Analysis
-
max time kernel
163s -
max time network
173s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
19-04-2024 00:20
Static task
static1
Behavioral task
behavioral1
Sample
a6e71a62bbad9f3971308132220d2b60ecfdd6e78246226b1f1ad4e5b5a2d700.exe
Resource
win7-20240221-en
General
-
Target
a6e71a62bbad9f3971308132220d2b60ecfdd6e78246226b1f1ad4e5b5a2d700.exe
-
Size
1.8MB
-
MD5
df8e6f10a77c60efab04bbfb014dbbbb
-
SHA1
174efc4665b7d4c39cf75149f7742905b859cf25
-
SHA256
a6e71a62bbad9f3971308132220d2b60ecfdd6e78246226b1f1ad4e5b5a2d700
-
SHA512
3d59ae5e1c122e5fa3dc5d55d34e16330373fe2d1fb406ea378cff8e7fba0e676c7a2c582d1d44ad374d7ad1feea90e1df0112e578061d05d8ecdbcc9553cc51
-
SSDEEP
49152:Gx5SUW/cxUitIGLsF0nb+tJVYleAMz77+WAIkQ/qoLEw:GvbjVkjjCAzJ3qo4w
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 4952 alg.exe 2828 DiagnosticsHub.StandardCollector.Service.exe 2232 fxssvc.exe 2296 elevation_service.exe 3704 elevation_service.exe 4420 maintenanceservice.exe 2872 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\System32\alg.exe a6e71a62bbad9f3971308132220d2b60ecfdd6e78246226b1f1ad4e5b5a2d700.exe File opened for modification C:\Windows\system32\dllhost.exe a6e71a62bbad9f3971308132220d2b60ecfdd6e78246226b1f1ad4e5b5a2d700.exe File opened for modification C:\Windows\system32\fxssvc.exe a6e71a62bbad9f3971308132220d2b60ecfdd6e78246226b1f1ad4e5b5a2d700.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe a6e71a62bbad9f3971308132220d2b60ecfdd6e78246226b1f1ad4e5b5a2d700.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\3e30a9de2bd8e231.bin alg.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe a6e71a62bbad9f3971308132220d2b60ecfdd6e78246226b1f1ad4e5b5a2d700.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe alg.exe File created C:\Program Files (x86)\Google\Temp\GUM9CBD.tmp\goopdateres_uk.dll a6e71a62bbad9f3971308132220d2b60ecfdd6e78246226b1f1ad4e5b5a2d700.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Google\Temp\GUM9CBD.tmp\goopdateres_ur.dll a6e71a62bbad9f3971308132220d2b60ecfdd6e78246226b1f1ad4e5b5a2d700.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Google\Temp\GUM9CBD.tmp\goopdateres_en.dll a6e71a62bbad9f3971308132220d2b60ecfdd6e78246226b1f1ad4e5b5a2d700.exe File opened for modification C:\Program Files (x86)\Google\Temp\GUM9CBD.tmp\GoogleUpdateSetup.exe a6e71a62bbad9f3971308132220d2b60ecfdd6e78246226b1f1ad4e5b5a2d700.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Google\Temp\GUM9CBD.tmp\goopdateres_sv.dll a6e71a62bbad9f3971308132220d2b60ecfdd6e78246226b1f1ad4e5b5a2d700.exe File created C:\Program Files (x86)\Google\Temp\GUM9CBD.tmp\goopdateres_tr.dll a6e71a62bbad9f3971308132220d2b60ecfdd6e78246226b1f1ad4e5b5a2d700.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe alg.exe File opened for modification C:\Program Files\dotnet\dotnet.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Google\Temp\GUM9CBD.tmp\goopdateres_ja.dll a6e71a62bbad9f3971308132220d2b60ecfdd6e78246226b1f1ad4e5b5a2d700.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe alg.exe File created C:\Program Files (x86)\Google\Temp\GUM9CBD.tmp\goopdateres_ms.dll a6e71a62bbad9f3971308132220d2b60ecfdd6e78246226b1f1ad4e5b5a2d700.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{E84A1AD2-0399-4DE7-886A-CF3B4B5367B0}\chrome_installer.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Google\Temp\GUM9CBD.tmp\GoogleUpdateBroker.exe a6e71a62bbad9f3971308132220d2b60ecfdd6e78246226b1f1ad4e5b5a2d700.exe File created C:\Program Files (x86)\Google\Temp\GUM9CBD.tmp\goopdateres_zh-CN.dll a6e71a62bbad9f3971308132220d2b60ecfdd6e78246226b1f1ad4e5b5a2d700.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe a6e71a62bbad9f3971308132220d2b60ecfdd6e78246226b1f1ad4e5b5a2d700.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2828 DiagnosticsHub.StandardCollector.Service.exe 2828 DiagnosticsHub.StandardCollector.Service.exe 2828 DiagnosticsHub.StandardCollector.Service.exe 2828 DiagnosticsHub.StandardCollector.Service.exe 2828 DiagnosticsHub.StandardCollector.Service.exe 2828 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 672 Process not Found 672 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1792 a6e71a62bbad9f3971308132220d2b60ecfdd6e78246226b1f1ad4e5b5a2d700.exe Token: SeAuditPrivilege 2232 fxssvc.exe Token: SeDebugPrivilege 4952 alg.exe Token: SeDebugPrivilege 4952 alg.exe Token: SeDebugPrivilege 4952 alg.exe Token: SeDebugPrivilege 2828 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a6e71a62bbad9f3971308132220d2b60ecfdd6e78246226b1f1ad4e5b5a2d700.exe"C:\Users\Admin\AppData\Local\Temp\a6e71a62bbad9f3971308132220d2b60ecfdd6e78246226b1f1ad4e5b5a2d700.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1792
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4952
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2828
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:1048
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2232
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2296
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3704
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4420
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2872
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD580dc72911424979c230521709392bce8
SHA16bff59717c8610ed6d4be46f3c3602ee253b0eaf
SHA256949f2d11913b059452c15ca0d3758178550a487e42b1c6305219e5ef4d588ad2
SHA512e220e13f37f5472600dd54ca59f9fd8caa23d4d68146bce70ed85609a5f0c5c7821794e1d122b9e2b938e0c776960aa392711415c16e77b0a865c0d8f75a786d
-
Filesize
1.4MB
MD5c4ae76dde9d26985fd64dc02ea6d9117
SHA1adb77c75c1e3cae761b934ca52bf58f1a1baab28
SHA25632a4d45d9ab91e3bdec8da9156c3a5e6362bfa5d73b6890df1c4c6c87b906bf7
SHA5123f1f5cea893960f426f6cf3de60aa8b8c23df74965ca0ff0f77a97b20ccdf3382f8aa7a8a269174fa2a244eddb66cc22d418fd0afedf0a2ebfd9d0a98351442a
-
Filesize
1.7MB
MD597a22f1c9b41cd406c8218930c7c21c6
SHA1269f1dff5622d0ac9e64d990a71cd5e30b45cc5f
SHA2561c5916fd512a7dc01a37634561877ba77d01215f40ba67ca7e711973cc6758a4
SHA512cfa59594becd8aaf772e2fb45e4d5365d4b45db40a283d34ec1500a7c74f6ab7f32eded7bba07387398baee7bf0958763a4b37c3d0c2593e9043d939fd9ba976
-
Filesize
1.5MB
MD5d5507f20af94a1ce91bd051bab3e2e65
SHA118bfa6f7419fb6a64aa29a0c165f322364e9e0d3
SHA256cf4b9915128cf66308d50668b9ba3b58e163405a5189ba7c7ede6517d7e81824
SHA5124afdb80edef3d4e077daa8d4c9093ceab0dabee8981a98e7751dbcdf554f63102ef2cc5c4d84d0740702c3deb028574d20cc2245b1d6ad449c4c4437e34a3dac
-
Filesize
1.2MB
MD58448f72afe36697077abb8622c263974
SHA10cb5b04d14f975986b1e7403c23d9f0ae8eb83b3
SHA256382f99048065e0f5f19a92f7db7982fcf7f7df87af04086f610b9f6434049790
SHA512c97fd51b11defe592607d1c0598ef6f9ee357575c45d8f8189435d0a6d0d7270d93e7d993f60b3308b218f6e59d461a8ac96ccda25579a6b4294405859b05007
-
Filesize
1.2MB
MD5d0432808c8ef5df4f8d159788f9063d9
SHA1f5cc9784bb8052db58576d494ee075fc6999f2a3
SHA2567adaf2f95163b77ce1047d89f81989115404b38c6797cf2e82c13e9a5fe49dac
SHA512fc73940feea3bbfe6217f14b882f9b9d7aa6fb0705ea42a78093f7ef80beb588d8e894f55aa5b3bedd9be25811ba1d4e418d06806674c9f1cc928fef5d157113
-
Filesize
1.4MB
MD50841fd80a778a37e41cf0542c9f1f16d
SHA117afdaa23e1a5fb594065b8ec2c223aa3b48d958
SHA256533497acfbdd776af348ef1eb38371dffde709f8668186ecc2ba6276fbd45520
SHA512976c794643cf2cd758570565ef4ecc1ac9ed4791ca010e4bf0fc7957dcd2ed022d8cc181db623e41c7755a90b6e0ab1b4188ed5fbb35a89b0279547a8cd2931c
-
Filesize
4.6MB
MD510ede738848a7edb4dec71280a834527
SHA1f2215814f118ecc3964af7650e793a8416a2be0d
SHA256c32f7e41e2466da343ab19fd468b53067acd9b4f39ff69092fb3b0a1e8cc364a
SHA512c7b6eafdbc99fa45b920fd8345429318996679bcc0b86ce90fe470eecdc2a414c3461ee2c8f0b75b9a56c72b5dd5d17f6c98266cdcacf708b9459396ff922d97
-
Filesize
1.5MB
MD549788eb5ffcf50915e3e39c5b7f36bb2
SHA1e10177548cc59e1043a6d1cee04ebf0fc97ddbf6
SHA256db51007560393c3726ea040fff50d63faa3ad07418c7b43adeec7391b43cbcab
SHA512540d4f37f658c87c785fb577147e903eb9db73a1df743281cc4e0211eb81f68319c824f86d32e625594f3a6c1e334ea03a414a815c55f9e45b1b4fc7c09de1c1
-
Filesize
24.0MB
MD551fd1b53dfe99195195fe607815af3aa
SHA1b9392744eb428b2da018eec65d93a70bf596588e
SHA256c2c77582ec401d3924225cb3e78fd8e4966d5b9cd2dae77db9249ded38967ed6
SHA512961ac76d55a95811d8d5f887c1d8b108ce9a33d75e064e06d7f4eda92bda29a9e75622a55360dc0dab0d7e0046a6d3c40d711087c49fd4084caec99a61622319
-
Filesize
2.7MB
MD59236511b1bcf9a8b18425cd2a0431c4b
SHA189fbb0a7bfebcc904777c26f85c855c11e64eae5
SHA25633db41e301ccd43f852479fc0e9634eafb3a023d312bad5f962ad44c20c857ca
SHA512132a54a6cfd7c9ffa5c224094dd7b0d83c2617f2ab1ee42c8cdd1666a12d21ad5970a390b7adf6f764405ed3b18386a23835ec7a60d5d087ee7c890eac315080
-
Filesize
1.1MB
MD5440ee1bda417cf88472bd9f25a9b6292
SHA12e7680fc1213b963c9c086fa5dccbb0afb544796
SHA256825968e8e38a4e1bdedfd9bb3570cf5f28119b771df514c7c9962250f5b8a1a3
SHA51225cead64894c934e4f8e65e2136c66113b9869f9483e22cdfbf1662a60896dc8c89e2ff9237f7ac55f871b43041ccc2ceb0572673cfb61d81d0ff90d4c02b815
-
Filesize
1.4MB
MD5ed600018ce7907335cab216dc8db845b
SHA1b0f80289fec88bd9694cd3a0baa6ae2a3f8e978d
SHA2562bcf3d084d987d73dd711fdb71a9540cc3e219d0f0559413f81f3aff456590bd
SHA5120a66726da5440fc37f0e5caf98e007372b4129c4a3a5356aa827e2fd2769aeff39a890ecf1db5b3a3ce8ee68a20777106c2309a6e55ede26569782f4ea7c7b38
-
Filesize
1.2MB
MD52c75e82c475c07d78ba524f508a2dbd2
SHA186843cce5e8cf6752406b5892be1685b1cc814cc
SHA256ce25750576555672c853bf7638994ad19272344740aac2f6b71f75aaa192daa2
SHA512b7a798edc1c115ce47a45d85856b4db991e9592d397644f5c9d83c0a67c4fdf8452619c8aee6fbe6bb53256b326ff8b02d8f514bb7c4d7d6c21b4483192ddacd
-
Filesize
5.4MB
MD535df3a5cdea3d404968d3c66d926c2cb
SHA12ec64d97e66f98d92ddae96b675da92db41a46e5
SHA2563a32d1eb489f050aa76f1c32f5bb3978b08932c81310d68f08287e1a39017e64
SHA51207f85a4b2c44751e33a467d0d0bf0a01ba6b51c84dce200216f7f29364f290be8bba80d7aaae43180dcf3ebe5464ea8d42ade4eb4a87e3a99f9529c401aaf1f5
-
Filesize
5.4MB
MD5130854ef658ccc4c87acf7ca582e463c
SHA1496a7bebf4bee9d181f4989cfa707a457a6adab1
SHA256833acfe137f3a3588c295a82f76631d6744cca78f4ae28c54695831b8113fb40
SHA512dd2b99cc6e11e536c944d58888acf8f34a93e3ec55fc736309de00bb2e2526c4a50550d6059e0db8091ce52965eee4e0eb8a5e682a6b59bb02168c08a1c7b88c
-
Filesize
2.0MB
MD590e8ce2c1799ed7846f88973c54059e8
SHA135516df657522116487999c8ea6fc8663e380b53
SHA256c984e311274422b560ec32ca0e18a99e65db9add2aeeb0eb466c8fcbf219dab5
SHA5125c470aa19b652bffe96f5ad48fdc084f91e34821836f57ff6d23f33b37287da7be7f2b2b471ef552698aea865771761bf85f9351ecb152cdfe4a0ffe33de8448
-
Filesize
2.2MB
MD593e3760aae045175409eb14981acf094
SHA14a4a31182b3395f4e378ff8c6a33897fe0771679
SHA25627d4202621a6d7d100fc4fa521594eb10e75196128a1c32b7cb9e3e6bff01b25
SHA51260e9729298171899f2ab494dccde1610bef960c73bfc3a482578417051f25e294c22244e7708e49d2ee1fa1f02ab28df70a32ffc1fd1a87a3eccfb33b8e336b6
-
Filesize
1.8MB
MD5efdb3029f8c8f871495e39085a3cf5d7
SHA1ff5411a9f485d5a5581716893135333829669328
SHA25666ef8d333c189301e617032259c15b56de937794698f9ef1292d101cc4a8b409
SHA512eac615b4218d715388d79fd9b78a1a2f7965508378972c2e3d37b7689fcba29533a72b79e0399daff205d282a125c4e8ec601b9c79a7144d1ff35cb5419b8632
-
Filesize
1.7MB
MD5d02dd4d5b1d73aacdf24a444467f3225
SHA17a473767208505af2438e2d3fcc9376f838c8101
SHA2563a1522bee020f657666d2c8d5100f64eb9098cf877d1ad155cccc803b6072a50
SHA51264fd93d4ac37ae58c4391966eead82a99e8420dc552a03d1113c68f938e5715881dc5ba0051eaddd06e3b4f6093381687ccf712148e2bf191395aa2d8ff3249e
-
Filesize
1.2MB
MD586e5cae0ec96ffae96b5583937e7b823
SHA187fc6b9153eb8de05ce57ab2054d05909fc9e226
SHA256de4256f22e2c9d18150dd6a52a315f95115eeff2660d69bf1549ec3a7729b52c
SHA512f548fb8214efac227296cb5b411a9ec9ba00eb1101a9f7a10688437ed21ed6c45a18b43ec8aff0491bb8e86fb6c0d44c0dffde6ad6de2b769da3173e8ed07731
-
Filesize
1.2MB
MD5432ec8964db3b0cae4ff2b0d8e04926e
SHA1f2ac26ab86fd83e668851c163895001f1cf0d7b8
SHA2566b1ed8caf271b20658b009686789c3a69a8d950edbf25ae3792ab90143b45bd4
SHA5126cec0604f4d807c1d81d69a07aa4be93d0d6abdb8197dd0a6e02f8c30af6f5e1915c26efe167c7fdfd55d28d5b7e375aaa0323b03f629336b47ede4f24165f80
-
Filesize
1.2MB
MD5c2ef25c5df3c3a1a68f57c77b6407e7e
SHA12102ab44969a429de8e2697038dcf152859180b0
SHA25614ee35eb74ab5673de34af8a8ffd55c8c9eac6742a1ccb648d6af928a8dd68f0
SHA512310696520b37f4b308b9ed76b9824faa5bca49bfdd714522b84f2409ae793ae54bf8c8da866a7f628e6ba6efb784af2d13fc7a857dc7007c5aa7856487b91c7f
-
Filesize
1.2MB
MD5a873497bd9f7cb808581beb58f24f48c
SHA1006b602ec188653d649c24f34f5da57db42ed6c1
SHA25695aecd88179f4dd1320aad13b82ad72d6bdbf9d6110107d4dd1de2256fc48b7f
SHA5122fd67b729b9e04ea9cd50b87830dfe8eaae9cb80f423b3be488779f73d45c88a08d6362d1ce4c9d8b069ad5f1be9e3197c756a435ea58498eda796e8b87c9942
-
Filesize
1.2MB
MD5e1c12458a15722fef6369e83d991f726
SHA117c918752e13ecada1845cdb9e2c750ca07ce638
SHA2566b3bfb30b25cbc65565f64947956c50d487394d9ae60d3f8572a6d77fdeb6342
SHA5127734d66746fae98f696e841c2d8fc5f7eced9a0482ec8bef0ad553ece370ea4c9abb0a3f24ff5ecf91712dcbaf0272d72602a10516375717f447e7311a8f7a73
-
Filesize
1.2MB
MD5b8b6a6e6178dec7626fd0617bc752536
SHA14d27bc2c73e30d802cb0fc2a02104941dc72ded5
SHA2567bcd5d547fc8b7123bdcfa65316c9128895fcce222c6660f54805d98e345b3e4
SHA5124fd59a17b0de3c2e91bbaf7fc1e48d170b0bbc276c87a4fbc0c69f685b8b4a9f8154be7a244a522b1db2966e6e879ee8b9dc04720fe55f882efd73169255aa86
-
Filesize
1.2MB
MD56ad60e17a9259f8a1287f093e43d96f0
SHA1db1f4faace5367783fa60f3493fe245e4e475315
SHA2561196de29d7340762991bc6a8f92c4a9da84d7e22f270b229fbda3b389abf24b9
SHA51208e4d0d96b2937e49f5a6f49a4addc27be8c8e59d2dcd09fe51770a24a1b6170159d0056bc7fd928f97cbfa97b2f009ad8f2cd6a0303e807bac15ee4ec998466
-
Filesize
1.4MB
MD5f321354105f2be41cc6cfb5e4ecf8f32
SHA11a766d4227d98692c6c3a9f00ce137c2f7983721
SHA25649cad88249b9b5d3821c0fedd1c46cb4adae0f64aa3b7b7de514ff964826da6b
SHA512814cb188d495cf810822c507809774212f47ca9d2891084ce2ed62c108a1afc57cb1ac3848cee735ab38c296bfe57b4fde2ec7cc660eb2de36fde6295f6c5f10
-
Filesize
1.2MB
MD5a35a71147ccd33c2b44591559bb80219
SHA1e438624d789aa2d3a490172d48fa1c8cf1d17700
SHA256efd86654c520b9bc2f92e851d54170873d8d26e4e93c447673b594e4868d8a66
SHA512b4781497fb230728f2f606ddbbdf5f4193f6399c48a88c5c802c1b8ec355526a69c03c0a6be1bebe0c91946e350d27ca5cf27e575e8a9ab6ce790e2830f1ffd0
-
Filesize
1.2MB
MD59a46f5b6e99dda9efd3cf85c2ad72f2f
SHA11f2260f9051813f363ddca1e4c99e35b8c6768cb
SHA256eda6729b1685d5024e0cd2c6b4ea9537a4e4e6460c5ec9094a6ca2973e4d1601
SHA512745e2bb405bbdd61452e01d803d22f5295ba15cba738da23ccd8a3b900cb9a0692ad95a2ea3ac6412d65f4a5c445517d707c7de82dd322b2978c376103dd8a64
-
Filesize
1.3MB
MD5727f12ae9c924d0a043851ea55b9f2e8
SHA1f38dc8ea57063721a70e1ba184d9a33ed9b06e9d
SHA25631dcafd7171be29f18fa763e533ec5932b901ac3566ee6de602969b7b91147de
SHA51205adc5e36b1ff82c0f8fc555597da6709b38f41524faec0956bf8512bd89cf7a227e40467b239642878173349468fb99006a313c8b942eb1db8d4e1f67c77755
-
Filesize
1.2MB
MD57954ecfcd469bad49bc7457834798939
SHA10164d5b5a29a491f240114eaaa5f71fd9ef68a96
SHA256388c5c1be88e18afb252a4250c6faaad40e73f208e33d75cce7ba8d1e7c8df71
SHA512f7fc9bd47d815f38b5c1927db3bdf22cbd417858075568b121a374c3256eb126191cab2dae9e80acc95bdcf2c0202a2f1b2c7b04d6e0af492f3ef79edabb5938
-
Filesize
1.2MB
MD50d83f439e61abc1a3c161b5b3f416ed4
SHA1f4676608fe10ad906add585b7b414e81fb5ed211
SHA25639320991020b6b065cecaf4993edb7c56213268cb00aeddd782012d7cf5bc4e8
SHA5122caf1307c4498e4dac1cb4ec0e05867d4135e8e83cfb74d5a04c0ee29baa265216adbbe2205f1c7a08b94952a64a8d4bae01ce90cccc47a6c2da15395ea8a226
-
Filesize
1.3MB
MD5705d140a495b96e3c4ce86c7d4bb2817
SHA1760663ab6fa170dd63bb493605d9fb164488a316
SHA256a33685bdd0ceb926e5e1d0b134e4cd6310b37b505c9c7714efe727a5441ffe51
SHA512032d2fe757064079a3665b434d706453dc56af14c196914c7edc2f60352652df54cd9e38aed7d8d43fe60dc95879655623848beb11bb94714b450925f4669869
-
Filesize
1.4MB
MD538100ea00af79acd992b213475e7c8a3
SHA194f7ec045818b851188561f21b57e728e5881760
SHA256e64adbef402de7e5e6b6c91ee96ea9d038a7f3618704798de3db206f85b0e928
SHA512be3b6ccf2c92db6a860b6cdbf098aea9cb48e95736f0151566061248343618f3b0cba09e7052047da436d4f96f7aa3be96926946ea77a2e9eaa93542d218e231
-
Filesize
1.6MB
MD53d3ed11d520eab3166330a2fc59c725d
SHA1ff0fd9c71cc759f621ac8683b58b4c321a75bbe7
SHA256f339d3240836b301ff3db4b8873fbdf5d45ec65c23439f6f187f309a2f34f2e0
SHA5126c12ee45a83d840cab2689276d5a58fc0949daa4763c09ecb7000696d916088e056faa1c73063a3947e65be892e115bbbb73b12d80bbf16a89b1bff73037270c
-
Filesize
1.2MB
MD561323ccf685aaa6b05e7b8adbd5626cb
SHA1f8d28a1c73573e15ed0adb09fac5df05fe3a86f2
SHA2561a6f58c050dec4af8f2fc54541dc4e6816da88eac20bdcf8cbb049d5727e0cd0
SHA512441aa09096853b17b40db796ec223ab6aefa560d90f2592ec23fe4a7c1e939597ebd069509d3858079ad686dbffc0c09243296f3b0b24e0250caa9ced39f9a05
-
Filesize
1.2MB
MD59dc144b68e2a514cc0508af675e9b479
SHA16b5ad507e47d98d44d05298c9d39c24857c0251a
SHA2568b20f3420786b64baefcb4a8025dc06af1713d8314acee03400ea8b6ab940ec5
SHA51277a53b99d1e66c08e9912fe9b9de71e4ef9f647a80e5b4d6a8d82f5c9fd771e5d267be8df0a6be3d275120976467a057aef0412c389aaeb1be64be96fc32b835
-
Filesize
1.2MB
MD5ab343ef0f540760036509e2dee7aa544
SHA1aab52216fe0630bdd93cf1b1acc4629cd0503e66
SHA256fa3ebea92e01f6cccf610f6afe583be26363a9676ecd97d6fc35e3ac638c00be
SHA512bdc62ecd24829b370a8b47867f73a81ed3f064aa2206995ba1ab8150c0ca4dc643261ca35f706d8b8356d10a91d7d17d94211c7bdcc1d69b13f5c8d5219a9dfc
-
Filesize
1.2MB
MD5399c7ebe00845133d091a92e92d28c56
SHA15ce4884528011274a1d2dcdc04c98ae71df31616
SHA25617b329d76eb81270208a4aee7f8b32fe05399a97ffc6c33a043d1d9daaa2f44b
SHA512688ae511eae39d59ad196248e02e3af6c50fdfdb7f95fc23d4ae4595380e8cef5b10f60b3299df2481b528efc4780da3b5ef8fe0fb4bb67241cffba3d0e02a41
-
Filesize
1.2MB
MD5f88b50328139ce1fed89defe0b3c6216
SHA1111ab757de150c21f0c16d3128919a43800c2fbf
SHA256e76ece3fecf5e82c987a1893233b6da371df83bb8f31512666d6cdfb7cd978b4
SHA5123d6be6796ee83051f2f0c37505eba91ad48fbc349c6ab770714b39fd42e54b1dbe5bb9d08b0d9386f18fb3aea31cab2a43063ab2285db234a4f9b625688bf17b
-
Filesize
1.2MB
MD57793492dc06e146bdaa0b204574850f9
SHA1e54a10a072c67acaaee6391b36c2fb88073a5b9a
SHA256817f6e3ae9f5ee35f50dc5f7225ef6ceb6ee6ec4ae17c9014e9b7ec01b43b4ee
SHA512055f7e7103e1c15ef62a656385489a9ad5381e609a80c558eddf9bab69723eacb4b209f6011adfc91485f939536090f04f863e5d7172d41ce687fccb1e4f511f
-
Filesize
1.2MB
MD5e46926f0677a486c9be827a02cc43340
SHA14f35c2fecd99a5264c952f853e4844c4d836a984
SHA2563b57b0ca06663d01670de8cd46e67ef84c22832ba4fc2e376660ffb33975a8f1
SHA5127ed2e6e0244d01e8cbdec1d480c3bc05f862bc82a071b256c00074170b1cf4f052280e3675d324bbb31a470681c927ac78d01cabbb020016302afa352deaded5
-
Filesize
1.2MB
MD54cf9d78389ab947735713a68ef63bfe6
SHA16e5ecced2fea9e28858f77e670146c8928277f67
SHA256b440d6f9675455c7e55d54a35fcdd1a9384da60d812c7638e41fb94d18f47ffa
SHA512191d2a4ca72e41ae3162fd1bd6ea01a825d760b60134d5bc2b52f800e8fe25580161fcec0b833350bf7668c5849b2769a77b5d0baed5683cce398f6a8c3a00cf
-
Filesize
1.2MB
MD546957f4e4c4ae91e0b8385fb140d2671
SHA16539347d1716b848b29cae80cc9212e8b3000343
SHA256bfbeb808ae53dbd808d0b9a5c59ec6d8ba37fea9b5ab9b4a218063c72e7ed766
SHA512fbde67b6c361c2deeabf7317f1d4764300b4f8f1e22b5adc2504fded114365cd1a56c825625a3829bd2a11aa004f277d3c528ae2462222bb5493444217a3a292
-
Filesize
1.2MB
MD5c386b739ead923164682e04175d80294
SHA1ab9bacfdfc84384d43ba1add9e1222a7399de51e
SHA256a2e6bf9844a2744b6be15a910120181b8fdab29e22c2447fb9dee0f95e8ba8a5
SHA5120b8d2f35c927f20ddafe0d2b8457dbe2aa45889e4bb3b080b02e994117bb30f4bbb825e8dd14a99311e2840d12f2f112849eecf44263e41c6d7fb949ab025085
-
Filesize
1.2MB
MD5face4cfbcdd52e802d629af884d535a3
SHA18a21524882dfaa1b8e376a353b3938281e92eece
SHA256d5b76414cb46557f95f8bf2ce814ff6b6c99e04bf80a97d0a1b874ccd5306694
SHA512fa33ed2ed2f66a943740871820e89fd663cda4a76a02b232dafa3ffaf0e051060cc7f36a08a405d4c85373667d40b4317f23f89d99510b2edaf6404f79a003cd
-
Filesize
1.2MB
MD506c903484e2b9a5cf08b54fe0b0a5a79
SHA1b6de818358be5b1a716694bec5424b5fa4bb631f
SHA256462c87604295cf348d4b94343a8a249b32dbc53ba1cacc8984998f7878e9feea
SHA512bc7790245311ae381f1f695b74cbdf836256ba1a855b0f4767d839c594b9b8dbf273704f2ff8949bc74e82badbf0f88e8dfd7eefcbeb0fa536fafcfea61cf782
-
Filesize
1.2MB
MD538b5eae69c676c98630dc26d7e6edf0c
SHA10dfe9b64d3bd76f486a23b9804f967a3f17f41a1
SHA256abcca94e3b22029b20d3b36ce21d42c0a725d3fe675f97a97bdace6c3cb5258e
SHA512c10e27aac386ae814999ccaea483f658d172b04f16eb6923903e70a3eee1ded58cb13b5125f82840c7bfc43613cfeb2f408ec2fd90b39be463516fbf93f06259
-
Filesize
1.2MB
MD5008cd0ba004aeeb75ec90e6faf37b629
SHA1a9b1007807b8a99e64db73028305d81ff0cea7a2
SHA25633402cc912de2f85e0342610e517c2def8b052472dd3377cba5dea49e674bc52
SHA512eaa827206360fdde93178cf58500720c85aaaa33ba3a1eecac98fcdd44b7855825afe6f1e611f925cc1905a230d15d33b831f951297d767020719783e05f5c59
-
Filesize
1.2MB
MD59776563c79457b91d1fcaf08536513ee
SHA1beb4c3ffac9517bd197b26df76dcde230aeb1891
SHA256ffa7aa9069af0ffedde8daabe3ce6da645422e9e209bb265777082af71c85f0f
SHA5125692774799ac92089b01a9fdad172ec0467c4de936b5506603f4aaac0639aa3ec59a7373f4639b0953d2ab33c3e0fc2c677ba077505384f8a7fb41fee8f36551
-
Filesize
1.2MB
MD517075836f8bb239a2ab337d83d1ac8cc
SHA143239296a52efe8cb08dcd0ba910e5a7885d87e8
SHA25615e4acd66988ed5d771d97db29b40522315d357698cc25444553cfe140493ff3
SHA5126c68834c46ad9464624b9c35045d00f2e4a8f15214d631e9f19d443aad8e00212bca509d3a250428b44920d6a9da091d2845d82f21edd8d16a7cce5230765996
-
Filesize
1.2MB
MD517d9d278f6765437c9a4117694e77c91
SHA1ac33ff456ce38aaa97265b9988620bb0bc2ef402
SHA256f6003628b5d29e647c5e2a2f8b82eba7b6d3132bc7cae0adc2bb0ed034b09601
SHA512eeb58d08cb422e518206cc212fd8b9b67177fee06febbe26cd4049af298cce241cf6f8f62d11835d30a91ac764af1478feb0227c8cd534b3c90f485250642da4
-
Filesize
1.2MB
MD5fc1746688836d28dfcdf0999382c81ae
SHA1625d951aaee254e7d4d1c865002a406c8b2cc6a3
SHA2566d81fd85493cee95099521b70edcd32d8b6bb326aa8d1f01f34a565819efeca7
SHA51242638a69e0b7786e559e3f4a5f31b67ca2b09a60602d0a3761b6771ce7e0fe1bbcad1467b7d1adf3ac333e0efc87562bf974837609cec3c3721d6d82011e6119
-
Filesize
1.2MB
MD5e516a015f29e33fe04350a35fa1dd3ce
SHA1b4ec8f87e813e3db726d4ec7f9e5419e7790fbca
SHA256fa539e5d82d7f9607381160876136cba3e523509572c4031aa0410d19a9a7c2b
SHA51201dcd690bb9f5694bda3eccf9860b071ad1952d53a0b75b2015fce92e2563a42ccd8d7b36e21e19df138306b781e96cc05991c02c8c4b0b0c765d0a4312dfb6a
-
Filesize
1.2MB
MD534b28f36e5e757477b29ea6ead40ddca
SHA18ebf8d8dc4d4ad65fa8cde9be18370f39cf8f0e2
SHA2561471b4cab62641e46841f8ea0bbc7ab3f3247a3ad22619a491d5eddcb5e7f908
SHA512a6c0aee3a68a6c7c4bed3df217d0d48eee2a41e0157acc27be724010969aea3bc928541155935d2dadd59cf9b6474c49258b2d4bae06a68d80bc58b1b29b5887
-
Filesize
1.2MB
MD5eef820f9c80639523709423ef2bc147c
SHA10b1db47a8bc99239a7d502c5e1cf2ca35127cb4e
SHA25640a832199e8135fd502ab011f65196efbe237047b17e15e8e223893376d0030b
SHA5129830283408b7ad296180949cf492a980369b7309e9f12621d6f0e6816a182df8780a2ce3598121e05a23bf45950b484898c8b1389ebbf7fc14ae8e29b1ac90af
-
Filesize
1.3MB
MD5ed5fa3128351024a4d39c9ed659407d1
SHA1a24e7d6540829dfdeef276e05aca71a7b747b24f
SHA2560e7703067d04f1c891b8f228e681764b0c3c0984cfb7be4a0f6fa6b1c2efacf7
SHA51249cf82ffeef7eed197f1ce2d071fefcdb49890053a3c719e992e84b903b962dfe735b307e03c11e438e1f4db5c2d339ac363f3ed28ae8fd21ff9e2823ae3523e
-
Filesize
1.2MB
MD5105371366dfeed7fa222509a6fb11062
SHA1b54f528c3285c9e6330840e934ffd776017b5402
SHA256ae8299e2df1519465e4b099a64d8ad69c31b13f94c53bb9b087966b8aa60fc8c
SHA5123aaf88292049988b3519fb55f1f708a393e186d4148baae267f4e1151c113099584f63639eb2851c887e5dd6fe51505bed8526d7ea8f17707be39cc02961bbd7
-
Filesize
1.2MB
MD544ad8852112e7ed3f74cb7aca3056800
SHA180f3aa2def812a41b2133f13f4d92d198613b3c9
SHA256031be7fbe4b4aaacccc1a0c862d347d4db65a60b9a8abbbe7b78a1ddca087b87
SHA512a97b9bbdad6aa37966f2e3b2c29afd467f1b80f93aa2cad26da14a8954d513fef14c108d7e51d5ab432525fb5072927305aafa2d3077af89b7e6df59a0e9b6d3
-
Filesize
1.2MB
MD58bff21a38d1495d5df4b009552b535c4
SHA19121a3bb31918e08cc74fb310e1b4407637ac4bd
SHA2562aa766687a7e7e45c74902cd1724ba8355aa7a3c83f37e1bb50b6f3123a116f1
SHA512f5f65b2a2430e637e49a15d4b149e81219208abef7f09ff7c1387a8833fbd70374df2f3b8d534635b669cb195e063a3b693b2bdb63691dbb047759a090be0193
-
Filesize
1.3MB
MD5b353970c49e331e1f751a63861ecd8b5
SHA151e3c0065a92a3da066bf2cb19ff6846698032e8
SHA2567a2d31d1cb677fe361231f0c873f4c557d79c7d3a5cf5ffcae73745badddf0e3
SHA5128edd7660c417703977bbda0d5cada08f8dfcef0d2b99bf853f2edb10251628d7f0377e0edeffd1e7d7c16437e5842260f92a6e702e823f0c9e45442adfde3c98