Resubmissions
27/06/2024, 12:05
240627-n9aa8asgnn 727/06/2024, 11:13
240627-nbm5es1bqn 1027/06/2024, 10:55
240627-mz55gazfmj 727/06/2024, 10:51
240627-mxybvaxdrb 727/06/2024, 10:10
240627-l7bp6awape 727/06/2024, 10:00
240627-l1435axhpm 7Analysis
-
max time kernel
105s -
max time network
107s -
platform
windows11-21h2_x64 -
resource
win11-20240419-en -
resource tags
arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system -
submitted
27/06/2024, 10:00
Static task
static1
General
-
Target
setup-program-jpk.exe
-
Size
141.4MB
-
MD5
6d63cbd3a38407394a5e4226dbf652c4
-
SHA1
b79445a99db3169bd0c372897ec474b1be7ef2cc
-
SHA256
075e3e1097b5a6376358f94fdda63513aed5c88b67494f23c1224c2dddf38f63
-
SHA512
878d5e21b204bca2d921d16552202832d6287e30cfb024bd84725a44fde40fba342b3366e9992d02825d320c094e824048026c8582c7c46355e3a34d3bc8d6fd
-
SSDEEP
3145728:tQqSfallJBxCN1GPUFmkVeuMAfpLziGyeAuAKWqLqT/Abhmgk7:tvSwvBxCN4qcxAfpC/eTI4ha7
Malware Config
Signatures
-
Executes dropped EXE 5 IoCs
pid Process 3636 setup-program-jpk.tmp 3952 instsvc.exe 4956 instsvc.exe 1008 fb_inet_server.exe 1488 Program-JPK.exe -
Loads dropped DLL 11 IoCs
pid Process 1008 fb_inet_server.exe 1008 fb_inet_server.exe 1488 Program-JPK.exe 1488 Program-JPK.exe 1488 Program-JPK.exe 1488 Program-JPK.exe 1488 Program-JPK.exe 1488 Program-JPK.exe 1488 Program-JPK.exe 1488 Program-JPK.exe 1488 Program-JPK.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
HTTP links in PDF interactive object 1 IoCs
Detects HTTP links in interactive objects within PDF files.
resource yara_rule behavioral1/files/0x001900000002ac5b-1190.dat pdf_with_link_action -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 48 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Program-JPK.exe Set value (data) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff Program-JPK.exe Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 Program-JPK.exe Set value (str) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents" Program-JPK.exe Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Program-JPK.exe Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\CID\{B1159E65-821C3-21C5-CE21-34A484D54444}\76C4D7FF Program-JPK.exe Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell Program-JPK.exe Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 Program-JPK.exe Set value (data) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff Program-JPK.exe Set value (int) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" Program-JPK.exe Set value (int) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16" Program-JPK.exe Set value (data) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 Program-JPK.exe Set value (str) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\CID\{B1159E65-821C3-21C5-CE21-34A484D54444}\76C4D7FF\0 = "030046090091074141038012149081084043207112237137" Program-JPK.exe Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell Program-JPK.exe Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg Program-JPK.exe Set value (int) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1" Program-JPK.exe Set value (int) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1" Program-JPK.exe Set value (str) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\CID\{DC484C6B}\76C4D7FF\3 = "246087206208176072158153005148068255072109058117" Program-JPK.exe Set value (data) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000 Program-JPK.exe Set value (str) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" Program-JPK.exe Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags Program-JPK.exe Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656} Program-JPK.exe Set value (int) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4" Program-JPK.exe Set value (str) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\CID\{DC484C6B}\76C4D7FF\0 = "030046090091074141038012149081084043207112237137" Program-JPK.exe Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\CID\{A3358E75-826A3-31A5-2C1E-14A484D53571}\76C4D7FF Program-JPK.exe Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings Program-JPK.exe Set value (data) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots Program-JPK.exe Set value (data) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff Program-JPK.exe Set value (int) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0" Program-JPK.exe Set value (int) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1" Program-JPK.exe Set value (str) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\CID\{B1159E65-821C3-21C5-CE21-34A484D54444}\76C4D7FF\1 = "030046090091074141038012149081084043207112237137" Program-JPK.exe Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\CID\{A3358E75-826A3-31A5-2C1E-14A484D53571} Program-JPK.exe Set value (data) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 Program-JPK.exe Set value (data) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff Program-JPK.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Program-JPK.exe Set value (str) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\CID\{A3358E75-826A3-31A5-2C1E-14A484D53571}\76C4D7FF\2 = "030046090091074141038012149081084043207112237137" Program-JPK.exe Set value (data) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 Program-JPK.exe Set value (int) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257" Program-JPK.exe Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\CID Program-JPK.exe Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\CID\{B1159E65-821C3-21C5-CE21-34A484D54444} Program-JPK.exe Set value (str) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\CID\{B1159E65-821C3-21C5-CE21-34A484D54444}\76C4D7FF\3 = "246087206208176072158153005148068255072109058117" Program-JPK.exe Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\CID\{DC484C6B}\76C4D7FF Program-JPK.exe Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\CID\{DC484C6B} Program-JPK.exe Set value (data) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 Program-JPK.exe Set value (int) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0" Program-JPK.exe Set value (str) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\CID\{DC484C6B}\76C4D7FF\1 = "030046090091074141038012149081084043207112237137" Program-JPK.exe Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 Program-JPK.exe Key created \Registry\User\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\NotificationData Program-JPK.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3636 setup-program-jpk.tmp 3636 setup-program-jpk.tmp 1488 Program-JPK.exe 1488 Program-JPK.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1488 Program-JPK.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1488 Program-JPK.exe -
Suspicious use of FindShellTrayWindow 31 IoCs
pid Process 3636 setup-program-jpk.tmp 1488 Program-JPK.exe 1488 Program-JPK.exe 1488 Program-JPK.exe 1488 Program-JPK.exe 1488 Program-JPK.exe 1488 Program-JPK.exe 1488 Program-JPK.exe 1488 Program-JPK.exe 1488 Program-JPK.exe 1488 Program-JPK.exe 1488 Program-JPK.exe 1488 Program-JPK.exe 1488 Program-JPK.exe 1488 Program-JPK.exe 1488 Program-JPK.exe 1488 Program-JPK.exe 1488 Program-JPK.exe 1488 Program-JPK.exe 1488 Program-JPK.exe 1488 Program-JPK.exe 1488 Program-JPK.exe 1488 Program-JPK.exe 1488 Program-JPK.exe 1488 Program-JPK.exe 1488 Program-JPK.exe 1488 Program-JPK.exe 1488 Program-JPK.exe 1488 Program-JPK.exe 1488 Program-JPK.exe 1488 Program-JPK.exe -
Suspicious use of SendNotifyMessage 10 IoCs
pid Process 1488 Program-JPK.exe 1488 Program-JPK.exe 1488 Program-JPK.exe 1488 Program-JPK.exe 1488 Program-JPK.exe 1488 Program-JPK.exe 1488 Program-JPK.exe 1488 Program-JPK.exe 1488 Program-JPK.exe 1488 Program-JPK.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1488 Program-JPK.exe 1488 Program-JPK.exe 1488 Program-JPK.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4876 wrote to memory of 3636 4876 setup-program-jpk.exe 76 PID 4876 wrote to memory of 3636 4876 setup-program-jpk.exe 76 PID 4876 wrote to memory of 3636 4876 setup-program-jpk.exe 76 PID 3636 wrote to memory of 3572 3636 setup-program-jpk.tmp 77 PID 3636 wrote to memory of 3572 3636 setup-program-jpk.tmp 77 PID 3572 wrote to memory of 3952 3572 cmd.exe 80 PID 3572 wrote to memory of 3952 3572 cmd.exe 80 PID 3572 wrote to memory of 4956 3572 cmd.exe 81 PID 3572 wrote to memory of 4956 3572 cmd.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup-program-jpk.exe"C:\Users\Admin\AppData\Local\Temp\setup-program-jpk.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\is-R3FQJ.tmp\setup-program-jpk.tmp"C:\Users\Admin\AppData\Local\Temp\is-R3FQJ.tmp\setup-program-jpk.tmp" /SL5="$4020E,147465875,780800,C:\Users\Admin\AppData\Local\Temp\setup-program-jpk.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /C ""C:\Program-JPK\FirebirdSQL\bin\install_classic.bat" TGSoft"3⤵
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Program-JPK\FirebirdSQL\BIN\instsvc.exeinstsvc install -auto -classic -z -n TGSoft4⤵
- Executes dropped EXE
PID:3952
-
-
C:\Program-JPK\FirebirdSQL\BIN\instsvc.exeinstsvc start -n TGSoft4⤵
- Executes dropped EXE
PID:4956
-
-
-
-
C:\Program-JPK\FirebirdSQL\bin\fb_inet_server.exeC:\Program-JPK\FirebirdSQL\bin\fb_inet_server.exe -s TGSoft1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1008
-
C:\Program-JPK\Program-JPK.exe"C:\Program-JPK\Program-JPK.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1488
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21.5MB
MD5f339125b9222eec6814a40222d02c438
SHA1af8d8a0a9ffcf69c914bcfd4b3066aac8e2b3715
SHA256747ec9206df78684b1a516756f33ce0d8970870adeb1b61d250eab2b0b1058a9
SHA512ccc02272af56c6fd2445a540030da0df483649d8e1447d2634d4ff6abbe1ab7647c7a1e413c878b5851bc3a1d22e06918466cccca50827c4cabb2f11d11673c6
-
Filesize
446KB
MD5823dcc6386159428e1a934652be84005
SHA149aba0b95935e5072f4585913b6ecddd5ad60d13
SHA25660ee4c5a597245de257407e0cc3e838bdbd5a73e5a91b8da3d869cf34fd21680
SHA512971328a17d356685af6013f04f11fa91925ecd0b7f3e8fe0a5b9316e3f97a60beb37d73cf34d211a9d741f7a9f39926fefe9e765fc6bc4dd54257f8d8292c4c5
-
Filesize
5.1MB
MD5bb7800bea048c751fa89fe3a0bf87458
SHA183db32ec9a23e0b92853ce52c6f0963a26bb1646
SHA256252716259fa5ab6c5f95feb3e639561b919a6b2aaa963b7c8d292ba14c994e45
SHA51263eb045ffc423914b4790382ea109473cb1a39f8db9fd4f5daa5007cbd131081d6f5389e504e7feb8bbdedcfa973d757e0f028aa33d4e508375807c620b98065
-
Filesize
8.2MB
MD593ce6fca2477c99f517cdccc3b89f0b9
SHA159c4d9fb0d482cd41dea35b88844288c33850a98
SHA256b2572b41982a52a772411af52901a31bcce6d90a6b70fcbdcd727e8e0586c08f
SHA512648ed8fc9f88d82fba1cb231fbe4083abadd7e5dc875332c7d6b06aa3d3616ff0b76fe0eb841ce1af775066502ac51a06a11c72e2662772bb6150444feabefac
-
Filesize
1.2MB
MD5684ffa7eabba36f2587f96d89142cb1b
SHA1f35db0872c9ec944d3ab057af1a47baa3768b382
SHA256a702e06ecc49d97af38bf026587c0de2eddd91728fbb230533fa5e5d05da4973
SHA51269db9def970878c4b69e929e01166ac019c865eae96f8c025a38d797f9a7fe1f2b3236bc6abed54a4e27916715422bef45c1c7b92a2e3669914efb052ffe1919
-
Filesize
17.3MB
MD59fa2e49376adee2dd90d19f3c3de3d24
SHA1932d7f8cca1aa68a7e90db827e8e949c77aa8dc7
SHA256fd4a0f77bac9a7bef8cfab289c678766b2c3d9a798363360dcdba8b3a62ad74f
SHA512405e3a5cd395dea4dc644fad8da2a75f25810fe8ce84f893b21d83492c52596ed70102b17168b1ae2b7e10c781a6fb627b783e5d82a217aa4cf1e200c6d983c9
-
Filesize
6.4MB
MD5af5377206cd03a08c5b575136c71de5b
SHA1a1955101148acb76dd1f07ef071ffdb3d30759ff
SHA2563f7f3ef8e3c9f464953d22ee9901fec76562a991d66ecd092c76480ecad55a35
SHA512e30648a038d81efb040043ab55da44c3842b574784904476b4a521b255de0dfa9f454e3de24b698280070ece699ae216b2216b4104daaaeefb5daf7129eaaba9
-
Filesize
7.4MB
MD5791d254eeb0bd21b9bebc433fa899b0f
SHA1093ed232aba85417ab9c5e7a93ee068c05b89c30
SHA256b0859d224ab7831880ec735bf92a07b2763aa36dad4f3970a58ef452632d6c79
SHA5128745e0f4ecbd9bc0c939debe526f40a145964cc28fe84acc2679562e414aa47f52b08277fd8f475db4fbbb666443925e722fca3c161abff646b5980a05eabe19
-
Filesize
3.5MB
MD5585e92504f226b227a8ea682ceac6f3f
SHA16ca5cf02af74bfe2702aa3dbd1f92eab404857d4
SHA256abe2414a25a0945e8a947a3aa369a65e7ebef8223809ba65a2cb3a85ecd42907
SHA512878d2e4664688976d1b12199da706f43881ebf168cd2d5f5165b913afbf7650cbc97acd3a7a9792ed4932674c4e710549401a16f2b08a0015c2b0bc1ed351be3
-
Filesize
2.0MB
MD568ea09c05c255a84ba95da8cd1a99b88
SHA1d19401b46b5f30758421b02daf7b7f5e34a0f770
SHA25672020105ae2f2d229544de8dccdd17b508f134de183c9b12af3334541a5ce0a7
SHA512b1174c8f3d065098c586c5bca50f490bd9d56dfd6e291f2abd58be3842496016ea2f096423153c3e441893f8d3e285b3077e9047d8c0e25c3dd409946882a998
-
Filesize
1.2MB
MD50e50620bb19bad224374c74c41cff9d1
SHA17036f841038d47d9a6b9b292755e76bd84603b7d
SHA256766195b308ec915f316d1669fb32f178b3873488f48a9efd132d0e8577aa4f3e
SHA512230673bcea261e91f447cd32ad70ee4e7e36b2c49b4cea1b7714075cb9bc2df7bbf3d8870cadac310e6aa0bcbaab13dd4edec4b430fd7ed4287a785253659f2b
-
Filesize
632KB
MD5388f38d7840f14efcea14a8c74930085
SHA19c093290a6f1b2f0e1ad63da37122a3d585f6e55
SHA256586f9282b27ac599b1c4db1784d2e1a43b5417910c9e8b858e264a81befec759
SHA512196a276c9e8265daee8c1d55b0025865ccb4d38f115530f1835a06721e50fd2ed46a18236faea3dba4f8cd5f46cb799b838a2d5407aa473ed6bbb9083d11a107
-
Filesize
268KB
MD588ab02d04751c7597b261d1d0b48da9f
SHA11b8f3e9fc2051e96ed361df48e8eacce32917cd5
SHA256489002ac430d09cb7b8f8bbc962ef05df7ef6b4de8106b947ca74e2d3612de5e
SHA51200505e5e399acad86ce8c3f55066e9a2f64255a33b00c0772d211567400757b7f223641ea9df95b62ee5e893b4bd4bc65840079ba41fd9f711baf8ff57399a79
-
Filesize
3.3MB
MD5e2b770c74970ecb5a77afcab6d92dfab
SHA1b29fbe1c7f74827a523fef4790e98d9876db7d34
SHA25627180731cab10806099d1316e243242ee384db3dc157b4e461cb4b4a75fb8eb0
SHA512ad443c264257595e50c9074ac53fcea915f4a14acfdc717acff3b9bf9c8c7d4884ab19259281fc6c97be6be8ef2675eeb80b501d9d7d79ae4c18fba53520c061
-
Filesize
259KB
MD5556eadfe1dd7df3f6d8f49d1cf96d98e
SHA1186cbc2ca3a144124d6dbf16593cbf7878cbf29b
SHA256c5691c8f59867c1bf84ab4cfdc241471485d1188041e089eb585ec29b57fe4f3
SHA512cb2bc4cf197213c4e2fe4e5333ba55e07d571f120e8102a4dd2cc47e86d43864f8bf90cc9de3f832c053721a7accec084faec0c7ea98a31f67b6ffc123189518
-
Filesize
94KB
MD55f6a178d31889e566fbd6e54f68bfe15
SHA1938ccf70c3be7cc559d7e553882261148b13b5d5
SHA2566b83839f60d87bb877830537e92e8725d2a733cc6627a15b26283014e321b72b
SHA5124d2df126b1a9cb4d7ab17876eac0487f4b2785ee5f2a4932fc9c82118a93c4772b6920f4f8c8a6e656b1b367e80ae893b8f5699ab834e1d65f6e56f73f2e50b9
-
Filesize
5.5MB
MD568d9eeb070faec44bd2d49e1acd6e7ce
SHA1a1c85bd0ef5da4fbb88c0b615281f27a8c0ca5d1
SHA25677a8e2c0b440c0adc61756028f51e95534115163d7c37aff898f4f3661e31228
SHA5123b6202825530810129bf94346ba3c7f349d3b8fde03c76b263a931bd16c867c8c903c0d4ff3b1d7c6669654a42cee2d5baa050587939b2cda915744fc93eb992
-
Filesize
1.5MB
MD5808718f3a7c1ff3cea7ada2b13cad855
SHA14d4f9ada21f7296d1c09fcdcdedd6b482eb6a814
SHA25644cf13b3cc2015c4134f587c8ccda910cd3a7f2426db50a1a84a2192edbd8f80
SHA512117976a53181401ebc40c9690b9473ab218568b2e6e5887e20a83a3e91abab6c75210a7d8be637f85275077fec23f96cb354b6f2225211c730fce3edeb9a0872
-
Filesize
914KB
MD581be734380c9c5dae22c16f887c2e3be
SHA18a3a928065aaf0e607d03c4303c01585d07794d2
SHA2568c1a14d86390bd7a2de314a856094870523e158a4ffad79d41fcc9199b6fe1ae
SHA512a8ebd155b56d3f6553ba87c632bf605c1b661100a83e7010dc8f7df4c137b119c528dc4319900f95220e6f8d92ad30b03dc43128e55d54583f2ebe0d314b86ab
-
Filesize
303B
MD51c25aa7e165bb0a047bf259b5faf523b
SHA12fe48efbd5e7a29471735dcb767dcb56bcf4a443
SHA2569d451c921a09ff3e30c93edce8865a4fb6b92aa44a59708e85080b3e24d3adab
SHA51247c5e126b22339b85e01227a1a4d80c9a7aa7f220d4b68ca383c361bcce94443847c9db6d32993d2e3a8185dbf0b9f030b97e858ccfb6bbb08f3434a84df5797
-
Filesize
78KB
MD5350801f6e640df410a2836ac6441009a
SHA12f7e4aa0d1512c4b42509d727f8066c90dfe9e89
SHA256d486ef2923b88b1a440e5423f864ea10a07ed03a808a02e9f20eb8818f01451b
SHA512bdf5b5c5fc2498c8d6ecd0212592d4740526790c1be3085a089f749d90b54e5c87ee6ea3ea3c89277cb94092274e16f06178e7e5eb74294551e7de580decb484
-
Filesize
27KB
MD530e28d5d771321457fee3ecba28cd43e
SHA152f61826212af26de852d85b4abc6cd57b1c5503
SHA256507c792995734ca5f91b4dcb2154453a31384b75399e1224fdd99888a54581eb
SHA5128237e9da05258ce855e92d7d145d685108f26547018c324b1e918538fbbc3e297bde9e668602c638e6cc1de3fb52dc43b10adb17eca9adb19c5a40590afeefc2
-
Filesize
591KB
MD504e3dd7b8143547e02a537d83cbdde83
SHA1c525d31281ba1c7d7a03a4133056ed6a954aadf7
SHA25660b5f5b3ede37efcebc787313d1c47b7f0177d554219dd219a06523bea8f3676
SHA51223751f90680bf3f439182dad49f83d82b35c4bab0d53857da1b0b8616e046a37a0aa0af06434be1d061d352df634d3ba719b15a23cd5def33b14070da33f436a
-
Filesize
961KB
MD5548af7a0a7b29f9c158e21a3e95889b2
SHA149375d72116dfd5d81e6f466296d329feba320bb
SHA256d176bfb13455968efcf10e7937608afd9270e9d02394b6cbdf709f4729942681
SHA51261680fd61d25d445267c3cc783c6ac28f767aee56e3217b25a24f71909ecccb787fd3c56fcd599f4ea5e5f73a739b3b33a685ddd4d343976c3a4e6f2c89cda2c
-
Filesize
1.9MB
MD5aae49bb03f3fcd7987f2848eb3629146
SHA1143f6b9135039f132c55ac8613db15870abb1ebc
SHA25621f908310d1ef22c27f4bc1f385f3ee32ca7943ba24d880d253dd5a70e98db0e
SHA512e7cb5f91b146fbb72632fc31b246a68bdb35c97ff64add8c8fa4cb3b1cea178c4618487af35ee46f9a6267835f33e60088e0f794108d7d8ab0ac2574f0fb1d74
-
Filesize
1KB
MD56adf4f7c01441bbf7b3fcef4eb032557
SHA166fd264bfd2d6a5031605c410ec3ad582f72476d
SHA256091550a842daf734493a0a3cd62e051a0644580e525fb135c67fe3f3bf0b7004
SHA5127c99103f6fa971da9589fa76f4d72ff65b3838b39af866f6df74815f02df2b6c0147bc967219bd20f8846db792da8ecdce3a9dc90e079d23da32d1a8a5d628f8
-
Filesize
488KB
MD518af1a2042f8b805ac7754e9d5903fe3
SHA17971a4b2c70cfb8f68824149f819a0a3fb42b513
SHA2562a8500e10df487222e5e0747c8a84a03620f8ec20296c5feba1cc54568ec60ca
SHA512a3d2bdb88f92246515ae7c64949871a5217f8a2483ee7f215d9ba09e0db8fc5ce76f99cac4fc0f1408c6ec3c7184ff429c0e156d33febd717a5b7904e219fbc4
-
Filesize
330KB
MD56976da0ab628193e4051e3dad45dc8a3
SHA156bcb3149d7b3a91bd9b7a8e4e495bcc4c4e218c
SHA256eb391cda39400e9b81bfab92fbea0be096c4eda833b5e7eca3d3115ebbb5ff67
SHA512feb438c698e8d03ec74995acbb3af3cfddd05a56bdb788a8a50a4f5f6cf56f28bafd98bc4fe6aae8a3e5b953bc3b387eff5f78bc46b8779a5cac06ee64d94703
-
Filesize
224KB
MD51b694610d88ed5ecd350d9c53211fd09
SHA1a6e284e43b8c225a7d2519176269c9e7a2b589a7
SHA25687e5c1a3774a9018b71340ade76676eccd472911f16ddf1275a07caff389fe67
SHA5127011aa14e0b2d6e9b586f9d223c858f2faec52a8638a169221222e49564fcff0ab1b32b0cf81d45f044f276b846cb59baaad4e8e3e15ff5fe18b76f3546ab494
-
Filesize
312KB
MD5977991b886cd6af80531a23d13bee6ba
SHA1d4b5eeb22796b3c3c4332ebf8c59b452bc8f3688
SHA256e6e8d624f04a07f7e38427ca9bd1a89820eddf7c3cd0873bfed3db08e167c6ce
SHA512afcd05b0d13f904a3d9dc01f2830f6ed1218e8552c95ea8b1701c3def665cbb8551eeace188a39389abd2b5da465642d40cb6d2b362c3c7cb271b00683312220
-
Filesize
348KB
MD530428a02ebf6c3f6229687e30e006c0a
SHA1330b40e1d08e278012dbbf9867f6c9804ff5df0f
SHA256d2dd644617c8e65fdb4031020976abb4a18cc25d97f411b56fa270ef023b4de5
SHA5128293d55617fe4e05d329fcc60f1a43bffcae0177130ec81a75e3d99b9829b826c31c5fd5c877371019041253f54e579659a9d98677748a0589871129cb2617d5
-
Filesize
198KB
MD5a2294cb6432555d5b388bcf55cb4a4c2
SHA1619eec5c9f57da9d41b01e2fed236647a36c5894
SHA25611c7870a878939fa5a1e6568565820608e158ed49f096228b492c298774cda4e
SHA512124cf4953c0deb21f8e25574f399a314c42d3dbca5328635ccdc7a26602f792e79bfebc93efb46e211fdb3e066fe169831c0436edecd2af26ff8ac865ed539c2
-
Filesize
1.3MB
MD53cf98a347210a6499bd8d412f85c803c
SHA123c1366d9b1380d59cb30505d038bdbba0bb2d25
SHA2569f76243b8635c93ce5bf7a5287605e5fc354a72df8614f4033f5bf588d890e16
SHA51258cbf9b2dc6d8d03536da401dc7e7c0ecb711dc57fe35ef2037803d89459833815f40adfb992f962e7aa55f41ab23228374acb2b29ebe85f0718882267e69249
-
Filesize
233KB
MD5ae48c74607de49fbfc87e201b3a95571
SHA1ff10bd099042e956e2df8fad9d3f9e862802646a
SHA256dd6d56fb0b6c497cd120f00980017669ab6d1113a21646bbd5ce8031aee267a0
SHA5128300150afc1e535978dd65713ad123bb9d6ca554934d43f9f491e40cf7252d81c62c2c9255650f09fb02c9462caa13b800c85e7fea418c30abda89dc42bc27f1
-
Filesize
5.3MB
MD5161646072fcbe2912db643124b1f5f48
SHA1d73236253fa1cde2f93945ceceb8e7484164a477
SHA25627cc210354c6eebef6f9bd82badb2cf5a0e9b11a960f66b0cfa25e2f3f3f4208
SHA512e79009f72cf7240deb3d4fe2b8ef2acf9c79b3141765a294e12fe3e5c4d0ebc074df3b7c53276a720d49372204204e5133eab3b9e74b28d5b165b7430952ed4c
-
Filesize
6.3MB
MD5f70a0fb0380a2596ec1859126c45b2c9
SHA132cafbdc15a3fcb956d19effa67d2599933b5454
SHA256f66173c45eb319398ee9cd4454826f3c5952e43792bf201831c99d28fa7bbd7a
SHA512edf4cfe669458eacd07fc63e38d3711ca9408023b28c63c6715b28071476eb66afb22ebf3dcfd188e01a9e6fdb1b8b0077735fec976a33b53d405fc00e1cd6c6
-
Filesize
4.5MB
MD59b58e1e8185c38c09f26dcc02a20de71
SHA15334ec6d96eaaa499b6405a7acf4e44b97f37c74
SHA256f2d45e798675846db0ce7fcfcef35e80ab31051811dd780b636cac46e9f1c581
SHA512785b9f2d0a6436ed8f76279463dcbf8c60ddd804a7b842715280fa3e14a48a8e8d5edb0baad030b6cf8a149430772e61578bfb2766654aadb73452bc1da3bd69
-
Filesize
3.0MB
MD550880d4a82f90b1edc53dcfae522d9f4
SHA1e20943c862ae10e88c609d11aee875bb437dbdb0
SHA256920f31aa92d0f12efdf4103d9458d5b655842b10a7967f248f8e756466192ea7
SHA512c3d41d1e8d00fee35eda676261661f4226f448d16a72a14c135b479dc6d2f5ef00831e99c437033e36101c03171b1d277b3fb2c6af0d3246caae8ecb77108dd4
-
Filesize
268KB
MD52c89510bee09b388dc0d87c91ac5e6e4
SHA19159a2325573593b596cdab656f6557d19f4f0d6
SHA2560deb045df2dd551fb9f3cb20a5c8819703349f6eb0ac9583563353a69910feb8
SHA512f5c2c446dba18288e46e184e472bf8ca038919dd50968ce7c67e7366cde2b4808e769db04701a39bac5fd55986719ab6e8ee2a3132ffc1d613a0fa52a5ab6a67
-
Filesize
5.4MB
MD52661932ac0e6ce18b2b90d4d65ebd808
SHA1bdccccd29f4da7bdc27ed7b826dd31450e795231
SHA25625ab3dd5ec8486f4ee4b7e82507a0256be390dffa546d38fbf57611aa29ab53a
SHA5121d4f2fa17f912e864d4168b87cd8777128237fa71568368e726f4cc052e38c97ed2c193000a9d203ce5c0906e19fc14118bd46cfd28964290f5a473cb784e1eb
-
Filesize
8KB
MD5c7298ac60511b6111626172f31d015c2
SHA118ea3b4a246a0edeaa7c4dcd7b92d96b4d2637cc
SHA256e252d1fd627564dee3241d4b8ee82eb8856a7ec022d2014682a503b0d316ff4f
SHA51241d9cccf1367b9c2a0048f1bda5b191ee44068733b3f7ebe4fb4bb699853bba8158cc7d675c20e1563f68a7dcc65c9b8137fb2cebc15a2195573898403bda066
-
Filesize
562KB
MD58cfbecaeb39f4043f4c7a8997c3b7df0
SHA162c6650d3324ad3a906eaf139c417d40751b5ea3
SHA2568f3237e1fbfaac3f3e03ec1390f4bbbdb0681d470d0fe1523fbddb931c88a0b2
SHA512588037ac905831d35811b9a90db7dbed6c8b96445d9e1413673302efa28fb5d28474d56b41b2abb3f5c73605899b2dbdeac3a669d9cb4499f30e4e57b60187ee
-
Filesize
6KB
MD5fadb2fc3c12e0700d073d02420c1d00d
SHA182c6d8cb5e04d2475447f0f9d35b23a79b5d51ab
SHA2560192eb2179dce11444784eb51f2213169e305e84c33d8b79302838175e5a1f40
SHA512054cc9bc773eb4ecf43f0aa132ea7a26e105515a4d88bd5ace0c7a78b477f3ad315d84887e5839252ab336d332dfd39ce0771e8b12af22b4ab47939e63725c29
-
Filesize
1.1MB
MD55465be8130c00e73ed5b5e60262e2f92
SHA1237e9fd2f6fd87cdc3f1e7b2a5e4e9514e6cc927
SHA256d2a054362dd8be02514d2139466f2998220c122097ce75c6c7df875a172dc586
SHA51208bc431cc7b8e29657ebcdab58ed769d9c992e7899b75f7a454e3db08ca61c6e15a7d2bf0adf90a3126dd77e99a81925b5eeb9102adf11a18cafa2ef42df9e0f
-
Filesize
2.9MB
MD5f63a314b6fef30ce0194ab5c556f5130
SHA1d5ccd62c4566031fb30d0378f8d2006591329cce
SHA256819820c235c79e40a071a5e3e680de7244c09f85fedfb88d8f6c1d7598981ae6
SHA51294c45bc5ff5d3ac832f5371d027e23047bac2a28f5663d4dc43d55977f60da8791b05c773970340f345fbeda0a7865f4d7d921e85bb74c3e22ce1438b4f5633a