Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
24/04/2024, 06:14
Static task
static1
Behavioral task
behavioral1
Sample
00d1e39baca50fa253fcfe2c34e52ed2ff249c130c007643b8b3a717d7084699.exe
Resource
win7-20240220-en
General
-
Target
00d1e39baca50fa253fcfe2c34e52ed2ff249c130c007643b8b3a717d7084699.exe
-
Size
1.8MB
-
MD5
e3781e152164efe289807768d918cab3
-
SHA1
2ff2eb39391eb204548a1268d7c5d5fc576dd4ed
-
SHA256
00d1e39baca50fa253fcfe2c34e52ed2ff249c130c007643b8b3a717d7084699
-
SHA512
2716369b17d19405cc85044ca5e9e1c41a06b89996bbf7e8dc4673ff50eacc92ba0acbf57236c26a0c8eac1e990423a0fdd288d0d71b83358d697d4b25903c72
-
SSDEEP
49152:Ex5SUW/cxUitIGLsF0nb+tJVYleAMz77+WAb/snji6attJM:EvbjVkjjCAzJiEnW6at
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 2528 alg.exe 4868 DiagnosticsHub.StandardCollector.Service.exe 4640 fxssvc.exe 3576 elevation_service.exe 1996 elevation_service.exe 3996 maintenanceservice.exe 1516 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 00d1e39baca50fa253fcfe2c34e52ed2ff249c130c007643b8b3a717d7084699.exe File opened for modification C:\Windows\system32\fxssvc.exe 00d1e39baca50fa253fcfe2c34e52ed2ff249c130c007643b8b3a717d7084699.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\dc02abd8b3e2edcd.bin alg.exe File opened for modification C:\Windows\system32\AppVClient.exe 00d1e39baca50fa253fcfe2c34e52ed2ff249c130c007643b8b3a717d7084699.exe File opened for modification C:\Windows\system32\dllhost.exe 00d1e39baca50fa253fcfe2c34e52ed2ff249c130c007643b8b3a717d7084699.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 00d1e39baca50fa253fcfe2c34e52ed2ff249c130c007643b8b3a717d7084699.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Google\Temp\GUMB759.tmp\goopdateres_uk.dll 00d1e39baca50fa253fcfe2c34e52ed2ff249c130c007643b8b3a717d7084699.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_156609\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Google\Temp\GUMB759.tmp\GoogleUpdateBroker.exe 00d1e39baca50fa253fcfe2c34e52ed2ff249c130c007643b8b3a717d7084699.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe alg.exe File opened for modification C:\Program Files\7-Zip\7z.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_156609\javaw.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Google\Temp\GUMB759.tmp\goopdateres_no.dll 00d1e39baca50fa253fcfe2c34e52ed2ff249c130c007643b8b3a717d7084699.exe File created C:\Program Files (x86)\Google\Temp\GUMB759.tmp\goopdateres_pt-PT.dll 00d1e39baca50fa253fcfe2c34e52ed2ff249c130c007643b8b3a717d7084699.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe alg.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe 00d1e39baca50fa253fcfe2c34e52ed2ff249c130c007643b8b3a717d7084699.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe alg.exe File opened for modification C:\Program Files\dotnet\dotnet.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe alg.exe File opened for modification C:\Program Files\dotnet\dotnet.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Google\Temp\GUMB759.tmp\goopdateres_de.dll 00d1e39baca50fa253fcfe2c34e52ed2ff249c130c007643b8b3a717d7084699.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 00d1e39baca50fa253fcfe2c34e52ed2ff249c130c007643b8b3a717d7084699.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4868 DiagnosticsHub.StandardCollector.Service.exe 4868 DiagnosticsHub.StandardCollector.Service.exe 4868 DiagnosticsHub.StandardCollector.Service.exe 4868 DiagnosticsHub.StandardCollector.Service.exe 4868 DiagnosticsHub.StandardCollector.Service.exe 4868 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 668 Process not Found 668 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1184 00d1e39baca50fa253fcfe2c34e52ed2ff249c130c007643b8b3a717d7084699.exe Token: SeAuditPrivilege 4640 fxssvc.exe Token: SeDebugPrivilege 2528 alg.exe Token: SeDebugPrivilege 2528 alg.exe Token: SeDebugPrivilege 2528 alg.exe Token: SeDebugPrivilege 4868 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\00d1e39baca50fa253fcfe2c34e52ed2ff249c130c007643b8b3a717d7084699.exe"C:\Users\Admin\AppData\Local\Temp\00d1e39baca50fa253fcfe2c34e52ed2ff249c130c007643b8b3a717d7084699.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1184
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2528
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4868
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:3164
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4640
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3576
-
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1996
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:3996
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:1516
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4440 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:81⤵PID:3396
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD55e1c137ad6e61a57ca88e4bad081efc8
SHA1eab2dfe46ecf6cfb7eebfc4c66ac2eb65a53521c
SHA2561cc071b846497ac844feea4cda8b8e291c7b1965d758ee283eb3ce33f5dc8b16
SHA5129bd7efc8a38404c669a3916b30f15d27956e75e77f3eba5c5b8850680075a85c88e0f4cba9be75a698b20e4f1494ce810f657e1e309dca70a848f1cf7ead6ca3
-
Filesize
1.6MB
MD547a099d25f3ca861a1330d306906befd
SHA152147a3c64f62cfbd4b026c64d0f276a3337dc0c
SHA256fbeb584295423e97b23161d3bdce48d6fe596b906b2b452abde84ec42316b53c
SHA512d2a385db89ba8fdbd20e9b5fa35c853e0968ccd932a97cec6a632d3c352659a35ddb6e65fa1934d83c27e907d4a53d05d1bc956e2b1b67a4e0dbbfc863b99ca2
-
Filesize
2.0MB
MD568eb107b5faeb12656eb252aa8d3e8fb
SHA1b262968dd0c821ae5b0ec9d9bd56d1bc82e131dc
SHA2568d08ee4ebaa212c3ca62b46df281ed37010b908a28a5c2b84a954ce7f818b9d8
SHA51285c8e4b5daa46bd3312989d5b5d0dfd3cebc3673fcea3ae6c69542c1b26efd7a40c4f85adc75468955940dd30c6b3b269208f6ee1d4ffab5008260ba23a37ff9
-
Filesize
1.5MB
MD51e49eee4183a0e5c0a29f12b108677f5
SHA13dc19cd56e7dc3889b267482af4d2167b9049d3e
SHA2565af4dedc3865c63ebc3e225ada2d66a554597a591476edd9eba8a4c9248d5a45
SHA5125681ec0944e26cd5ea8efba0bc146445420f05603a86b9dd9a16b3c9455db151b94127fe7d7605e15ca02d1b75ce4988290b5b9d90c4dedcfa931903e5dbb65a
-
Filesize
1.2MB
MD534918c6ebf4ab306493a1dc4cace17f0
SHA115a2c3dc2c8e5a5dc1861b258406bbb89a6d896c
SHA2561624356ffd06fbb5bad54c8be4e9c90d45962981333b8b7f0fe4e06cf8ad47eb
SHA512eded8b2b4aa626e66b670732aba835d46870186cdded0f76454c2dd54d377756b30cabe33d4b4c38ea068ab45a22d29a657e595aafadcb5cd03f659865acd802
-
Filesize
1.4MB
MD52ec31a91b0206a0dc66a9c24f8061158
SHA12b8fccd1f9df14d4fb6e37d0c049fa91ec501be7
SHA256c25862ab64f4852268e05489aa269171cbd1a636f5027d6eb61105a65d5b6980
SHA5122df584d3067533b7a238c49e8c5bc98fcd6be2efa3a6c8d88b29718adef7f0467f35b946c158c97c7e695e90250ad607ff2529e6a647739538aa8f65c3ebef4e
-
Filesize
1.7MB
MD5cdef262bf7785e83541dfb6d21af486c
SHA1d8beb84972f489af4ee3fc2e5f9f844ebf12d825
SHA2569e3d9cbf9cd25cfe4e68f1182850f9c078565a396c0acc4411e826929222748d
SHA5128c9e81f380aed565127eac50903c8f50c7494b45b41ad584b2c4a4014f9fda09fbbc735974fad9ecb84491b94203eefdbb7754996c2d03428342efda57aef0fe
-
Filesize
4.6MB
MD54b600e321f992b3b43cc293ca0710fc1
SHA18dd8832dc08156f20ac3116cb06f5d5d89e017e6
SHA256812816e793faa70f2b3e09969cdb579a877ee3f693ee8ca59f1a7d9ad1157b68
SHA512f715ee33640054133eff907eb6d5b1d2fc79f9c596acf2fcb88d2ef75c087a1de0247775a22ced79deda524ad45d837ddea94ecbe1bb9e436efaf56bf6a7d6db
-
Filesize
1.8MB
MD517d0a98d37506bcd1b76f388560a3f49
SHA1631fd395a0596d342900d28d0f1368937f1dd135
SHA256b8151545ce0101094b8b8421678b39a2438748138d82df2511f832d29bfc1ca9
SHA51217d3bbee206f01fc2a91a962d99604ac290c2232fcd8b1eb94b12f52fa3d3bfce098fe7302cf2dccca1e2976a3daf7e08356d78837ae4985b905328e7fd99a4e
-
Filesize
24.0MB
MD5d5e6450bb98f2476c085c3d1d917defb
SHA13cadc441e3cf39208db971282f6aa9a87cf29b94
SHA256b31851dd89fbbd1c833e04247668e6c5d39b0351dea71dc3f04f552a94064e78
SHA5123ffb843688d1f004d6fd8ca15978b9a7f9c77d0581400900e71efb617d75459fdac9c3f7bcdd589dc144a9a33fa6b37966941ecd65fda71a1b592ed2dc51cabb
-
Filesize
2.7MB
MD55350241cb2d2f0404b719c1a0eedf01f
SHA197a29e56462a4de014a6c6f3f77ebe3cbdba26d4
SHA2564e2190fb6c81be6bd2e01bbd20360b8cfd79a5f6d1c9a243afea892e71740f79
SHA5123a955b0e6ac80c1e5a0550ecd18cda9e924e85abb8ce54fb999b3b24219531d74d72f7d7ef5b25159448572a52bc4d631cec9910a95ca4e720363a3c89331270
-
Filesize
1.1MB
MD52a47dbf2c409679b1f9dd796bd635062
SHA1954968cd7cbc7bbb82f83bcd7f8b8608d9be6eed
SHA256418fe4464e8c988033c885a0c2fdf201e134d75a1889dada7fd7d6ca81cf8c6c
SHA512b25b7fc08aee013714f67d9dbc3a79743d6a7dc83e08878b2b196a1c8ec016d20f9c50ecda2ac1c6c6ecee4c1206d58ad68233685ea330065cc4d778a3959fbf
-
Filesize
1.7MB
MD590e3e0891b32759c7b02677c7ce15b60
SHA1967eeba2e774b67bb4c4adb77d77cdb947cb8819
SHA2568b2aafba927751b8f3f2153ee5d2267f2fa752d60d9c63da8f4e1c38259b9b8d
SHA512fdba1753d4e3701a6601fa5d3531840b061d1478052a31e1d891c31d5e39572c752237517cf23667c8a8558cb5fb60e91e7c8bb170b8eb85c4ed537bf39a3d70
-
Filesize
1.5MB
MD52e480781a7dab1b502aca8bed7fb2d8c
SHA15f990edcbf826b307728dcbc52f29755401eb7bb
SHA2561f066e0ffe36fb165b8cdf95c265e3cf73cd6b9c42402c7f4f59843ea674c1c9
SHA5124c225fd700094556417cf1189260c31e08013fed88f2609ec0f14cff3489c75d2b3e7380bd20fff4c4d18be9a157e0c188c0cf229c70e50a83c35de0d74b5bbf
-
Filesize
4.8MB
MD57e4e819a1d8383c999d1f4e7557b1a9c
SHA11cdd167369208f312ba716fdce422317c2504da5
SHA25652d18f965931a340ce7f157f6199ac3c4559fa984e1f646844f46d570b99102f
SHA51256d1b78ccf9c8814f0b26d39c21c184151e6ddeef219ed343236ba5bb9ef32441f6eee3b64c51193685c395196fca0db96186276570b55c1d14ce9fc520ee288
-
Filesize
4.8MB
MD58ebb83fe1d6d923f74b96645b07ae3f0
SHA1191c0d6d9580d285d94b254277337e8bf5f32e2c
SHA2566b57a6a6e83bc90e6330e2f3492c39f38cc86a6b95e9bfabf72c97aceacff4fc
SHA5123a925f8c453bbd10953d5a4186c3156c30e8b0c261e34d1400a4c204944407a362255d14640c2ea63453e13899a509085abaf39b60796fe23c462c6abd776d62
-
Filesize
2.2MB
MD57f8f733c57fd1b361d448792393276ba
SHA1b089c7da2aebdc0ee29967917d733f26b859e82a
SHA256b7950717bc920e6908c00fbc9ac88aaf08286e2781ae3f1ba5797c6f0d539170
SHA5121fca3da55ecb26d470c78acf9721d79b0c052edd4791159bef77c44cdec176b5c86454053da79cd4fc9b449c1677f4605531a48c4fad75796f6c43f3b1cc91fd
-
Filesize
2.1MB
MD5a9eec60bce40da7cfd1cd9512a8e8a5b
SHA1f54d55433cf3bf922bf3ce8b41f710df0f5f0888
SHA256b7aea9f932270ab9131c3b4a33f61eb516cdb389e29630006dc9320665ee9f06
SHA5124431d120f83174dd5ad50d2662ff41bff752dcf6747fb2aaac5ec8e5326a870af5512d5985793d5d5f77fb7d0c96f2abd5bc834f3a48067b58adb1d6438be7d8
-
Filesize
1.8MB
MD51b736b9f277fe401f54320a45c5d5c0b
SHA14ba49b2bc2f8dfe439a756ce7dbea6be0abfef70
SHA2563dc9f03d03b1a315dfce8ce66c83bdb7affab1fff07188528dcafb8e0529cd6d
SHA512608963ed06d524f7a38e54961bdd6af17e598413eb8b3550b49f33e8588960fdcecc7bb3d1b56979cea3d36efa80ba938c9b364bd0172ec7fada725e99a342e9
-
Filesize
1.5MB
MD5d54ab5b981f6dc8715792a78acd6b752
SHA18e633aebcbac902d48f6bb6795b48ba3f186acd8
SHA256cb2b0042b5713aa421216a6e7ffe7f9f962ef69a0a492fd9f4a075d3f29e3a65
SHA512baf0e1b4331a0bd00d85bf865af18bcec4ea40a4c872828ac087d8307e41e3fb5cf40407c2718a05c15ec5f495ca31d364a51a256ce79c7750b1212da136052e
-
Filesize
1.4MB
MD58d77b7a64b7083845c11bee584380c32
SHA1b42ff26b19b1850bd233647c9453bffc419d6c7a
SHA256db58597b267de8e8f8017b3663206120f39dfe76f4931f89129875772d1020e4
SHA51220ea6b5b7f42f2fdd1ac3c14800d48f22c45721f5f460193d753cf6193af14b544fd754f82dee64535103a0b609c34fdc7ef580cc57c04ae787e21172ced23d0
-
Filesize
1.4MB
MD5c4ad8c96494cf75d64394ba5c485c765
SHA18b6f3b366747b14becc2b85a488cfd3efad0ccab
SHA256be43c2ac1cc862adb41e9d4e1ab20bf5a8627d610dd6d93748a128f967542a49
SHA512e5f87aa2994224b36bf5cbe058be82a0f74916f9e7244b615cd3807ab5b19951fe8116836b9009453d0a587f60ea854ee9c070ec84cdb119b57f47134ae003bd
-
Filesize
1.4MB
MD51a29ccb7e2827af6c41ef17d7492dabd
SHA1b50dde5142990d2ddd4f79a2b5dc513030bf3e44
SHA256b22fa1cf67be6b12346919466be7474cd11636cd32ae17686ea80ad46bb48355
SHA512b808b30323b8cd03e66e5eb87a6e5dc80a7b1d132720eaf115f38a97fa73be4cfc190ed1375773886f55f7a9729ae1a7c871fabfe196cd94c7bacb0e12c6cf07
-
Filesize
1.5MB
MD5a155256228d8a919e6e406d203ade46a
SHA1376917ff12d02dc71f979d34b433792fb256ac98
SHA256913df744c76d7422c9854a3d2152c655941493a682e26d646eb6c1b3ef8bdb5e
SHA5126aca584a0bd7534906c141407d9b65f02d00e76741fdff0d823e11855e771061d5127a49339906aad43fdc03e60194b6cfc8c457ceed12534c40cd166b75d5ff
-
Filesize
1.4MB
MD536ae0d1c10409457da56e27dd71fa1a4
SHA15e602fdbfbc7107fb1ff4d3e6403d397bc4bec5a
SHA2569ca5d11d322ae05a52ba0ef04eca7d4a2294e90197cc10479e0f85daf8af22d3
SHA512b6c1829790cce26b4aa0bb052460dd0e151c2e6c150c9512c372bb542df1fc3ffb785273db43e8cc26d0e6d8412fb2ef249cfd7b3e2c5f2669ebab13552cbdd1
-
Filesize
1.4MB
MD589fbbf3e5c9529574d1680e3e23f23df
SHA118ae50a7f44041ed498eb2a183b1f95dee105a78
SHA25633929c9de0649abf1bf88d038f8e94e6dc3c7ddebe55d9e277cc829cef985d9b
SHA512e5a839d4a869d5ef801fcfe80f5c51069f69901f62bdb9bb42d9a9da55d89b6e0079eb90342f401a9f995a2b2bbd3dc9e2f3351103a1ecd6db22268379e6e4cc
-
Filesize
1.4MB
MD51a4ca59a7aff334354c0229a5eaea3d5
SHA1af098e28e5fa1f4ef4f94782e78f5023e219ce6f
SHA256c61a05e7e4f462ccb178b3367a38e98f0dd34237835c5e0fbe2ffeddcaff4adf
SHA512648bb2e3f2c4b7e8608225af90ebb28631a0349fe69078f96ea5f0f0397cc5458aaeacb0c0c0425492acafeb0de22622f2b6f5d7aeddb9500cb7f132f5955b87
-
Filesize
1.7MB
MD5d9da34aaf55a1fab83617160fc5b14d9
SHA11fcf1fb6b89c9cf432759af503247ed07e3b252b
SHA25626672a329466358cbc0d53d0f6f5f8732af43627b8b4f5a6164d2d192ff8746f
SHA512eb7728b605bd89f291d900488d194a38f645d8b0041a85c60d979b339dc8c0b0e2bd4ee102840744f277daac561299cc156e5d48d2a9f58e91a0204eeff7a8fc
-
Filesize
1.4MB
MD591ae0be904071a18b50ba6f471125490
SHA188b63de55e434615044ed7d03b1148c33129622c
SHA2569a099a0bbe88e3c41b6f8d61736b88d15f2d94ece684659bad63e545f69ea5f8
SHA51257a39da12427fd0e649ef38c2c1b6007f18b589902c824627fceb1a63a6230eef192ba10ed1846eba2b075748a9b1d8a83b5877b582ac1035adfd1539bb004ab
-
Filesize
1.4MB
MD5bffe509a86533f4759fb925dd124efe0
SHA11d4f8c0f53e73246f5415524a9a841bd9314126d
SHA25693c3daf147e9783727ef17ca831cab5373c03e24a328573173be415e6739131f
SHA512442671a8149927b23353188e7af0e2ed1c91295f1ad9bfda5c239494c60d411e44ee66a66181408c2c75edee8c5538485e0d2d5a144269039fa3afbabb5b11b8
-
Filesize
1.6MB
MD594f0ccc1e46c822fa5c2703c027b4bbf
SHA1de24a5b83d97a4e5999c0166f26ca1d9afb2de6a
SHA256cb37030d9d497086530aa4cea3988c751f5014c8c7e4e29689904afe39f540d5
SHA512d966edd478d4a235af83bb4119939c5a20f37407ac21c26b0bb3e9b548df7f43f43ddcc1aa06d515743cf10b0d2d1fe101d48ef7696cf15fe79469d6701a2bb3
-
Filesize
1.4MB
MD5f710d420acee46a12a44fa4781df6c4e
SHA1f421d752bf9e161e43ecee7eea05cb7633fec7a4
SHA256132c1680ad4d957cff6916a3279551e28953b781b50ba447c52dd712c12bc8ec
SHA5125670ed12375723f9a6875eec1a766e0e7709f06b1e3cbd5b1440e85be43f44b2122fc5fb418774ac0f258b4260a49eb593863d393f8a980a17f597db4f9289f6
-
Filesize
1.4MB
MD55012855aced0a6ad495289fbe1d2fe28
SHA1eb580da3b1de57f3a74054d4f4981aad83558761
SHA25620cf09c82b66ad8f5b49b2db511f687dc32036f31d648a9a98d2a5810111641b
SHA5127cf65b411060daa8598adb72678bff6b9256076013e5348e560ebb1747e9446ec42ae5073828e208b02f3fea066f9274be065da6603e50b9a003f59c9c8543f2
-
Filesize
1.6MB
MD5a0c38889690ab2ec688a2945080de2b8
SHA14760ef60907f4cff5af2751328c14da52d1b8d3c
SHA2560a0859667e12c23b88e7fbf3f54f06ca45c4f2718ebae32a43947a0a966f17f6
SHA512012ed4be045f0e1a207c964f0565fe9e5e93a110a809dbed9b46c5e61e36c6243dea534168baf39ce5615b9b6a81d72ddc30101d7ec0f336371c3c29cf9c4324
-
Filesize
1.7MB
MD57647950fcfee94ffcca2cf081970ced4
SHA173ecd07f9564516a21cf38197eb4cb4f91773642
SHA25676e918739e164b367d887d185765f4b4d645ba5d90cc672b10824e47adb15a95
SHA512e32b78e2d687caafc18133e0a2fcdc447e11fa3496fc04b5628e0d6e9084aaeacb1cf2b3574e00fbd3d97c9de954563cc7e9248f5e4f2ee751b3b6d2427afbaf
-
Filesize
1.9MB
MD5e3e599691c0d3ee599320e0a3c1dcbc2
SHA12b94ebea1321ace842cbb40d3215a4e1762f605b
SHA256be567f8611d6cff5224d28224cacefafded2cdc9f8e996b908f0c00cc7e42d79
SHA512befaa725598262537f54b42ee680f36b9c396dcd4e5c884860a2568ca1e89e2dac98415f7950f274b0966f2a86265d0383f346ea9915732e1a7606261eb632b5
-
Filesize
1.4MB
MD58f7812ecfa9c06194cbbcec2aecead23
SHA16033d54b528bd7533617991f8fa963ffce5b743f
SHA256a4bb7758d5976c476b16024d8ba816c0af04acd8ea09277935f6a195c99a542d
SHA512502b978b7a7983c3bdc7e7cb04ba42c11786c12887ec947f16758de5c479d71c5e27c18dca63e2c26c46fb6fe3f55f1308bc67ad519264cef0d979d09b0ace8c
-
Filesize
1.4MB
MD5746f1558804619183d2e1d4a38e9a1f0
SHA172b634902ed81fb9e28e41c6e32ff90e4c95a9b3
SHA2569827eeeaf627a6db327c02edad454ec23d51ef466f7e9989f92143fdd9e951cd
SHA51272bcbff8d6487168c6efb2de02845ee8490858944d97b8bf7396446ac4c70db874796113e8cd154cb4cf35bdea23d83fa5e64c1e564c04c75900c2c3abc38058
-
Filesize
1.4MB
MD5286f81da63c3bf0439539dc15fa3a7c4
SHA19975ae6e757a60407dc3fc0294e0a61d9cf565af
SHA256098537c9e0c13b72a9f0418c914063f86ed92f772704e1414d1e436f3d400bd2
SHA512aef29c6330a4a7cd17fcbff5f535e7faa02989316731b047210762cc63047e5a06165780012d297de029cb83c7fb7ed190a3d1bd850b4756b9c6816c80b08950
-
Filesize
1.4MB
MD5f7a9c9d8a904acefe36fff65bde9fa56
SHA136ed31454d90e20c83c77cdabd8864472fb8f2f2
SHA2564dbf0f62ab4729cff05c34bbd171ade7102e92524a14ac94f9308eb4d337e107
SHA512e97b238e882bb11ec67c5024216d7a8579f6fe9824f2a04f36574716d36f8763213e3d7194d05e7db458828184cf9b90ae12fdccee09f794cbeea106935827c4
-
Filesize
1.4MB
MD55f2939106d69b251c8820f023f35d5b3
SHA1881de1d6354a933f65df64e4327be7368fa97ef9
SHA25681c0091da31f73d23e20871fd1ed4009a0c7b4bf8b526492d7e70b8f0ebd8a43
SHA5120361439b3e55655f022415aa422798ad9fbcb05c9784f010474cb1f8736e1a55b17995e9a2ea67e9b9665829be12cf46df32ed5ec3c5784fcd03368b46ddeed6
-
Filesize
1.4MB
MD5607cf0b92049963b62c62d12b225f780
SHA1d88f2374603d24d642e244a13e4dd177bd351a49
SHA2566924d2c7d119f77bafe4efae58d863eda575c7839f6adbbeaee0341644af5c4f
SHA512f8650e424c4a471491e49bbafb7ac70a3ed3dad840a87c0c67d18b3aa21debd2a34c105de3e0f401d26a6d1a14750a477abfb87366a32b3129682cd80a8915aa
-
Filesize
1.4MB
MD5878b3b8469aefa6dd8ca5e6811ad8cda
SHA1fe4b221cbc429390b9af05097a9eab9e54d6e302
SHA256c206966649e7061dea90607271b97a80c2f74c3cec097f88a2096c532b0e92a2
SHA512f639abab02ee5d0d3d4c921b2ae903ea2c6849ce1c57c352a01bdc7af5b5514164055cb073ef66a5087427cdf4b8375c9e236ca282c134fb8fd2f14f2e221489
-
Filesize
1.4MB
MD573d62317cb7a209273b7aa9ad409af55
SHA1ba33283742f8cefdc4ab602652972ebbd298be28
SHA2563096f3c953b2d70fb2498e63726b0e1e0388544a57e09c57d850d33bc41f2c4c
SHA51281bdaabb24c9436b3b392dcd25c498ddde7f206271fd7e8d4cd648f794fedbe234ef67281436f2f1ccaaeb9d679ab6af66163246a970d3830c4edb29ad1cfd5f
-
Filesize
1.4MB
MD54c14658b17ea6d60e25a5ba7e2952c92
SHA1900636c91ed8e46d431a20bb6ea2c0ca7d20780d
SHA25622ac2ad9a41e29e6103e2b49cee7b41e64348610931697c15b2748d46a8f29fa
SHA512bb90d0aa463a635c1610c3fe7759e89c0ec0a27bf8f3e0761139b8cd118c91a049999543b56cf3d39f85104996c751a60e61914ebcd3a293750e85cec12e3de2
-
Filesize
1.4MB
MD5c84114dd14ae8cc8c68fa40e8c193ed1
SHA19dd7e3815937423ccae1fcba8b98b8ffae9ee338
SHA256fd4720077895e7c774a697e07c8de1f80eb92574e44677ecf0a58008356ce171
SHA5124c4da30cd734ae1c97e4af25a2f043d90ed018438097d7ee7eed7e16c6bdb9779ccabaa219a83cbb4d28de2d9709d27a1e0c63eae9ee5b59d1cb91fbbac6d65a
-
Filesize
1.4MB
MD5c98a65508b5e032ec64cf074daba188f
SHA1ba26c116582d0de8ea09a1ded4b363df5e4230ec
SHA256bdb5b1a78881916613227b4bd043834961ee967f4c26ec96580f39379cc0b209
SHA512d7697db2a697dd324c094c3c3d8e2f08ea2d79a5a8bba3b24ea93735be090187d22351c10e68a81bf70708b107bc384e0343aadd4e70d76beff3e439eb5d22be
-
Filesize
1.4MB
MD5a2043064aa5871e096180d3a467e29db
SHA11280343d6050c868fb2b5262585805751996f9fb
SHA2563110d0670464340555b1e97927d44cbbcc41bee75c3a9700cd02dadce3507041
SHA512fb2d2ce02952a2b0b8a23cfcc756097c06368a8abe6cb24865066c1245c57ef3f1c9b28a4911647cc11a969cd15b426465597b6d43d9ee15f5ebfc2cd9c4b6d8
-
Filesize
1.4MB
MD5aaea31d3e6696272529848ea78defbfc
SHA1639aaa2834fec0c377077029bf4f628fe22b37fa
SHA2561856b0eb10d77135436542db4eb5c8fc28f4482293950849e843d8909ed34784
SHA512721fa9f0258c670b7074668a23e2ef439ab949f2385712c10f1903467ba11b94ca6ae7d5de6914e93d4c59f0945605a973cef13db2f8047255ff8191ab4b014b
-
Filesize
1.4MB
MD5c58f1cfdffbc2d1a4d1315fa562f87bf
SHA1294c1ecf29f8810748d47e74aa49b0dc63c6ec79
SHA256d7703584a943f71a04d3db2f87ae5e837d76b354f5aeae745fda7e050d305948
SHA5124fb8bd54be471625097075e8ac297f1055393f6629e1de45523710b14228595ead6d85a05e7beb83e9dcb8799ba27a332dea4a9e4f0d9033531a3cb4a6b2ed6d
-
Filesize
1.4MB
MD5c087824cecebf585591ea67b97ec43b1
SHA1825b7ed6a5fed0609887e5ce6277daeeedf1c936
SHA256000ea94e37e0c295fe66e2c28add0a98b6792dfdead4b3290f816d077f4c8d6b
SHA5124c7c6485d4276d8c10fda143a167048f390b6d9839b2e0cd365279b86895ad793f499718c603689fefff394d9f51f6e4ebd6e3347405734b837bbe051b383790
-
Filesize
1.4MB
MD5d62ff7b90b3e6862e5adb7a781df79cf
SHA1d90a967e148e67c748051807b5517d8475b02bc0
SHA256441b76a2ff1cec0ff0c2923745b1218b7a57c6f6814741c516a82c9876363261
SHA512bcd964da661168732a644b780d0d05a2602904d56e886896bd42523a9543c2b13adbf4aaed7424e764cc50c6139a92813d7305a7abb059dfb28e6d7361232e83
-
Filesize
1.4MB
MD53ea221f8986c5d73dcc5af7f6bfca9e5
SHA136866efbdf6c97fd5645f55fdba6fabc5645edbc
SHA256e18d36ab8004944aaa9c400c2924db4ffec6437e178c47a00638fcb5875da787
SHA512701ffc084fd3a7e6cd169818e37183ce530aaa14b2be50f723729cab566f658b8fd6d07c851edaf188dc7a3ef643220fe893984075adf3c13130f8abcc105002
-
Filesize
1.4MB
MD5edf9011de218b1b18eac782cd2a97365
SHA1ef85e6d3e630ab6801f4e8457bc38e28bfc97f50
SHA256fe29a5a8655d6630642ad1f68042c22520a3d819e4f274e61448ea8f7c7834bf
SHA512acd8571aa82c0159718869323e7008ff731b91087a9fdd6a8e329534598fe1987b2fe7e610f1d8b393608ce00a6ac06f8e480bfbba57c2338e47524c570d463d
-
Filesize
1.4MB
MD58b63864841f1bff99db532fc36673e53
SHA1c0e516e98b42c109c4ab0da525e51f8e100f954f
SHA25676ae285f732726c243d0fecd3de60cde54ecbb71aca1489c6a2336c8baedf2b1
SHA51266ef21126f9e2b691402b298c914161260279d3b96ff01615adc635121a3e0128d9ad6e83979cb3d57b256031014992ebc8039a16c069e067f3e5ab8c455a7f0
-
Filesize
1.4MB
MD567098fc4d613cbe4c7f262ca51aa9736
SHA10af9767bfe0451e2cf7924591994c92ca98a5996
SHA256fc48d3fd8b453e034925f0548bf878fcf128d15c3355f0c6de92386f97469d66
SHA5128f01242634f943246e8517b44d68c403ac56191ceb516185c6f9121f6671d8fd74c092eb7b44714650c7e1efaf75f2e3ac86d3cfd8f042f38538198f97b588ec
-
Filesize
1.6MB
MD5fb3e9a5dd10fd22c67d48f5a211a069f
SHA10a294ca74dec55e2832a5a697d53e42da5bc4924
SHA256fc1a9812860fd36a3eaa003c060344fddfd1da3162390d601137dd0ef710fb52
SHA5120f70c6b530d2e04886feea025c5005a4bdf7ef83373e2426ce9db76eac1979dd37e7047c626ed9bb0a56fc3a570c3a6abfe841970a9fc3330d1599b4b0b196f9
-
Filesize
1.5MB
MD57415ea2b86344fa7a5540b70a91a2c93
SHA1d9f116b10a8938b4831c5c8806d006f7f028b159
SHA256b5a1c5143239af33b9bc36c2367dc205739c397c171b6403bdb3bc2ce342f6d0
SHA5120bb90353a104476a86ff851d6a22f510db98bdbe4a325ab9d7065bdd8af35cef9baa400e1005b70c61d38d62bc87d73e68e4451739297a19776406ce4918105d
-
Filesize
1.2MB
MD5b5f801f91ed9665823f2fc9914c1b5cf
SHA19d1279a77d5a1bb546f3cd717d9be42a36ff9b5d
SHA256f28d2e91ed5f185a0d6aa596c597288ccfaaef320e8c3ec925f8d2e5ed73d34a
SHA512fab43159cce2f7ec71c478382e78394bb196a2c64617c02973256afd2df7da66e13b570fea117c1d837d519d89305fc7ea0eb57907f1b924700e91b0434a8fc3
-
Filesize
1.5MB
MD5478e0c46154d351816a60e2247edd25a
SHA1f90c91584959d643e1fd95029c0fe697379f8a57
SHA256a649c49318b507747c59248cf0a228361aa297d49dfa7b69e328edf38bb0d855
SHA5128f621e0655d05ae365428475bf07045dd3d47cc6b55257e135f85308b20a8dbc36e59c8a502ff8409514445f959e7dccebba69c4389793d5ab0ce64bd50ac9b9
-
Filesize
1.3MB
MD5363f904aeea27536c8bc991505a9aa7b
SHA1cba0ccb74da8369d458b965c0ec46f6460500014
SHA25647a0b937e9821c84c7e145c13692d6e12ff2d37fd3a777133f45aa918203528f
SHA512e9d3baf202b5fc5a4e089c671f1962e2a3b44da8dccb688fdee7a415cd61c7ba7edbe101b76828f5339d1f7fcd4dceba67dd15a229ce91939e00d8b9c968324b
-
Filesize
5.6MB
MD5f7ecce2dc285b27f225db84d9acdc0cd
SHA13dc618d69338a866903a6036985f81706f540999
SHA25697f45cdf26356bdf267cdc4942bb6a7a8c5792d982b61b791fff73d4254682c8
SHA512d3b8915920872c4313c579e5c544d832194ac71c6b27c099ec1c6d71478efbd1bbf1463e33e16460777f5356848669e451d602e4ddf2aff200eb52fbdfb1fc8e