Analysis
-
max time kernel
12s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
03/07/2024, 03:32
Static task
static1
General
-
Target
34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe
-
Size
579KB
-
MD5
7bf98e01b83a1157dd41dc7f8e04df50
-
SHA1
13ab75bec97009fb87f1e130f29b59c1a2297636
-
SHA256
34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd
-
SHA512
3d21e3488f4448db9f23617066206dfc9996fabd1ac8a463801be8426ff7c33b74233d39d711ecdc657484ba08b00d19f6908dc3688d8e8e327d87651d859a79
-
SSDEEP
12288:KMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:/SkQ/7Gb8NLEbeZ
Malware Config
Signatures
-
Executes dropped EXE 22 IoCs
pid Process 4644 alg.exe 1700 DiagnosticsHub.StandardCollector.Service.exe 4700 fxssvc.exe 1516 elevation_service.exe 2952 elevation_service.exe 3052 maintenanceservice.exe 2840 msdtc.exe 2096 OSE.EXE 2216 PerceptionSimulationService.exe 3348 perfhost.exe 4736 locator.exe 3116 SensorDataService.exe 2664 snmptrap.exe 3528 spectrum.exe 4860 ssh-agent.exe 4964 TieringEngineService.exe 4744 AgentService.exe 4520 vds.exe 1796 vssvc.exe 1688 wbengine.exe 5100 WmiApSrv.exe 4912 SearchIndexer.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 24 IoCs
description ioc Process File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Windows\system32\fxssvc.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Windows\System32\msdtc.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Windows\system32\msiexec.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Windows\system32\locator.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Windows\system32\AgentService.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\9ca82d1ec8648821.bin alg.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Windows\system32\vssvc.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Windows\system32\AppVClient.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Windows\System32\SensorDataService.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Windows\System32\snmptrap.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Windows\System32\alg.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Windows\system32\dllhost.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\spectrum.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Windows\System32\vds.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Windows\system32\wbengine.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe -
Modifies data under HKEY_USERS 8 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 668 Process not Found 668 Process not Found -
Suspicious use of AdjustPrivilegeToken 37 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4068 34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe Token: SeAuditPrivilege 4700 fxssvc.exe Token: SeRestorePrivilege 4964 TieringEngineService.exe Token: SeManageVolumePrivilege 4964 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 4744 AgentService.exe Token: SeBackupPrivilege 1796 vssvc.exe Token: SeRestorePrivilege 1796 vssvc.exe Token: SeAuditPrivilege 1796 vssvc.exe Token: SeBackupPrivilege 1688 wbengine.exe Token: SeRestorePrivilege 1688 wbengine.exe Token: SeSecurityPrivilege 1688 wbengine.exe Token: 33 4912 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 4912 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4912 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4912 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4912 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4912 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4912 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4912 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4912 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4912 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4912 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4912 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4912 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4912 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4912 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4912 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4912 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4912 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4912 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4912 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4912 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4912 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4912 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4912 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4912 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4912 SearchIndexer.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4912 wrote to memory of 1596 4912 SearchIndexer.exe 108 PID 4912 wrote to memory of 1596 4912 SearchIndexer.exe 108 PID 4912 wrote to memory of 2744 4912 SearchIndexer.exe 109 PID 4912 wrote to memory of 2744 4912 SearchIndexer.exe 109 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe"C:\Users\Admin\AppData\Local\Temp\34522355c018f092a767e08afa516fca7bec15004d8e63468b2381108e62f2fd.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4068
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4644
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
PID:1700
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:1252
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4700
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1516
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2952
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:3052
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2840
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2096
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:2216
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:3348
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:4736
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3116
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:2664
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3528
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:4860
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:3940
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4964
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4744
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:4520
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1796
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1688
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:5100
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:1596
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵PID:2744
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5c58032634709e9b55f7a6cfaee2d23c4
SHA1905a3b70223dba1227fee0fa4d4ca02650824c25
SHA2566ed4ce9382eed357eea43a1fca7185c4f100820de2d76e14117e813b44e58f66
SHA512be4c3e4e15c784d577d711afa77cbe233f1c799131256d5d0e9b341d6d73b73cdd730d5da72f6312272e87973026f4eb614b24cefe6482e1a5c8a25f7dcfdcf7
-
Filesize
797KB
MD59f2a21b02a7fdb0ea623a0792a2df421
SHA1e35f5df9425d779c9badf09408e4972c0cbca26a
SHA256c562b5eac0f5dc3fd60611a709c4ab7de01be30e6c2fef20b742511ea1593087
SHA512ab52fa01b4751fd7d536a884b67706c7b39583605dd4481b5b654363cf71cbf201c9f292949d5b325293931098c1b8a780ae612e10eec18729265306d4a8942d
-
Filesize
1.1MB
MD5fbdaf87ef1e5da70d55b300ea9e7809e
SHA1b980c7696d2bc87c36d51c03a613a2d7946a6034
SHA2560d0946d6c1f7f00d078e150e88f90740e9dd9aae664a297d733e9428b9c103d6
SHA512d60a51d8b5f782f0429e75401f8ea6419a580212672579a3b390c46ce223b79b9c5499008bda64d7aefc627bb3c4bc8bc628f2788185e1a48a97fa15d98197a5
-
Filesize
1.5MB
MD5eef856e9c8e676e7fe64efb0a95bcaa6
SHA159bf5fd92ef2ba1400322ac164c0879b78cc0a9f
SHA256d22a74e97c66d0b927ed787230405011e567e84c60f942c53f441f6b8955f172
SHA51256d172232683630bfbdcd32c554e40c9fd8b341d6c60cef690f3f60f5224b11d284b2ba9c72fc20012fba6394671bc9d48e58a1a69a8c8ae57a7713efefc7d57
-
Filesize
1.2MB
MD5859dd59debdd192b089b8069eff201ca
SHA1f99b0afe2887d74a28844e2fd532e5ce86214ef8
SHA256accdf72dac1accbc2f01d26cba6c5ccdd3f47457852b1510ed6d783c44617b4c
SHA512167f11851a7a9613cb72e6780f2eedfcf86a9d5901f70af3d97f08d665a330f755027fd877fd8e9341eac00bd9e0b99de53eefef5b168c46ab68ccb6d0c4ce58
-
Filesize
582KB
MD53aab5ca291b268df9abacb186b347c0c
SHA14147e857a0908f5648b99604ca340464d595034e
SHA2561620d4c8e818ffc0bb40dcd926c74b64922ae9f2a3a8a83f2a8553f74ef4f422
SHA51280c8656c5ae5c91b286d194a9885fb9ed03ff65389ed26e8d3b4644686632cea27bd6892fb6f93caa9ac8596082ea6df07f4d99ef0133f1f464046f946e0bf7c
-
Filesize
840KB
MD56e51de6e56206fa8014989b6659ef86e
SHA1b6f224e541e656ab95b128b8b4adcbea768996cc
SHA2566e9fa0fca666ed0570c6272a60a81bff2df74d185bc968eea23a51ee2674187a
SHA512390d252b63fa6e920af70de15f4cb5a387ddaa020937bc16dda9ea4a3aa4105d9ef489d41f0a5048dbe9e5433b01d5ce7680547938e2e2cb9d1c4091dfdb4dd8
-
Filesize
4.6MB
MD5c14423062fec04f8e365c0a687437009
SHA1f011641bf7b10e730950858ed64ca6efd864acbc
SHA256e7bb4c6b3d6ad5794e0175d32f26667c6e0f9001c960768be3e077d262ead071
SHA512a42bea18c042f54524cfd4460e70d42a32d2c013e39c15887a59f8a8e33fa380be0cc936301478c2d2c88c2101b88ee55ad16d817f814260d5d71968a3690579
-
Filesize
910KB
MD5901c881ac3d38f45a1a199d4759debc6
SHA14bc2d9f3dc25c4050378f0a9d34838fba5e000e0
SHA256e7ef5bedeaaed2417f62c5eb1be0bd2439cce25459ae444c1e4457928edc5574
SHA512f99c0b1e19d875b06804e332ea368ec8f4080831e3ebf9c3225c640a929f429292bfe52882eaeef99abfccf53f0955aa462c29e44e304ed2c2c4f5bde13c84c8
-
Filesize
24.0MB
MD588897439a14301f971df2a6aa98903e6
SHA1c11a10b05c96c9df0362d6580d5e6563c1e6159d
SHA2569c64a7fdac692db34a8ffcb07537f8d3a7a9e19916794a5f78b065c0e321d4e5
SHA512491cf309b8c6ca1ee256e6100550e976fcf59deabbc1116e41a4c25e6af0f2df4fcd58ab16680517ce2c048e0dc2c739a57061df15cf3e19187ca6ee2a5ae4d4
-
Filesize
2.7MB
MD52564c994d2017c20b14db73d1ed4e7c7
SHA13db64ec265709854a96a88602f072b09f5a59235
SHA256eb3352903d05508a07614928b9f7ceba8bf046ef2a9f71eceeacaa0c3aadeb90
SHA512b330ff8e541702846ad7b431fe3c4604cb64a5c0dc1420cf7ecb562eec6e197ac569defb8f00cc6cde08402d3239be51c9c6deeb7a589c0c04e18f927eff3b42
-
Filesize
1.1MB
MD53c6bf69cbab59d13b2f6a14cd2b40479
SHA120ab5ed218aa0fd7e17e57047433f0541ac56384
SHA25602fc6578496b86bcac0f9895d7bbfa9d35db6b0308d9257f501fb14026bc3876
SHA5127ca1628e2fd22d51b94f8fde9b38683acd4c2d118c425c7b1e9f0a8bc1963280d99d1afe69a4f4a2315dc3ac7a8a0769c205aebb2b976cb9e93469b93b0d66ad
-
Filesize
805KB
MD53bbcbab854a36fa3aa49d36eb166a273
SHA13a1b756cbd0f5481db6dcf14c803021ed2a0dcd8
SHA2564550bd15c531f8e5dfbc82ca282ec877c0ae90fd545af3cca85430399775bea8
SHA5121d42766e8a64de4663f9018b917c21f1f7c1e3d3f88d14791746452ad139438613d8ae3fc3b9f03800468bc150d33adc2b7d45259ff126906e02f4a788d6da12
-
Filesize
656KB
MD5677de37b6c339ecdb2fc278c73cce65f
SHA118d56d96306135668fe483c8b1f134e8fd15f5bf
SHA2567e0790fcd5ef0816d64ea919ea6d8998f3b3e3011f37300b4986a5ffb2bd4b7e
SHA512631b9275745c815118aebe988e6208f93df05b75903d3c5584488ca8aa748924ed5c5ac26736038f17040ed6f9858f5e7634b89f3a5284db50de38103db2a60b
-
Filesize
5.4MB
MD5dc3637dd7aab0124b4629658e16a11cd
SHA1fde6298a9897b824e3b23aa6f1438593556a9b20
SHA256fe5644ca6334cf925cb05636f86f60f201c5bd68779b6899a32677e0d1c58071
SHA512b4a6753da316ad14b65637157586b6acf64223ae07206a532e8fa8d97e9c68f50ec903459e813c932eb2716076ec6e341ff01e8d82e7f322832ea91409bed887
-
Filesize
5.4MB
MD59ce461a8a5e16026d03cc372fdd6013a
SHA1ee161a384937ea7e974989f312cbc377bd3aae88
SHA25692e65dc2fbca1f1c1f282e1cd014fed8f657e383f03b4eab86b6ac7844c12fa7
SHA512f3d272e831df543abb4a5bf61e3be3747aea1325ed93241faedf7298cb83e1c90c14db382ab3b87aacd4b0d684288b2a50908467cfdf77aeac494ee1c9665b0c
-
Filesize
2.0MB
MD53c9adac745dc7719f889380cfc87ab4c
SHA17152cc6c893a5821014b24095a36668946756bf9
SHA256ace90205cbb6752248062d4297f59414735e4344f3fa9434095ff1e3c4f1120c
SHA5129ad00c2a04c4682c4415b944210332b2918ecfc3e3ed5f41cfcc7fabb9d6fa336ac5773900130f24d8a2985f4129e0f8f9030baeb0ce8bb72591c0b6d6a2ed30
-
Filesize
2.2MB
MD53d1ae260b19c3c866c54c4d7b522e0d2
SHA1d6392958fede4f322cd3afad8cdf2a5a64364ada
SHA2562261c67bdca41e75e8bb2b8eeed739ecd25092908ad8dd7399e84db70ca8a196
SHA512a124714abee6f97002acf219c2efecd63e1062bc5107a1276943bbcae3d541fcc43f498f44437d932b890910be700d0601a4807057a0195129f7e981bd94e010
-
Filesize
1.8MB
MD579242a0bf5ea61e9cd8483a180b92860
SHA1e3508445c5498291eab973b9507f5a219310b4df
SHA25615c990967cb73e823ca334a6d6817519aba5b9bb7f6fa8765f147b44d711ee53
SHA5124803cf98a494bc4232685741446c1c111f4f9dc3254ac4cfb93058f7337afe670fa05a64e207e02a9012bc09c32f9ffb6f067a13b91c991a371f5d3440ebba9d
-
Filesize
1.7MB
MD5ca805e793a16c4409534e7ad1aa23a12
SHA1c2d8d84e7f38155275ff896df0dcd6646cc2ea31
SHA25673fd7aeaf7228005547fed98b020c49ae7fefc0c73055eff294987b050dceeba
SHA51236f24cb0e157412047cf8e844713c50c21af6790ce2990e6e0d5833be8ee0cb652d99116f232c6c592b27ed5ada1d7639368d9ce863501c8dc9d7de568cf650c
-
Filesize
581KB
MD5aefd19baf46727b9313cb825623d303d
SHA12b943c4b42fc71d01469265675a7dd8a9e22f2f1
SHA256174fe8d971212fa8d76d18417697098ebdb84358dd7c828c2aaca2912571c209
SHA512b97f84a44a1abee0eeaf5a618b5b5e04f50e12dada4e7c31058d9d532b0e888c318305018534b7bfcdf62633e111f603da2121a9b466647e1a2a1ed9bc61faf2
-
Filesize
581KB
MD5950261d72e50f67b8d9e21846cc7346b
SHA17028eccdbc4f2b5180f52b1b84973a6f929c4852
SHA25637549d50897f3aee836aba30eea5534b9ba75268442969c371a8d1d254751583
SHA51242067e5b7a3782435a013594012f92613857269fca3b20e6bbe93c619a55d05e8232716793c0a177cbe9bbaa4662147e262047e8915346324eb58c55ae4ebf03
-
Filesize
581KB
MD5e3e569b6c3efa66e2cba135e5957dc9c
SHA161fb7c4e619e5c74dd05d4d836e6c0fca4abf3dd
SHA2565d5dabd295ba1d3d10a1350da3d3921f787de5c1867e1cf8b24ec4fccba02646
SHA512447e31e021fc206f6251cc2f83011434c7e279efb47b574c39889a4e9e09abd8912f23f58a03fb31a675c13155435d45a4fc8472274100b424cff35eed5fbc9d
-
Filesize
601KB
MD5f85b63963c646d7b437c9405b82f2c8d
SHA1359c65f1bc6bff8c68bd7a436434b31f4c5a9c69
SHA2563664577066a1f6dd61e05e1a44ad569fbdf1795b50c6fd37c11e50f27f9705cc
SHA512f206a0a2906763eac7d158d06447501e3ffd405f878989aedf66471783f579f7d9f4095eda0a7d437b0807aa5a9e8c19519f28df35f46b6fb829e7d5c3bf49c9
-
Filesize
581KB
MD537292bc558bd4a982c15cff23499af0d
SHA1950ca42c56dc74ec82c844783d436d21726f063c
SHA256b054e23e995ccd69575c310f345082f0bede9e37809210161562b2d815d154d5
SHA51287a16146e8c8cb53efe7f674d7ee5aad3ea4c895372e8a5b32c454ff16fbfb48a5a48c2b47d5ae23865c1aa7bc5232ab350fa73197882a261b7b4e3135371ecd
-
Filesize
581KB
MD56400865565b4a0c4779082555ae68a12
SHA139208db16a4bea8fad31d79668643bbb7ff3a7a4
SHA256e2b964d546fac5247d85144ab9a2030990ed913e157ad78db7f48a0d64f82257
SHA5126f4727b8916c6201f8574e35aed16daa52e2b960e1bee3a1965b7e033899aadca319fbd8442808519b81028fc8f124b51492dc914e8ffec1aff81e4ece0e5f73
-
Filesize
581KB
MD5f5a99309c10cbce0144afd8ceb8d605b
SHA1683cbdf08e1b8436d4e49402d6b3a95e4767cee6
SHA2566a6b0a3bef40bd8f70bec2463457afd1da5f0b797f7ca7f6ee762b990d2f73db
SHA512351770936f5f6746f2f97da530a4d10e91b29fd5954aac57c4e28cd8bc1f83367a37e5fafcaffcdadb203fa8622283a3aab2ba04de49fe5a1e317c2c2d861202
-
Filesize
841KB
MD580307d5a5262d76168c7f60aeebea685
SHA16f0b5a90cfaf7420cbf9d88e10d2fca63f8bb15d
SHA2564fb3277457f73ec8b1d315e414d4bb81548ce976ecabc3d4a61f5ac06ae48c61
SHA512e87b2050c72b676fb8d1bef455ebae28b2cc02dadba9aaaafee585af728b2244efedb236c53fe245073aa5ee586113078433ce25d2185a498f237618d88d7560
-
Filesize
581KB
MD56c4f9868a1bd7277dd405f6f52a09fb2
SHA14a74dd494d6c56d0803cd58833c20b21bff2dad1
SHA256d75f89badcef52416fad2f51755c51fcfbfe2ad95bbe484c9b0ca359ee75a9cb
SHA5122d86c42198c74738f946927a1fa5b82c33424742db3055bc5ed7cc7f59f246b4627cca999dd3a157fbdc028e36db8b85d8138304844686dcc07602b98900261d
-
Filesize
581KB
MD58547b23e8112dfc00401ca5be4c0fc43
SHA1500d7dc8c62dd7b5dc3f299ed6b8457341faf423
SHA256d310234f818e5771af293096165efb4a0817cb16f1e300513a9189b8f1be0ad3
SHA512d1e8932f8193942db1299523e624572ba777f4811a82fd873473b6af3d91a1413324b562d8d9e832322f7cde7a17726fbd3ed93932060ab49f1ed4a589bdf47f
-
Filesize
717KB
MD52cab081015fc81f9008224190cb2606f
SHA1f5ac6da38d0e1bf2d4ed8887cacc99e0b6fc7c84
SHA256e061d70017f47ab83fff8788aec40bf06f2db976c0c16f919828915e1a1e24ce
SHA5120a82b5b533a9b0ca3732c424b6a8e421b60b26d441ad465dc48da441092ffff2de24905a1f40ce12d0a1514f70b78839b5424091d9b267cac9939d6c43fbbaa0
-
Filesize
581KB
MD59161c91f8a428ad63d5a75a8ccb46cbb
SHA13a581ef7adf5e312cbe59fb8fe6c43da9a71c801
SHA2564e3359d2fcd77950d25b0f109fa17bf2dd2aa0a12839593958738d88826ecb24
SHA512e30358a2bade191effe8177dfc956f9ca9ae8bfbd4b2559e000ec0601f98260d135f7a976d302358152eef2577bbd7581eafc84c0c0db7eca36fd74713f630c7
-
Filesize
581KB
MD5285bad4fab7b8b397f7ffce90dde4110
SHA17628ca3d7ad11b427444ac48560f71e1102b99bb
SHA256545ba6c75252a426ca75aa8ae2210133fbca9fc5af2dc8967ebcb18e1080f2b1
SHA512cf58b82656e21edba629f20b19fb2e31ad822623c1b6641659bc3f4ca2df02d8721e4ac93ce4bb44b2c39a2783ee9983b68bfc683eb559924ae986d0992da5a3
-
Filesize
717KB
MD52712dac48f16e76adee45771eb35c9a7
SHA1ed85b35be948b471387ecd88c4e5556b48ffac35
SHA256c2a059b8e54f995d9b5960f9bf72ff3a2ff6e3822dc39429054920ab3c1dd4cc
SHA512705adab251e7fc8884c0f1c298e5736ce50f136fe29ae255c0079abca4f0e54f53b613203a04beba5e408da5a9677b4ee9b5f934607f1214af51c4f98f6e633d
-
Filesize
841KB
MD5ce246df8ad1cacb77ad2bec4a8359878
SHA17f002c693fa8701464411a50510b37871de1c1aa
SHA256b4c96aaeb00e238e58ac397f10fda1c10d1178fc346206415b6eec19b1cb3f61
SHA51276e12b4cafea6fd251d11b9b373ba5238dd5fc7f6cc5163a97e14641b7d8e78ec28bf56fd130ed3f555c6e9fc7af9313d95a16188f93536c16dc60e16a53c3e1
-
Filesize
1020KB
MD544dc88fe3267e23e57e8ef1afa28ca7f
SHA146e3a67adf3ad3082bb1c95a384c5558934d7f0a
SHA256f5fdcf9d2843aeccc4c4be49156d6efaa50ae48fea42194353cff5eda5f1598a
SHA5127e8431236c157140fe2a5782d16a45ecad4db658c59c41c5dd36febd634cd94484a47a6de7ba1a3e0a2c588e3a9d489904dc22d9f22a457a7727ce2a2eebc10e
-
Filesize
1.5MB
MD5c300ea4ae765abdb4512cb1bb2377fbf
SHA18f1fc908cdff2d99c2c1e7b2a914add45a5f58a5
SHA256a947d421934f14cf08f5662407210a3f50fdc84fd872123846458c0d477a87f0
SHA512afe3090c6b4d68b2f4142e123838d5d0d8a722836ce99568063efeee3d09eda5079b0dc1195fb23c8827fae8c16babf1dd76cb8700afd57e34bea3324fd01db0
-
Filesize
701KB
MD5703bd20ecf57fed0932c450e43dc6a18
SHA15001491dd298a6a09e661b02c9f637c6a389359a
SHA2567305d27a1d7d2cc38ba33418bd01bcb36e0d2815e770fbb0a65c81f5bc9147b8
SHA51228e2d684c3b680994f38116cfaddbfc3026b3f1dcdccfe1735cbaf38b5c1a3750a22ca94baeaf130959f50b4146968d35d01afd63a8d28e5758100a658468114
-
Filesize
588KB
MD5f6ac1f5516f0547c434bab0e38546343
SHA14fe2c7b35f40b16ade1f5e7c634bd95adadca8d0
SHA25646dfb223ca877fa688d93b821b872725ef03b6b2c73f66cba6693d94f1f22aaa
SHA51224844f5301bf8fca8b8c3b2345da004aa5529bec102d2a61ccc55ddd2f83f4833a6035e3a4779e7697d144a3bd3e75b137871dc6ba5e631791053760c8c311aa
-
Filesize
1.7MB
MD53eb25e30fed277e95b833bdf61531072
SHA1deac73cf8384b2a6efb36a528e9905da36583c5e
SHA256e82eab058280e98d4d394c94a2d67aefa7a41ae8c4439c483aa2beb9d331dc57
SHA5125afd17389eba95b00e747aa7fc6dc8a6c91fe68df35afdae5407dd16fd18fb0cc422000975ab9b28244e5d43382fac2c17bfd27283fa8d72f52c883b6398d93c
-
Filesize
659KB
MD52e054a71a677cccf087b99aa917236c5
SHA1ab75ba9682fe0f4f470fe09d23bdfa5d38dd2b51
SHA256100217b92b11c3a25f3b505b1ebe6ed95bbeae5229770e5bc7c5eac6cde36e9d
SHA5127fe251e095214b80218ebb0e70d3d4443e6fe90197353430520beb643bb68de1435e9ed3902a7040922547af0b16d5bdb9fd4c739601e76742cc4a3b5b7624fa
-
Filesize
1.2MB
MD5d7706555345e774bf3c48210b3ad5385
SHA1388f30d254dc732b1a45114b4868d498f9df3097
SHA256a1358a933bdec3958cd9932ebf9630e10b351c198ba4c795e17f26cb9f5a3afd
SHA512d17b4b009d1f629e71545eadd5530d8c6a482fe60f38ee9a30913f6fae7fbca81d41df61ff1c2df20cf8b1633baf760f3104d5c0da8da2d38aee7273c7d8779d
-
Filesize
578KB
MD51bfee7d21f7c443c0c689b356a3bd0a3
SHA101ae183fbdc7f44745e0988b5964084f7b65c3e1
SHA256dca4dc533fc1fb34d5536b620511cea87a7fe63e111bf7f9fb69ae45b1d0c763
SHA512fa181c6a6bda41f5c726f6908b3cabefb8f5aad02bb6ca05e6759fd758761346a621fac644c721e48ca579d7497f798b0ff702102580b9e72c84770070e183a5
-
Filesize
940KB
MD578a84c66ed423527c4e0184774d5c29d
SHA1476b0a54711dc79993eedfc6101a01090483e52c
SHA2561cf01987939bc830c5f6f3e29a7107f0085e0fa2b006f13a411ddca16959919d
SHA51291079a494be8c4953dbcb1a85656334d50855691c8e8d5f1bcf40e8c49c3d96752854c3e3f9a3ef1128a859f72a6feb61591237279fc4e4cd2924a6ba21be4b9
-
Filesize
671KB
MD508932e15d9f57f1a0e51d866e96fe39a
SHA1424611d01345bdfa0b9759f0298246c0dcc9c2c0
SHA25635e05dbdbed1009e871b68b185457828f164ffa33beec5dc5853be43ba4ec4ba
SHA512d9262c854c6f19278312e06ec635422d99d5a6a8eae45725ba5fba8896fbfafd864a7636c70a23fc8b8a2bcd0285e7a31c696532bc0dc84e2a9e6f3345e791d5
-
Filesize
1.4MB
MD575d99e76273e000a93552f0c5a184f30
SHA1c877abc91de3acef381c37c1dacd9c03c8ff83ba
SHA2568a1fb83449a224a2e90e96d54080daaca4a77a9d9ec728a5044982767a94d033
SHA512a911d2caed2c7b4bded76b81a4c80b700a7acae6ae6e69a645f2261aa3db696c3ce9b0e3ff91361908a53b77d8e975cf99cce789ad2b55fd8d296538f7430173
-
Filesize
1.8MB
MD5da21c45abffdde0cb65cee7fa2c71274
SHA1a3844192149d5f89a9615dc5a729005294a21e5a
SHA256533a61ec2385443b01b8cd8dce44f18a6b9452c99f954a5bbb38f342807b8b52
SHA512d1dd8e2b21b633375f55ee61a61f76e98c324c6c89f1b502e3b510c78a23232b9ccacce35cdf59f283667b72e64eb9333aee39d18f4054781ba6fe86e7e67963
-
Filesize
1.4MB
MD5ce6794e07bf9ee9fd146f4b948913e24
SHA199cb94187ba998b06738d2cdfe2d8ccb5ef73152
SHA2561cd5dcdf4af0c276fcbd6d073e82c1860c664bad9106898bbb6ad1681556e305
SHA5125b4a29efa571a60ec2ed6abf384914b2fa2b919e77335ccbf49e1399b9db9ff7aa75120c6404c0d84ad67aa6e206ea03cc881b889bcda58521f4407bc2170539
-
Filesize
885KB
MD50d989c2e8e06479c4d4b168cc8317d87
SHA172e88335ffaeb4264ca25cbecc52dc0c15e68b7f
SHA256fa57c0d3b1d97c211275276eb3f4a58fe5806ce620a0c3b9216f90ddb493f1dc
SHA512ca4bf0d1b2b2a2dfeb9b91d6a9294ef869dab1ebb3346a7e7cdd98734d2bd4bdbca657296dade2459787465b20e5f8889d4d855eb122df2d4fc0003c1e0e7694
-
Filesize
2.0MB
MD5a72a1698edb07ed4c02d93c01f3ab564
SHA14e325fc829b10b205f0b0a870daef722cc8b9b86
SHA256c8654ee838caf94a02d2bc9dbf3e604c0cfd3d9a7098f54285dff8cd1684e3b3
SHA5126e0040465e585d550ba841d6c1611e55c5a5bfa1a3630e683b81e56bac3f302989a645f396aa906dc5b089eb6e23c0b09fabad993695da29d30762d989190224
-
Filesize
661KB
MD581a020e209b694f593437ead7fdc528a
SHA16705193984180e3730c1305bdadf552cada97dd5
SHA256bf3c02e02fd6c3ff61365a286d4d9543b099aa7e471294a5023359f88b324244
SHA5125fe12b0f92a9d4649355a0d56959cab9da9730182866ce2fb3abb42c50f1a3a8765ea57a8d12e7835e4019f95b712b863d84541e5036e3f71305b8ac522abcd0
-
Filesize
712KB
MD5e67620a8ce445dad2cb5430b192b0048
SHA165ed794193ceabb27783f75098f3c4e3715ab233
SHA25666d0f9b4c2e8b64e4ad129b5e6cd6a18875c7d16693ed4cb491cc63b797a8013
SHA512ea1bc8dd4649a8db4bb3d1b62d85f1456bdc2468f5f4e0916b4155be9e96917d801add32045b3b091a2f7368237b397265042d6ad93977e5b2948c0d2cca86e7
-
Filesize
584KB
MD5f275aa66e8db51e5fda9946f8d8fa704
SHA150443c556aa0606ac955a05a9a192354d7d47368
SHA256359fc3d19517297ed97e058188b2616d4132fbebc79e47f10ba81698bdaf24fa
SHA5126899c6776f60e07a3dca0c7c4520cf96a7786fa7a17147aeb42658163e8f1d7752032b337633c8a9c005c7e16890638cf336bb4d1adae420799c60ef02834f18
-
Filesize
1.3MB
MD5ec7e40682e39afc04a4c081083f3f758
SHA10c85138a6973ec6553e6a534954cc0d48595d93a
SHA25682508457e15c76d7def500b31a0bf233cf64286e372963e399e48e5365ec2ccf
SHA512ba8a0ac3cf0dabec76c24ab10e68d0cd339565e5dbd0bd67dbd10af5db5ea6b7ec022c21c24dbb3e74969081748ca74eb1d8a034ed015d0e93e4f73aecdf499d
-
Filesize
772KB
MD5df0a9ea37baddd7ccdd16bdffc71b1ad
SHA159668aeb1cbbba40c168fcb8326e3ab72f5487c7
SHA25690bae920cb71cd15fb08f6261a76da982eafbb2b718b006cd6fc00218edf63fb
SHA512975d15f83746e98a4cf341f05bff3e0a7489e8fcd792bf389fce10865849eb621fc5bb5d90e1aa4ad52d10b157420c4fe94aa489382b9c0351e3948d22e2e961
-
Filesize
2.1MB
MD548cc4ab36825dc89517f05b0f5a372ad
SHA164f97563c9ed89cf68ab42a12ac15f7176f08594
SHA2564455df2251d76277d34b70d6565e654a2602d726e70000f8689ada5d20ca4a13
SHA51256589dd41fe421438be028ee68ab5325e8006164f78defa41294dbbffb2ec6aafd45a850b0acdee1c24ff63abeba23f44b502fe6c77e1da294cec34ae94822b3
-
Filesize
1.3MB
MD524e922f50a3fae288b37a4365ac16484
SHA1c011d2380978ad7213b8b3537df34264ab9cacd1
SHA256802e789de08ce91cf66c392ac3a25486fe9be47fc23a0cc893a9d688be16e7f5
SHA512b1c0a2497104298c960e522ec47d05c3946320160c9de8f99fdc9e40c0cad6d3e1bc5316ea6b2c47ad22a97a0ebb30a17f6bd12f566507cf05d45e04d902caaa
-
Filesize
877KB
MD51b8bfb483a80650b3440fb0f9a2e2b32
SHA1f4e8eeaf562f461473a3ab976f5efbe50dc1c2b1
SHA25697573f20f352fed33c5652be3f02549e2731f18e367c7005bd22c4a61ee50f7c
SHA512161b2524ac618a215e292f2980a8909d54e93c469ab9055391deaf27a497176761ea8bf7c0bd1176acdfc20fa02a803500c96347311b7a15feb65b895e9a72f1
-
Filesize
635KB
MD5c5dd71925bef5eedc340ebcb6fb92188
SHA1e2247ebab38acf579eaec6f1d2e110d9c374bc5f
SHA25688ff37244618ba8a5865bec2f5439584ad94affa65df0dd86a5a08813f46e9b9
SHA512b1f2de644b9d7d1bc3860fd20f29703385bafaa9c103fac856ea5fd10d8eb66623dc35a88528eb9865e9584683c9ac33fe5db02100c98cda5b873ef8b60e96c9