e834d.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3080 DiagnosticsHub.StandardCollector.Service.exe 3080 DiagnosticsHub.StandardCollector.Service.exe 3080 DiagnosticsHub.StandardCollector.Service.exe 3080 DiagnosticsHub.StandardCollector.Service.exe 3080 DiagnosticsHub.StandardCollector.Service.exe 3080 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 660 Process not Found 660 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4708 2bd2d3c53b7fb1b4e0e4b5eaf4d81d216408273df955bba77e5af72c5b0e834d.exe Token: SeAuditPrivilege 2600 fxssvc.exe Token: SeDebugPrivilege 796 alg.exe Token: SeDebugPrivilege 796 alg.exe Token: SeDebugPrivilege 796 alg.exe Token: SeDebugPrivilege 3080 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2bd2d3c53b7fb1b4e0e4b5eaf4d81d216408273df955bba77e5af72c5b0e834d.exe"C:\Users\Admin\AppData\Local\Temp\2bd2d3c53b7fb1b4e0e4b5eaf4d81d216408273df955bba77e5af72c5b0e834d.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4708
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:796
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3080
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:3516
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2600
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4972
-
C:\Program Files (x86)\Microsoft\Edge\Application\123.0.2420.81\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\123.0.2420.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4252
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:1880
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2988
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.3MB
MD5709d368ef45823c1d094a354f6c3947d
SHA1e5fe668ac81af6ecf5959049f6d19797c86990b9
SHA25634f8a81010a3709c3aea8bbc0928c9161d7d670bc7648362a26d119f27555f7a
SHA512da0ac01b9bc0da728278ff68236b25d538e519c3c825bdfed1932aa12684345bed5f2c684443a78d9d8b24506be596f9079db3ce3774a0c0e9ca94a395caf3d0
-
Filesize
797KB
MD5f205fb62b1758f2b1c8b44f6877c2fba
SHA1d6d129b24b708c4222547490356a3051b87546fa
SHA25637b377596930fac691b84293bae8c1880a934e726e2d74842ba7b59365f77a03
SHA512825a9664ca1bf5dc27819acda395bdbef33ef7436427224a493144ac345f15d625380363fcc106b54ad6aaef5d6368a728a110190b6304d0cb3d20fd598a1684
-
Filesize
1.1MB
MD5b98c3672ada5609deed08f086e63b96f
SHA14eddd5d5f6efe9586a2c185a2c341582d88e515d
SHA256e2df172736db0b55c5ec9942b836e2c7a5c220281b266704be49b94ec239e84a
SHA512e99415edcb1ed835fba0a3be13a29fdb6b353c75d7ce16c2db2d46fdaf92f0f2cf49608573f69f7727ea7afdca3d11ba5ed19221cc62a8490850e38245b2b75f
-
Filesize
1.5MB
MD5942ff2c9063dc776c56f8bc27b6c5858
SHA1181fc6dc13abcfb91f68fabfb52a0c0159d9db32
SHA25661424752a2f3d3d040bd7ff6054f8603cd3511790346dc750d7bf811bbd4e650
SHA512693decfcc727f76f3c45bcb97b54cc48d8813633290376f15bb4f559855b1015572172511a3f4b2b122db58b7f842e3c09bbe50eeacfda0fa5bdd1c854219d3c
-
Filesize
1.2MB
MD5c04114ee21b23b38327bac461d89af6f
SHA178f31633fcab5c62bfaa3fbf170e717e67742d1e
SHA25652befb3ecd83a02c85b84af35e40051143872a59b45098b87011529548346ea4
SHA5127296624c08452bc8488c889ebdc60d7ad2735f17c0b26aa722ae81f94289d8620a6350cfb55733ade5953e822d1ddbdf7361f247ba9da7f97080947b266a335f
-
Filesize
582KB
MD50bc0b0b41f020de058ecc593135eb0b2
SHA1a1c844a7c340b18bd0154d831a462af8f7299538
SHA2565d2090526768d1dc2b97371fefbfae6b783c321e89c84c87ea1574eeb695d51d
SHA5121a951c49cb9ba3a98bde45db487e3ed7a0e60ef27b7cbb82fec51ad64740786e7e5995bc8e7167beef4cf4f41667b4d9fec8f2d736794b1b5c3ca15fb44f5236
-
Filesize
840KB
MD5583a1a5a21c294bd3b28d240ca3220cc
SHA10def1016d43bf96159c28b5116e1ecedb3c73399
SHA2566280220d5601176afd94a2eedac7a059d3a36302a870d67db0124b41e208e30e
SHA5123b7cc74973d94dfbb0306316061b2aed1df067aaad9cfdb8e87c197768034973e9ca5f23965c3c81e2897d79eed9a82faa2206bad503f411d1d772f66033499d
-
Filesize
4.6MB
MD582d85541e28f89ce0256f737d259ff0e
SHA10e36baa3c74b481157847c44771a8433fbb6747a
SHA25602d4f82134b808dc99bbca4fcb4ccc8a5e7be22a89aef669f7607a3cd452ba5a
SHA512209f99e362b1119ed3091b63ad02ccc293e0a766cff866e3e28b354440902aae2496f9e22e4212637359479939cb565b7909fc6493400143078edef68609cf27
-
Filesize
910KB
MD5f9ce1136ef9baa5675f8c7038116bfed
SHA1db4945ea0f64228e2a6937dbec6ae836a96c70bf
SHA2565eda56652c45690cb8af607175e7370dea62d06c4fe7235b83f2b0c8c4a197e2
SHA512a2ca7a478b20df4debfb90fa27d62404098912203c88a16584a8a26ed8fc5522945c8168f211d5281f563f884ea0265dd463968d50be6e32517d48afddc33c7c
-
Filesize
24.0MB
MD516a0d2644190f2eb82c0543d2c1eaf57
SHA18229a7efdb934f6a122e44605a910d55d470f4fc
SHA25687dd43469ad586ac7312986e418d53cff9ce7e63d9d593e2632c7fa599140e8d
SHA5127079a852a273a2468308778fe4cdf2f2fc8a3d3dbc9668fdfee5bb7d7117c4d71ed65c18407180dcaa22d46421a1991b389464698235f3a3dfb2fcdcd1c45399
-
Filesize
2.7MB
MD5e4b75b126391ef14eefdf213547c7cd5
SHA174f66beabe1aacdae3f4d611fba85d0b4cc96dd6
SHA256b3168783e9b2f6a99f27edc2a8a2ed8960fabfafa92807a84159513b2e7b20b4
SHA512f851fcfabe880f352c6fb0f3c273281b3f75e12b0259415502e6a9b4f78ddceaab6d1b94ebcbf23b858d505c1e8834040a6e73dcc6dafd7e70eee4e790899e69
-
Filesize
1.1MB
MD5082fa4a6c920c3e2c9413da61dda65a7
SHA153d8c65bf572d5eded9dd7a834c24b24117f64e5
SHA256280d1c2e2e295100d567f59934e10d27b1d0e636513adab78f4119e5cf399677
SHA5123839b76a6f331cfc41c3b16183579d709783fae57d196d3ba523d50b527893ac26dbed504b8aeedcb573ee4f076ac6484c912cd6e0123a3d029b5f88ff56ddc7
-
Filesize
805KB
MD5885b70d8097b8bc8361e00a08a8bbb1c
SHA1f0d5cacf425a7b46ba4d6ec0aaad7374401e8edd
SHA2564090c95d4fac778535ead9383dc8adcc3deb765fe186fa068bd0aad667afa08d
SHA512a85314b8ef31c015b0cb8802ade46e41f55f37d4cdff35454ac762db2faef1fa06fd541cbf72521731ebb7c5b1024e8966208f48ef394ea3edbb12657a7ef426
-
Filesize
656KB
MD59cfe663f1d097e685bcffefe4626ac3e
SHA14a1af49db0d427a9358811bb6244648f7332132c
SHA256d96c729160ae72cd4682767db90071810b4cf7921bc43672b7faa607feb610e8
SHA5122bc4847d49f4429e13b359afb4ec74f2b7f7b90ed1ef4c62e68beb4f0a4760dbb88029dd7fc9dd50fbc72cafed1e628f942c9fa063c96e83ce17e5b2b93a1d46
-
Filesize
5.4MB
MD526f5a9c28e8972b02bad231c647d794a
SHA108eb88e0f2d29e52148930d1281b8946fc7bdc5e
SHA25601c1c212b32a9851d6de016a60b881d2242443df9ef210c3bbba6134d991ee36
SHA512b40caef0626d0e99b0a52d7b5cf086ff1b578ce5153530750480c4216a87f16b53a74e11f3f5fde4ea36ebbdd2f5ed4b1c966dd047cb3c898bbd569c9e96bc7d
-
Filesize
5.4MB
MD58d60bc075cf7899307257135f2044a72
SHA181f3d153fef9c0030789b30b011c7e5f168fd241
SHA2566d2af11d09bbdf60fc7de480fce4742cd5d162484871ecb74ebfbb92de76c658
SHA5128b6a51181b9c120993da68e63c9f05fa72cda043576a8dd07afc96f3b8aad67bc73dac1a9f99fd526258d36ba0403466241f04fa39a9c2f3d1f7eac4a365b3cd
-
Filesize
2.0MB
MD5aff6c90658f54c9e645ac842eda0b3f0
SHA122913c46ad8f10d836582b2f63de0a899dd4f11d
SHA25694cd024785e676d292bc470ecf18aa912267aa34cc77cca756e47134aa9d4847
SHA512b5c50059f5f814006c596177758598f7b2e4f14a2b2c396e1766968c7b75ac3c292d55232bd4f0ef33556159546cf2753758e014699bf52f6a4fffbced0f442c
-
Filesize
2.2MB
MD584fd214855ff13ba4933cd46a2bb7c17
SHA1d9c3a7f0ca32a8a32cd74ec680300be57739afc0
SHA25635e0d545f8ad952ae43b7c43b4ebb512bc7a513d0f5d7c119385b3e1e0cd43d0
SHA512dc31b072f8c9ff241dbde74ba3b3267eec4ea1b06b5156cb5b7695b4e1389ecd0406761d4b44cf2801f5ec801cf5be56689db2e3ec628fc7bd504727ef3def28
-
Filesize
1.8MB
MD5bbe2de50ee390226c70374ff58c7a43b
SHA171c7faca196b9b136220818fbd6e76eb26629df0
SHA256aaf6a0659db0bf3b5ac8975ec6b4b4406d2b67a82cde3b6b20340d082b383a57
SHA512b9f4fb66dee5bab90fff224d64432f3ad6dd9a4833dfe098470ce07c7c12b940c9dfdb3bc8cd78dd38cfdbc0d574973f97f37054069b1aa00ff38754f8ef2be4
-
Filesize
1.7MB
MD5c3cd39bf287222654a5eafb94d6166e5
SHA1aee1a03afe4d69d7438f5407333ef52b06663991
SHA256a06e4a543d6c33ac9dd9bbc087b4c9273b67453dbec3300538f20295f34aca3a
SHA5127cb178c30515fd0ff47270548e8fc32f09f9e1bac27de552bbc6049869c4c28ea90cd2905072f499a5f4948e446ee25d84216c03dc0c94e353eacb497a9b4544
-
Filesize
581KB
MD5d40c9539083d6b1d230b09ae8848cb4d
SHA1498cba00e44f3931c64f8f36e2e420f7e94e41eb
SHA256faa723983541018741d4fa8f333c1ac8701ba2b33f123e1ccf3e5528c25b518a
SHA512d11916ec2850729dce7b161d4d02582b22af796fff4b4e34cac06a21d975f49f8552c62635fff1941b71532e06761b539a052512eec04c18c68bb285f084b207
-
Filesize
581KB
MD5998272413126aa205e2407ebeec2645a
SHA167e9969115400161ad8f66a9ba722dd6c2df141f
SHA25636a51d238092f5d4e62645083177a3301ca663d5cd763fbc67313cac34b3a74a
SHA5122f501cbe441b1c87d58c207761b4ba48686f45c5878ee62a943a924b1e2d7da240f5f414f56a393f9b851519c46bba375bc3a6b94a76ba8b8575d1458fed885e
-
Filesize
581KB
MD50bcc82e0a86f2ab8484e631a2f83d0de
SHA187d0a9f14b772c09f7e3b1cfc39df4aa5077f873
SHA256a03ac2167a3b713cb9078191046de35c6fd96737680ff56f7be9da7afd9a7f8f
SHA5123cfb3ac153962d9e56bfc606a2c4d146c0bee603ecee02b949969faf63bd40e4f4b66d6e9118bbd266f7d73f567d42eaaa2117974cc38178415d57b55188f46e
-
Filesize
601KB
MD560dee03ed4ebdddf41fe3a9723a068d1
SHA188b2a98394b40bcc7ab37f4ae0b0c1051fc85c44
SHA25617dc84f4eadafb7f2207e987a785fe18074c79e1dd2e4ebc772248cb2edb7476
SHA5129cf6147ef4432c02530b0d32e39aff49e5732964f9386399e5fe74758ea059fa79a751725f09d04fac40772312c5ac86ba5160cf404851865592bfd16580defe
-
Filesize
581KB
MD54c4c3343bfc2c5cddb6c7dd684aa1aba
SHA1047bbd04874d3523d5067d5ce99b07dac95a3958
SHA2563992aa1c1aab1583fa8e0a293efd7e210257bde46ff255c12fced4d95474e241
SHA51207127e1a8307032551d348476d644b7a539f34823792b0a0742a6e713165a0100cb55aa07966586c851353b2628d099162c4cf156cbfcb50dc4bea688a0468f6
-
Filesize
581KB
MD521ee421401d5c796382ea5ad9a487c6b
SHA177b2ccb97756951c0d5e14417a0ab914ba5f3471
SHA2568d396c9546221e96c78cc18120fde6945c4d4858fa5911352a890960f4ff0a96
SHA512fdea9486261fda45740083ce2f176361ba9d695df8d2c97c7968b845b1ce694b9bbde6cc44fd46bbe6c6b323d0dcea5ab28cd145da047e091a6455a16b728a82
-
Filesize
581KB
MD5c9754fed1259440cf5b91d3d1563557d
SHA1666941285a82c3a0304fb21c31ac13f014e333db
SHA256d42c8a22c8c75d95da599036d38a9f64de8968e9f090e6e560c2fe306bc253e3
SHA512e044b4e2fe281df159ef69fde03074f979fb191c2121e5ad1a15d4a1bcda9ec988416dc934f7d907303c53f0de710d27158d39d2f34cc14cd698cf5577fea16d
-
Filesize
841KB
MD566c1a75cb9f4959038a0cba77c3d7b0e
SHA1ec5bcd7bb4757eddaa0933b6453923694bcce05f
SHA256ba64ddf10b4805ed557ab1d3aaa0e5f722465fadbdf385071ab65f900d3ffb2a
SHA512357e80ed13e686f8cc83caa84a86f62e63f30682b055d961caf37f94c0456b2af357549b6abb1ee9f7546a0067b753edae1c7940e7780d712d76a2e06a042ca2
-
Filesize
581KB
MD56df426d971f5266c7940d98a537187c6
SHA1dec41bc66b27ecaa0cf240ef57cbdba41b981044
SHA256641b813068d35a914943671ccb7fb5c9798bf6a69976c3d404be2db0690a5c35
SHA512832247b4874bb68e32e15c8bf059d993c7386f3a1942d69ac609066bd7fb646fd1f285f32179cc873f3d68f6f0896b4f372641f975156d42613adb7e8174eff5
-
Filesize
581KB
MD5b1253e39dbf001ee26136c71c420bfce
SHA1d996fc253e4be282c512036107790c38e6ebcf66
SHA256e4c77a18348397be9c0d9fe2b00f15e8f38393c6a2734e2b5443913d60af3e59
SHA5124a4c487680af87324fffb14330f5e07a0daeaf9fea53f040bb3ffe11ba56ab6bd28708d35c18dcca40ef3892437903cbfca472199b3d7c5548e2b0aec66ff19f
-
Filesize
717KB
MD54373be25d1197bf038fcf422aa7294b6
SHA15319af41e52a847437725c652e967f96e1697384
SHA2564500da01a2c4404e7b2bc186432485a09695328dfff0e1fe5db54a69db63046e
SHA512fc248a83aff8faa024db408ce8c9894b3bf794adfc864974d35ba279918845dac22cc4a8804517481f81c8c2df4346fd8dd882bf0bc04eeede0082e56eacfdd2
-
Filesize
581KB
MD57c076c72c8ba1bc9ad45f9855b9df198
SHA1c4e3222720295272859aae40bdf04d4205ececa8
SHA256186b51a981c5008e42e9887f44a6b2d51e13d496db35c304c84bc007457e209f
SHA512f9243968c462ba764e85527d3ae6903480fe6dc642d16b320edae6a8bf9c772cd0f535b2841ae011c19a722c0c8b57079a44d2281904555b80b4dee7a8ef37fb
-
Filesize
581KB
MD50ca287ef9e4572e3a47fbfba59883746
SHA1e17ed07997ef3d2d293ae25230d3a34d2ee18fc3
SHA256b988cdc3baf4ce754d66dc0ae2660a0f156ac2452ed8b7e68032657df3a27734
SHA5123b709ef02e2c0d8520f741b091c40c1684b8bb18e5c030cd8df2b2fca8073a9d0f6b92c9f08770e4d375f57ab502f9c609418be70fec93821a9399915941beb8
-
Filesize
717KB
MD56e772824960888a3eb9ae50f13db8f69
SHA16bcba81bb8785fe8e2c0a00f3610f5c06a576d2b
SHA2563071b46c2786c9cad4b8b6c6514fbe281aab0c0b3b966a5eb01fe86608482bde
SHA512631620ff0fe5af69c625ce2e4aa58ba46464fb40926d827cca277c475736eeeab66c27cc6512acb55ae3d5d0a6da906ee85f475447b2460966b3f1f3fe0afc96
-
Filesize
841KB
MD501b9b10935355014982fd69b9ea97cd7
SHA1ce5d5adcd6b8ac1ca94bb15ac431e2e117de7b83
SHA256ad2833dfe12197524cd2bf363ca6a052c85970f743245c6f80075f1c99a470e1
SHA512da7adf98cbdf82260264b483e98697d8b7bb981061f2cc6f3a7a10822cbbcde701909d187dc881def1a5fdb5b50081f774fade73ee6bfca8e08b77e0cd234de0
-
Filesize
1020KB
MD53bc2abe1802f1d3b84a31b2bbf7e81b7
SHA1e325fc5ad21b129d980411071b94af788d1e889a
SHA256d77d70b585515a47ed390b9f87ef4b69ece530c6d023873f39b92acacc5ad118
SHA5128120528e4642544198b559ba06ebef4707d22ae996f5da9593e0414fce3b0d8c15ca6fd52267c3bb0363b65d40925f9323d7ba51f02613e9b32683e62cf74dea
-
Filesize
581KB
MD5a9d788160e3880573ed91be620754d76
SHA145fcbca6aaf382011276a8890d0b9f8f61ce35d2
SHA256a3aef730333dbda1b3aec333217589e0c4826638602a100524a5dbe747896443
SHA5127776158197186e2f232a04fe8043482b49b2ac3b9dc66f13ad4bd4dc01f85104eeaa40eb7f3d321d49bca2deda3a610fb656dc7ce2592baf701c292c329102fa
-
Filesize
581KB
MD5ac53d34f2f54208619545666e8f3c123
SHA16a45e259870dc0c6c7a8c375ef89e7a8abdf43ae
SHA256fa927c5f4c5d0e933892f630da5844b5f47c4480d1fddb96bec66bf6f18fa71d
SHA512df375e530481813f5eb7b41c8090c23efe10d4c60115f00d6e37221a595023c8a0a8e48f4107e4ad37d748b80fbea8f9ea8242420d482a3333a556e3f869d29c
-
Filesize
581KB
MD5ce339a020efe932978ba39a8e7884cd1
SHA1ee5a1a67adb7f27bbe7faa560782a49ee81ed46f
SHA2563f17e4cab76b80d9ed45301aed9eb591295740cc5fa47a6d5944d0ee9b423aeb
SHA51285fd70155369ff9679cf03860132446955f7f49c1069c5dc81d0bb879a9e1e202d995acda064134eb13326c7e228a7ccf4e625c0887ebfdf4d47b2ac018c6270
-
Filesize
581KB
MD57aa99539a54befd3287071fd7ad7ce0d
SHA1930f43a3502914ce1dbfe336c70b666079b0683a
SHA256a9858ee48494825b2c51b738ebd320e128e88099bbcbbe10631ef1c4969fd617
SHA512579f4af5f6a48f504bd6d8dbbc406817ef4c002ec1f20c57595d02c39779ee2fe2bae9d68d333cb5fad09a6d2ab4a2de792cbc6e105b3f3fd99d7166eeed1b5b
-
Filesize
581KB
MD5475e009c5c257d3d36f36dfb99794669
SHA107db7b061a8fe4c4ba3fcfa1165574988ed94f3b
SHA256d358a1cb71c5db0c7d8c046a8ce63021cfe8fbe4ecfd388b1c5c23f568f639e1
SHA5125822adb49f7295517878dc179d21af576accda43f5efd44dc5078a768471aab52af8c66a7e084747aaa66167c883da3f42fdb10473c8b60dce24709fb9d957c1
-
Filesize
581KB
MD53bdd1eff62d65e3f4bcd4b74641c64a2
SHA1c6ec3068c2c7d2fc8e607419d93b18f15a5b72fd
SHA256d341ab9d273025f5b520ff8b0463299ec0b45d61b194cb087ef9b6ce434bdc9d
SHA512233156ced1ff947442ee139ff8ce838616eaad165528ec902396f3761132e5ff8ff2bf604ac0b804f7139d528a0d0e105897fd759dc3809a99e2ec2a01adc8ba
-
Filesize
581KB
MD558c2f51d2acbc9cebb6217b5ee24043b
SHA1ed703a80e2353fc0986a82bf9c33973ddcfe5761
SHA25637486822e8caf5cd5d60dc727040714638094073e24ecce7e6ce98241336f2b8
SHA5122066939b53ef7d82ca7483c3472f79da869951c04e909d2f93e1153ed948f80f7e3562796a91990964af015220e315cfb9acd5464f0fb9e1d95538f32e2ec245
-
Filesize
581KB
MD58406ff5d981c32437e985453a907d194
SHA1739301cb6fe3798700fd97a42dc930f0fa030d95
SHA256ff3960f69dc14d135c6ab86a9642e2d3ee0fc8a2c846e4b6a97c341725bb5cbc
SHA5122bf9a917d5a7605c31883eafad9d7f100b4b0b87cfc4e30e643a43064f774e3162e3601f85128ba645036f0367e88b3efcccacf8d788e317313de73f95729f87
-
Filesize
581KB
MD570ddf4573429887cd999a5494fc5774d
SHA161c1c6900299d2e1a110420dbe5023670305f70f
SHA25683d6f86e4189b10f0749eddf6a1cfa8f825ba86e65d343289fcc973a6d3d96ab
SHA512dc2302c82eb5f563bc62751bebb2b3a35e46518c88f18eb065234c51a346f1cedfb04e652a22aecd19f0f6d22a59f73120fd6dea0f2f6b7168cddfe6ef435866
-
Filesize
581KB
MD5c8fa00fa4f64caef8f4395eb876bb9d1
SHA11278cc56b689df9f9b7ac7bc3e9ae45aa939ac09
SHA256a8b17d05df7f9bf62815c5d85f53a65ce56fec78a1dac7d7dd558bcc2326455f
SHA512f192dca996ba97ed638d9cba139abee67bc3a971c6a66da75f6f37e57907e727f50b564ee82539b0d847e3e2d22e6b683c48293bd9fa7996b7dc10978427c1f3
-
Filesize
581KB
MD5f018ff61852d6610d819e133e6fdc599
SHA1e63d1a706ba65f99280c19937bcbc24830d9ecae
SHA256e3c4bec411116743aebf5538625335d52231f94cd793f39d5da9609948526fb9
SHA51234133e3ef319dd21d69b0adb31bb1b0c864285e66eb92119d94c6c619c0578ebde5d4dc6179aa5143221b644ff28e35eecd75c0758d3e725b9e970ec48caa243
-
Filesize
581KB
MD580a37430bd4f010d5b22804edcc06c38
SHA11d96109854713992a41ea22e76e5263beedd7340
SHA256a9046661bd683e6d87d0339655fe695ae24baf4ff217673ce307d9c1681c7c53
SHA5122fc2f459b5518eba9b470fadc147543b9c7c9c70639de0e7f85cbcd958fe7bb20ae9774b5ca7205b33ebd79985043a2f05d00914733caa499b78406343a99e43
-
Filesize
581KB
MD5c10c5e04174b921bb918ad13fefdbe52
SHA1c7d09c0dcaab487be5127078d7f8e4bf500061aa
SHA256993714c54242baf4c3bca865263fc88225cdd4ba28b6fb4ec95e06bb68637f4c
SHA5123e2397abecfa5a3be4d9bc41fd367ae369c16b084525b2866704c4e1dd573851dd6f9baea6b0cdcec3ae63ee8570230cf2706497dd9bdcf7dc76fa09dc380aa2
-
Filesize
581KB
MD5778837bebf670f4cdbaf21cea11b2bf0
SHA192df21ea18c5e3eff725b4399c460f5d321b62bc
SHA256ef289da34b08350d7897d7660aebda47ce4cc296a1b3a73ad31aed063d0533be
SHA512ff22a741803cc9c47f7709725220fe2c2451483ba74c672b284cbc87a5584ce96a356bcd6e847e95f08c0c29555f50872df43598935e06d99da0f743e51f71a3
-
Filesize
581KB
MD544ce8bd7b0e49c894aa57d01e10265ca
SHA1451576c124f486820246b6428dd79747e9e22de5
SHA256bbed334ba32fc603bf7cfc7818570a116c6ea72c70e02d9645bc87ff99d000a9
SHA512f9ddc6f27ed20d9b3a06ed38f1f66d2748468d17118997687908acf87cbd5a6b56d482412a68772adf0f6ca8b8f878d6a9489feef820a1dff276db776b8896a7
-
Filesize
581KB
MD518d97863746fa5e0b08ee19c85c87aa3
SHA195e5f64bb799aaaf754520cee6f2f5df6536b342
SHA256ca646ef82ea103f82c5923b96db246ba5f013ad2e57d2ef6794bb3936dfbe4e9
SHA51267789b4243c140de4001e4cf2c14a3050f012c87cdc8d9930db8fdae60ae5a6cc6c71519c269fa7bb4b02e97394636fef3918caa2399f57aa5807285b3d97e51
-
Filesize
581KB
MD5030dc2b299cfe8a6b30f85badb1002c2
SHA13e4fea42bd14e29105d2cd863a047c29c4f20693
SHA256789a881d0f5a4d694f1dc62a8d012ea48d834df0e078b69e8686b796ebb2255f
SHA512b80242ddf543e6efbc6e711ed3e1742eb10e6511bf9c292a2525bd26f12bc7d465d1e692a597454f8336f2cba067637773e1e755cd4283e30729e84aa1684f3d
-
Filesize
581KB
MD52e49801627f899d5afeea6199c36a2c5
SHA10c4395a087cea340662fe46892f1414ec90c2e08
SHA256e7667267aaf437e433d32599457208d8a2c4af3eacfb6144747ef2ff462c50c5
SHA51285e51e27e524a74dc2229d176179ebdbe656a974bfc36c205050ec2eae7b3a6d625cf30fc8a398b5918fc226cb95c7c266e914704824ce5720f20617f49ef46f
-
Filesize
581KB
MD55b9af7bf9add771e17107131a7eaae93
SHA16208e72a7ea146b566276190f115c43659a40294
SHA256b07e08fa420d1ed0dea624c5edf83639dadca7f5218dabc81fc2c5b3201c1d61
SHA512db98fa60abada1d447ebd1f76972fa7ec42d980ebe8763e320aeda00c93d8e58a0666d94ff9270be171732f2b90075cd21e121ff22b6de9989c42cc230b6df15
-
Filesize
581KB
MD53dd1c5a2d9a1e4941cfa4d2520ba610b
SHA1f4fab3ba60f21449ce9c5ac6756b7e7d1037ca94
SHA2564d5b13e7005dfd94c3c5b9a68dcbf84dd948f19f3e296a6a9a8b71f2b463c2d3
SHA512c6c2b27530b4514214fe7581d2a4dc24a24455864443f435bfa0757177a565d7ea7b79bc9dc459bc067d13135cede18adbe1def99255fb251bf3b8281c36c8df
-
Filesize
581KB
MD5b130f0153e8db8f78c32e2e319ac92f7
SHA1443872ce8b45e7dba78c2fa9081876f41f17ea13
SHA256103585c4be425f6b9092264842afeb15a7f590abf27efd0dd7d154a8fe025e06
SHA51217497711f3f0c1877a5e709e599f00bdc6fb6d55b9cf52442fc573e278aec72652a05bba1ca9351cba5db52c0abed73efc88ba9e658c1ff43bc71f2066f31244
-
Filesize
701KB
MD5ab4cb9037c48917ae3c526fb8d923e8d
SHA1c7dbab73ede59080235ea6352ac4474600aef14a
SHA25676aa7a7002f9693ab771d3221d390a3471f073bb8c084d67c8beaaf34e101943
SHA5127f04b9ecd8f435ad5e21dd16c1923578adeb93bcb632df1cb80ac62ce9afb89ae8a3c63df5423581a227d4d030472e81f142f8f53f20fb129074cd9350d55a32
-
Filesize
659KB
MD56dea602e49e50f22f6bac35226aee7dc
SHA15087189ed7af36762636b98f5486a274d102e104
SHA25609913c166a5e0667d85a7a646e5e14010af3a9a8dc22e1a95603d6f2e46c0e0d
SHA512837c82dbc122f9c57faca99d0b99563b3a8a5891bb5c785f9e129ae720c7e2b51e10fa779217af511bd57c7fe7a534c939c48751d5f8f79283773a9aa427c2d4
-
Filesize
1.2MB
MD51caf3107123ff6cb5e7916ffc4c98dd8
SHA1ea880f4832c6d3a9c2ed39625dc3136b8c126b88
SHA2566871a9c9eeca7484f288ed93061ea974703f345fa51971aa9c7aabe74d8463f0
SHA51221399eb49c005d3bdcf621f28b43426d1ae5803970182427a557e19085754664e8907b0ad0c39fed2ee9f82f27cb249a560f51fb833ea41d9dcddcbc708d5f51
-
Filesize
661KB
MD51058c8f5139dcdb48c75e4082e9c8e23
SHA1762ec766cc94b1f5416cd0af7e082d6cd7d7220c
SHA2565e409741aedab68b73f3af43db3ec2904a4cf130f5f20a9c5ae70fde9631c1c9
SHA5128aadc157eac8efaf3aa8c21a1c35842cb608949120a69e2f7fbe12aac9fcf283e5076693696a7d91690682486cbd784bd02532a4a2a5d12470acda66486ff0a5
-
Filesize
1.3MB
MD5a75b0580fa22dbe71eb7b95a9faa1da3
SHA11b3e4c522476cd0f8c0832723ddf4ebf2795c656
SHA256548438256948d0450c2f9286557493db9e70a9125d7a0ec3c1f496aee80fea79
SHA51223730851106b2d942640b202eda41fcbe7a051c78679f537a847f99eb7fbb62ddb315ddef4027dcaa7c82d9d274d3b8323b8b2324fc8f2904d1096ff1cec2e79