Analysis
-
max time kernel
136s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
03-07-2024 03:47
Static task
static1
General
-
Target
ddb1fdff1c6fd9995358143999047e10ace7e256757281fb54d48f4099058c77.exe
-
Size
1.9MB
-
MD5
fdfdc220aad6a8e743c1c63bc369c79d
-
SHA1
d5e3cd616c799d401294cf4395741e21c7095923
-
SHA256
ddb1fdff1c6fd9995358143999047e10ace7e256757281fb54d48f4099058c77
-
SHA512
281643b3451449a22bcc50ec29237cfd99a4f88120fba968d9db064545e20ff26d018b57e9f9d1bc3ab181141c47d144690635edd51a69d335b356daea70fb4c
-
SSDEEP
24576:s78r8FfC3F32nUnCdAaKu++nO3TNjx+mZCkt76f/24pN+XNqNG6hditW:s/fQF37CGaP0f9Ckt7c20+9qNxUW
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 3104 alg.exe 1640 DiagnosticsHub.StandardCollector.Service.exe 3936 fxssvc.exe 948 elevation_service.exe 1420 maintenanceservice.exe 4196 elevation_service.exe 3188 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\system32\fxssvc.exe ddb1fdff1c6fd9995358143999047e10ace7e256757281fb54d48f4099058c77.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe ddb1fdff1c6fd9995358143999047e10ace7e256757281fb54d48f4099058c77.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\a74fbd894bebce60.bin alg.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe ddb1fdff1c6fd9995358143999047e10ace7e256757281fb54d48f4099058c77.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe ddb1fdff1c6fd9995358143999047e10ace7e256757281fb54d48f4099058c77.exe File opened for modification C:\Windows\system32\dllhost.exe ddb1fdff1c6fd9995358143999047e10ace7e256757281fb54d48f4099058c77.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log maintenanceservice.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_96109\java.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7zG.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe alg.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe ddb1fdff1c6fd9995358143999047e10ace7e256757281fb54d48f4099058c77.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1640 DiagnosticsHub.StandardCollector.Service.exe 1640 DiagnosticsHub.StandardCollector.Service.exe 1640 DiagnosticsHub.StandardCollector.Service.exe 1640 DiagnosticsHub.StandardCollector.Service.exe 1640 DiagnosticsHub.StandardCollector.Service.exe 1640 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 656 Process not Found 656 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1056 ddb1fdff1c6fd9995358143999047e10ace7e256757281fb54d48f4099058c77.exe Token: SeAuditPrivilege 3936 fxssvc.exe Token: SeDebugPrivilege 3104 alg.exe Token: SeDebugPrivilege 3104 alg.exe Token: SeDebugPrivilege 3104 alg.exe Token: SeDebugPrivilege 1640 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ddb1fdff1c6fd9995358143999047e10ace7e256757281fb54d48f4099058c77.exe"C:\Users\Admin\AppData\Local\Temp\ddb1fdff1c6fd9995358143999047e10ace7e256757281fb54d48f4099058c77.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1056
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3104
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1640
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:1680
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3936
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:948
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1420
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4196
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:3188
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5d3cbe95b60d60066f8c7bbac776e986b
SHA10224263019fabdb084ec31ad3c4bb9b32fda67ec
SHA256c925bb393a782921a48b2b0a59b19752be233248fd9595094c6af6a18f1adc86
SHA512e620337549b46fbaa8298c595b26cadd554bddda057906a2ac8b15339da5dc94990b7ec2b434cd1a8c745d83cc8f9061cdc96e39af9cc45c44feda03a31a2916
-
Filesize
1.7MB
MD5ac751088ba02aa7d83c693dfd6a02c5e
SHA1dbbe4191a7e15046e56029aecd3d35666446301f
SHA2569e21ce7ea63ace7f4a183b017bd6328033b55a4b847bb61fe4766f0d83a48d7c
SHA512f4d9d080733bd1e84d8eb0df71ec268b73b25beab323d22238366757290b2bc82b87462a3548726442e9f523cce45e10d37ae04b9c26ab20d21490e5dff2b35c
-
Filesize
2.0MB
MD5b47c7cc067c20c0563d54ebdb4adf38d
SHA1c02d3023408631e3081e1f80f4d40816f19a213d
SHA2567b297022f9c4ae8ce19a17d98f638f5af11c44dcf26796b4978b49e40f3cf0c5
SHA51276bc687ac4cb5f85f26718925877eb2b30bd6e7b65c4a7e7f3c6e25ff0b4b5ed4b65ed27b29be9e8d9f77369592f07aa1bc4c153bf9087bae0e752496e767e8a
-
Filesize
1.5MB
MD549772358f5b8800943ebd00dd099366a
SHA18ef833114057080a365580b73fa4c8d317b6af51
SHA25653941e1baa99c9ccad2dcbcb1b186b848a5ef6eaf3a38faf3031f9a77b9d1e84
SHA51217f480a6471f45ee9c52388dd56f22aebd3be4ef225a45c49b88fae69d8567be0220c03d6b366db5fa17d8913a6edb14f4d168b4ed7e4f06ba42688ada165b7d
-
Filesize
1.2MB
MD5560e9a32eee2e7713980fb48dafc9f12
SHA1d7768676dd8d474f12d96f41fed63a20be7ef5a6
SHA2564455c9e68cc5bdf1bbc92d8f896ff3f04a83666900088225734d37840fa40cba
SHA5122fdc3eae12df5a720cd305a0b6614fc7f51cebe1704b19d5f3d1b55a23e843ee9a683f2c387aa7b7dd0f851f588f55ff0ca4c313b25c6deaa27eb480f300bc30
-
Filesize
1.4MB
MD54d8db58fd448ade6f6c2d05fd0adf981
SHA1558bd8f11a479654f1b556bc0411e7c66bd49960
SHA256c98eafc23a471881ebe0c66099b685162f217891c525ea7092ba96135e99930d
SHA5125abb7137c3b2618c7772296f7be92d155d0f8be00c1e476cae59d116462357e3a5ff9d6fa193657be0807c7e613e6bf844eca0a6d261e156f3048080185d28ca
-
Filesize
1.7MB
MD58e24c908a7644d717caee294a5d76442
SHA179654d4e5d21d9940eb82104aa8ea464f34415bc
SHA2567a41b329c725676ad35ec1ca1fac36ae1a7986cecd873cfbd31e61abef30b101
SHA512ba72567b09655d82ef601208e08e7755b1f1692f95e83875e49d7e4af53dfa16e782dbbd34c7669cc5fd1413fbccbb9ae901a006b1075984be159cf64992cdfc
-
Filesize
4.6MB
MD5f9794ff7abe1fb9ac9379f7698c8c3d6
SHA12ea59c3fc114a1f0517b4ce5463d77265561a80d
SHA2566cce7025b45d26c055668c0a0194d8fdbf6644a32b6426b264451692debc80cd
SHA5122d8e705062bd8fbb3a875995648ea3adca3c87d6680f2d1e6c848ee77d0eb92994bd150558e922de97bcda98a08f04269f05f50e730895c5478beb022e711b64
-
Filesize
1.8MB
MD5f78a0250671e93498a77c90805005459
SHA148ac200928bcc0a5a9212db0372b827eb5cb5675
SHA256e8bc8939454b193d8a5ca343004b4d89c99935e65fc3e91fe28b63fde8e4c67b
SHA5121f62db1c1d0d0a842b54b7450bbe8f7c2fbaa1664be9694710e724c4f1a8c94085be800ab9bfa254d4acc5f0f40945f6643259ea7b2915a7e4c061e1e7c9774c
-
Filesize
24.0MB
MD5d87d99d82e816581069557550e359139
SHA19d147a47573873783a80e1a5171050a9cfef3762
SHA256309f36ba762e5bdff2a87f35fb9d789ac9dfaafa92b55a22d31887a699efff02
SHA5127c1bb1de0022132ecc6380a321ae25449b31785e7406a8103c5e90e07262ef3a71ffe4154d64e8c7e2bff7a1a56f68ba84b499d36f49894f366ca559637e2aef
-
Filesize
2.7MB
MD5ead22b333f36d9b874dfe91fc07b7864
SHA1813a93376614fbd87a0dcbc6328807acf7f93990
SHA25645d542a0f3fc72eaa321a6c3fd769431e694310041596781601e272b678807bb
SHA5121a89010cac3de85fc6be08db46e283b95fd1e9fea8f5fe7a4f20e9615e0ec6e642b8c845dcf96cd14e8c53967d7cce072e65e71251d3794426751bf33de24821
-
Filesize
1.1MB
MD5bb58ee687485f3daf65115c806ba6e2f
SHA16e534aec796a5e3ee2698b13006d3711a10b13b2
SHA2560b62c09ff0f25ca9da54636ee13f7a31f25b48a163e9d6bb3b612352bf6892aa
SHA512da2b496827168897eb561ea2d65d346a224e3c05808ed4b087f032215a2f651c230c1dedcd8f263c6f4dc5cf7c1bf02d5a540bd4b49c3383dc9df5c10c782fea
-
Filesize
1.7MB
MD5d400358a833791b589de69d61077832d
SHA109f2b30c74637bf89c4a5b9e2812c7f2fd4659d9
SHA2561272ae38b928b6d3c372ddb20d645f3c0fe290aaa290d9fb3d454670cd5fb433
SHA5122d214aacbb0416557038fc25ddbb805f9dc1dad0984242d3f67caf5f8b937c33b2251550da7ebfac113c3ebbb4dc4bf898137772d60ec8cd990cc84333f0e73d
-
Filesize
1.5MB
MD5b85a2bd84a3f962f6aac48bbc3660a7d
SHA17771f39fdf2394fd494778fd31360b5df66db2b8
SHA2563155b5d82c0240a0eb7f45f9131a6ad1133dc6df8cd5b7b9441613fa31a0500c
SHA5123c3ae379b91b35794e72dd830ff6170a509c2a85f177f9c3dff86541c52b97703fa9ec273124368f999a796f367da8a552d50a9ec806bbfebce5f29364dc7cf3
-
Filesize
5.4MB
MD51bd21ceff52fefa1eff3fff1df92cca2
SHA1e93b047b5879b71d078615ac842f808c744665be
SHA2565de9935feb06e8339ddc0b81df110c534fdf36dc1379f402f9c85c54063935c3
SHA5120a0c92a579e24507bff091965e7248a68801ad96cadff0e867d455237052961463346a7ffae3eb766f5af86230b43a966926e7785cf4ff6e2a7a739a6b3029fc
-
Filesize
5.4MB
MD501b311a2ca0867ee6ee77dae7e17d3ed
SHA16a85bb4e0ed98183e2e41d0d468f9d08eae205a3
SHA256b8e43b0c68a7659124852f2075869a1d659dcbbb1372bfaa139a16aceb5afeec
SHA512725143a7748d99633362fa2037d225ae90174a1adbd7ddd07001a16afa4e71fb1912321688cbf0646e7f597963a33a8d88bbed66351eb0956cedc135377c8577
-
Filesize
2.0MB
MD5bdbadba3ea8bbf172a02b51e9dff9f45
SHA1866ae64c43f10494ad6a833ffabe87b6faa40f35
SHA256ae700e245c3f6a87d02e30d320ff3f90c389e78f38bd5ec38d859efebe1c8a4a
SHA51244e67d492234776db6f2f60f9d0fcf623ab43e5a009f465208ce8d49a8babbcad18a8fd261155435a9afbf35c667d883ea30830d5df46e5d2f9747d7ae0acf3d
-
Filesize
2.2MB
MD5b91de0f2aa01fe172407d1846e87d94b
SHA13bcf88ff4cf884dfe58c90a70e6da86a92752488
SHA256062dc38c1b7b8a397ba35a693b64962422c6e7771ebc44e5b3e0fb370e39510b
SHA512bf583a2a350a72bad436f6c8656a4ff47c52d9de2f33e70612f61694a3805bf4c877b84c68a4981738fa819c40ccfd503c78aa8defb559dd6182bbb9725a195e
-
Filesize
1.8MB
MD5ebf89e60151355b35c5db86d693c899f
SHA11c54c9aa248bb46ff3ee2231c17255db7a803004
SHA2567bb2f9b78fa65b1667a1f53eacb05da7a13fe4c92d701b181cd8119627112a10
SHA512e67d0f8bef7611cc848c1403260956ed81abd65c7846118312774b0cc4455ae6a3b5028fd04f08379c623186914b9ca215d75af9aa3f4317723fd9bf68baf3b6
-
Filesize
1.7MB
MD5833763f55d9fccd6def0763d3c65636e
SHA167638d1f5c4a625a775015e68dc735da306adaf3
SHA256de9433e5510861d4f7b570a2fc8320043edcc57f126975e7402921082d76078f
SHA5121251b9c5ecfc666995c6b25225ec75a5cbf5edadd0c09259e1de2618f1d9fe8f217a5afe3f7fd1774a98a0c1f03fe888744388a9d4c8ba246518094475bd8dcb
-
Filesize
1.4MB
MD5f979252bab701abee2ee3104280a5dff
SHA17615c5d4026995145cbbc00a8f3e57a006af7f3d
SHA256a759132270c0b0759f451902fc5925537de59c7f5563508baa91d3876b90bc1d
SHA51235ff7c4a2fac12b157f71858c6961c09a3f682bc284c62492b6ed44d45ad8938833420685b60a48a8f1e393579eea10c98898c3ef198cba791763a40a283916f
-
Filesize
1.4MB
MD524953e2d1bd02f65f226f57a491ff89d
SHA1bb7ebe591849edc2d0b5f6559878c03198bd4343
SHA256362b159676f93dc7f6b20e7bd8dfa59bf2fba79a32fb71c6cc9ab085ca81cc1d
SHA51263b562867f1725f028264c11f2ec755e5cecb83a1350aa1444ad43d42eee1d25ac6efeb4ab1de21677ccb4c16f51524785a1fe9945ee1d835748f1d948acb79e
-
Filesize
1.4MB
MD5c89ef4b095f181e877a5404f65d2f8e2
SHA10d47106a3eef650e00ec44f7a9fc67b69479246b
SHA256d688e5c334e7ef1b81760ec08e6fce8075e12e220288dbffb725a314bf9a8c69
SHA512ff4be74ffba6a92423cc1c26241a7b0a51940a5771df6dc9f9fb20eaade3efd3fbf093618bf34cf46ac2c94f44ec127b5ac1bec2eebcd77777599cc0d0deab4a
-
Filesize
1.5MB
MD5c76b129273837682300851f20b3b5c9b
SHA1320072c8866457759c76be2c2fca45a6b0ddaca6
SHA256711b66f3dd94929f4b211ae9478a369e58358a3fe4624cd8f151a888c09a099e
SHA512ea975b0401ae572ff1e1af1c0ffb67f0a154fdc61d8850d36857f2ce489560f373800a410f64e2bae0f22a7c21ffe9dc6565ffbd0082cbe5ee8f561246a63556
-
Filesize
1.4MB
MD561c173c62a27b6477bcae68781053207
SHA1a1c6113cdee03f04e4ce89d57bc9f68f3f67a9fc
SHA25699973f55d663ec6f16c0708b2e93ecd6ade60d99e49d02e9c25a01cd1f3aa423
SHA5121b212b0e9bccafc97a24b731eca43d3bfa1974a68a51164fdd6153f32a3cc8bddea49d3739c3cd0e0664d1d2a1ffd22d2273f2396f9c007b48cdf4dccb491083
-
Filesize
1.4MB
MD59abf89259c45bac39118269923b9c285
SHA1679cafe804afd8d3e3d1d13283dedbde78013347
SHA256cf59ff0a33e046aa6cb0fc5d46a7b37e4af283db0912baa1cb9b2755b0123f64
SHA51263fe69221b7ed47f167a68a977c00fd743d746fdc78f33bc1b19ff2ceceea75b95ab90c547bd97bd91a39a616385a8cd7e4422c5d9558752e59959b19067d3f8
-
Filesize
1.4MB
MD5d4c1960ca7a24f50bc76ce49e4aa2dca
SHA12460c50dd3093f6312ac9628c41115c605d5e192
SHA256f4bd12aa9dd726fd187d28374a25de5473a06af36f98741a3a0b0e6bc5c47d1e
SHA512d071f581345a08d186c9d1f97ad9054813406cc0ecbaff438d6442138e50b1546ec82b934e1cc2c0275b030e3de0897a85f3f8dd49672b617721496c8f4f1d61
-
Filesize
1.7MB
MD5ef4f6a782cbb76926ea94a412daaabe8
SHA12e619702d264f3d6d397a5612018ac8700da6325
SHA256c2849f5343c12f267338306b97727b2b9f7135b30786a32ed1d2933c02c74af1
SHA51287efe759a4fc25af64eaee612b2e69a30bc0f4a01f9edf2be4d04c31695f3dc45e62dd8c9026561c45f1e817f791045dab82b6e3f50e05446ba0613c19e94239
-
Filesize
1.4MB
MD5956b31ebe2d71f6871c2d39abb5f5ea4
SHA1d23669eb20c8cf56423956ecfe2ff78552e4be5c
SHA256fc4d52ca3f17cf4015003fbd96c5c47e6e2f1f42e507b39968fc6da1503b6a69
SHA5122606e9e0b7f1f1708233eded16e6458b129e95a2d8e64288cf539079fe8d4dde9eb33ee4911fb89458ecd764e5d3a9f1e246508e4db6783c518d47d74003bdd8
-
Filesize
1.4MB
MD5c686314495e70722edcb8f11a283a05e
SHA1375e609b67abf5ce904bc7ba4c3d8b6a9387f4ac
SHA256759fb26043aecc47f3f6e87d894333ddf356028142e8fd9f2efb720bca9b6edc
SHA512dd30a5e817bd80055cda58e156a9a7c15b9297f7b4895272fa0f9f84dc1ae93853e332eb13c55415f9c14520a76abecced7d82fa813115e2f00efb17530f9738
-
Filesize
1.6MB
MD5fc445f337298933768df69628e872e27
SHA1d9430e25a2387168589f13df1dda2f09e3529789
SHA256667afe348b2a499bcf55c405cea068fab3390f8a0e67be5bf93529a13e47ef22
SHA5125630a39bdff2362567a12caa553da03ef055ea2545a05d1cd02782ef667ae420d6bf114c6f6f084b35fd29d41dfad65e9887d95564688c945ae3f3b5f6e038b3
-
Filesize
1.4MB
MD525e3738020a1d45bd814295e459aafd9
SHA1bad68de3b3a0201e843ff5d7e7d981656b141cb3
SHA256ac78180f5bf9dcb61aa0902b3878f7cfb1f6765698422cbba75ef5c559e7ec70
SHA5128b4cae855e0014ff2377dcf1bc41c69276222bd65373d6b474cdbe0411ef849e3b47a79cea78cd7d6df2f33f863cac3f5f21f3df1f81795f7c5b165508e6b781
-
Filesize
1.4MB
MD53a018e5e172da3a2eb02f24ae4194af8
SHA1b50c7b61939cfeafc8f42f65b865ec6109af7fd7
SHA25643a6281c44f9cc8d12c910f7526688232e41c3d0018f6450a17c15f049e25efa
SHA51262d897f759663ddb1d435afbdb34d40b7b6a6603f3e50073645e02788c05e962774ff34e9ebbf4b7f51fa7ac21c81328e98485058614f91452f8dbc9a0cd5a63
-
Filesize
1.6MB
MD5ec2b85e8a39b77c1924277ea99de7538
SHA14ed56a84f763e9d9c819f900edfb7ca5373807fe
SHA2568414f623cf03f239337d43fa5d3a530955edb8fdec3f013ad2d2fd04022df954
SHA5126e3299f58e5c80988891b18640dca03dca9d1a9402fe76535f1036a86cdfd995845844f8141af987e8838a0d7055a90057566e083f960a683c4f36224a9bbefa
-
Filesize
1.7MB
MD5eaddfe550792e93daa0435b81c986257
SHA1b1d86c18a4006cee83f72a9f481ec28371515aef
SHA25638212f243e779eb0218d1fa4f1ea419f898b2e391174417e83f670f5b8f5d10e
SHA5125c4dfdd17606c0ffa14f0f1537238a6bb136135d849751cd8852ef4775650fd9e9668e5dbbc9dc04ed10f046306a785a9eaf93c9116d82e0a4691fba09361769
-
Filesize
1.9MB
MD55d5dc495af94e598d1b16ea40e34e6fc
SHA18e5f621aa19a00c7a97fb9a63b86db5f4ee3b035
SHA2564b259ff5a4ecf443f1cb9c4efcefccc75a0784662c07669a266ee86fd6a969fe
SHA51220e65d11079f45fbfb383a7ab018a08dbed5daa51be07d13e4ca862c7c17299e54e34d5397d321e9c559d95eaa5087efab3eb7bc78d4af75737368f222785412
-
Filesize
1.4MB
MD53220cbe8a1da03af09cc3210d233834c
SHA1331efd46212fa4fcc865ed0e83297e12882d8590
SHA25616d5f18af6596c19cde6219ae496459bf47b5d5ea80e9ef51d8b9cf93a814a72
SHA512c5dfd882a5ba9f72aa7f4ef0437c2c2a92995911da4c5e57e85108b68f570194118a382c20ddd4136655b8ab9ee06202fc689432db590b129ec4ed0be8c5ec6b
-
Filesize
1.4MB
MD508603e3e59008cb3dee1e5579dc2fab7
SHA10ac56cc55924658dfa90242e8f71ed981bf592b5
SHA256d6a6c2fbb7e5c0e674b3022fe9405991d3adaee6315ccbb066a8fb050f03911f
SHA512b2727c0e172555e574e46b289312ee70c18fecfc3971ab4544cdb23a525a09803e70f19383cfd12c2070ebb295fe645e65b4ef74483c2e292866b3a8161df2e3
-
Filesize
1.4MB
MD5fef5f60fc283aad28b729d501e1035d3
SHA1034771d3511f7730a20a28c5a260ae028cacfd68
SHA256ad49e9cfb43f57ca6198c92a6bd4af048ab0a643c34b8250843c59503c406e29
SHA512cba5995dcb3d71e97e19831c6254ce125e59a0c5719e1f0a732769b414175990097ef5abce07a7a4dcd62dc621478f9cebb2b0a3594e552e03af26e4398f9aa0
-
Filesize
1.4MB
MD5691c7eae5562e66b4eab5f3dd4d9551c
SHA17dd9bd870c94c55a3d7e5dd398d1dee09b3ef2ae
SHA2567e551819dfb6d77bc89ec5fbd3dfcc9a460cd9388b34b87db05d3617cb1afb29
SHA512aebeeccfa30efb45279fd3651b5c751034394ece12b80f0b30b0e5102857b0e4cfc2fd196fe592add371f6f37460472c85d8c0b7e680d95d3bef004fab086272
-
Filesize
1.4MB
MD507e461c5338921bc612a1440d554c063
SHA168b5a7512db32bbc1699b18a0df8481f96f6307c
SHA256e3e434ae39bbb553d69209aae229091c5921d5f83fd83950b5a76836f42ce8fe
SHA512f595cc6e2780281089fdb584d6a1045449b4a8c38ae05c057c9f8ddc15012d771572d15158a28c0062c3e8e87be154dfe9bc7a34e4796a388d4335584573c5b1
-
Filesize
1.4MB
MD54e12207daa0c04ded2c591f2f1411ed4
SHA1270157692ac407fae868acd6e7a05e044f85e89b
SHA2568e66496a2f40a7cfb1b69f59581c0c426593059d556fa5e00e542142779b95c0
SHA5129187367e5bc83458fd040413f3545feea15f9ef6f7c555efe537acd81e2e676a82cf3675ea4cbbcf7cae56c5ba0c6b81ae7987d1f428672759b2a1751e881e5b
-
Filesize
1.4MB
MD5a2a1123dd71ccc0ef697c6d161792f5f
SHA1afe009b287af4f67af3e6ca02483d8c2625c0b50
SHA256b97a5b1c4b3c98fb9b975de878ecf26ec4c1d024531d48a522e798ea1b436ac8
SHA5128b273d22a7c4c757801b27a2507e14119f6fffedfebc2da693b193159c4dfb80f6fba2510149da6c031d1c7646eb06d3590a1cba6166293756fd499023aa5575
-
Filesize
1.4MB
MD5e705d9a69dc470fcd1acf4f4fb90954d
SHA10410ffdbfb0ba4b7ecdc101d876cf2af79ebdc6d
SHA256943a68b96a39076eb020629f2d20bb30e2293fdff5550e3a1c9ccd204b0cf198
SHA512a78cc74144f6b8a829a48e7e82d2613bad49ad86b0cb2a22e611a37246277ded0573f3b0ad263c051b67fc713d509b389d78d0c73f08c462c53dd931db9a8a59
-
Filesize
1.4MB
MD5a5fb34b4ca58b59e8ef20a45b296d350
SHA14a238cf90bb85a8abb7756bf5099a22237cb463f
SHA256ba1050726793da3f7cb8e9a13a70a96aec322757effcefeee5bc509d31f3f03e
SHA51242a177dcd1c5282762b7d50f918620fdf9390fdd0d90b10f650f45182fd5b4598103685c4eaaea9cc66353865441dbcfe64a31fa7ae304b648aad4c05d0d606a
-
Filesize
1.4MB
MD5d66d3173c7e7b034abf255a68fa1d53c
SHA1f5822f9f2dad8b155444269bd04c950c9fee0998
SHA256c0c9d9dde8ef81181bf173f683d9731ec8c8950bf0fa9b6d46f3fc3b1617a9a2
SHA5128acf1baee415af592df5349962d872d4631b76f45ad77f7e064ab91fd0e057ced469adb4f404288c902855da1bcbcd67ca8297e9432f13bce58027930f25b743
-
Filesize
1.4MB
MD5900b11654ec3ed52d98606f2678ed03d
SHA1bd7d1add6bf9f3bcf9da5f177da1fe1b2e1fdb8f
SHA256b7bc4c99851db1498b2a4f82d2624df5518840837e35fd263227abf91aeb46da
SHA5123e0332a96ade12eb16776570cf92d6a8811881561582a5c9ed1527df7fa72a9e8a5722d72e21e0b238a0b6aa44be3aae9db7cc0d1290c225eb45d4967f375ade
-
Filesize
1.4MB
MD560dff75c189afe399e25c392dd112226
SHA174c3f5d720cb13af762c0a7e057cb5014ff842fa
SHA2566588a2d507c003545d6a73faea41b9ffbc35e2dcc01fd5d62af839eef9fd295b
SHA512fd32865916ca8e7696ac8d1cb9b79500798ee3d9ae3911342d2ddbd3b2d048895b806d27e181dd4adf48f259d99ff9d848e92b00342c591834f92bf994c21f12
-
Filesize
1.4MB
MD53fdb8f5ed48eb5bd79d6f53c3321ac64
SHA1136ad924e8b14394a42c540d6a8011ed2d9275d9
SHA2561d67583f68f5072d722327ae24cf0baa2be94177b4f24e8f885d28556d6d0017
SHA512bfe6b07865d936b0e2543c3fd31879126517f4f0134e866ef721cb15ad23ad6bc4fb86a27e793d0f88db9f0419e3fdc60c41a7f87d0bf79613c2e9566de75efe
-
Filesize
1.4MB
MD597b835aa18343e1bce80d9c59193f987
SHA19a1bf2240d360d9b125f1cfa5c1049e1f0265db2
SHA256491830a939f44edae0c09a46834bf8ccd9fe5d637234a8a51bfbe3c823e4e8e0
SHA5128c0c406d9a96c0d53572f7c82c9038d853bbadeb63f467bc08b862db1e8a57deb02e970eeda4ad67d54af10df4bea4fad9027f7774981de3c7329623b2d77d61
-
Filesize
1.4MB
MD57682cac0c3cb338a4735a7771e8e2950
SHA145bbdcf4c33aaaa9cfe9c7875a8775792d9696c3
SHA25635aa5148d57ae146e55a6b4746fc4723bd019a66ac892a4dbf18fe666b3c44dc
SHA5125e590ec926811e66c2125cfa8fa2dbbfcb4ec3e52685973b33d25c4104126db89b09093d973e65f9ed75d8a0ac863ae021b45bc038f7a44e894c487148734815
-
Filesize
1.4MB
MD53ab873139dfa85bb34775754ba300597
SHA1220508b1c59284e0b29a5dbe9d07458dff5dd5d9
SHA256ff3cb374441d5f0fa90497a3e3383a77bf408db169598c32741fef9a4488a4d1
SHA5121485570f14fd2bd89b66eb516bb629862ea5dd6225c9a2a37b65aeeba84cacaac81c6136bd8866abce9d5e35d77ababdc39222a85d80355da1cbda3ff4bacac7
-
Filesize
1.4MB
MD5e07c86d79493bd8580c11b432eda6c56
SHA1f25c4b8a1b2e17ee9a8d87472d532a39a45be865
SHA25659913052883ea15ef3a1808e5d66d3e5b9d59cc579c6c2e71efcc76b6f03cc9c
SHA5125c04f0e10bb50ce532eb371666e3315fdfcfecd753389c46fad04cf53bd1551e6bc5330434a61e24a58348b2d448515d3a1c3a44e76cb8bf6d96c29b7768e199
-
Filesize
1.4MB
MD5e665fff87392235387c283fda44c330f
SHA114909dc50adc16ce7be689a083085053f7d18e35
SHA2565315f4aaaa1e66366e9ad0633ff3ffae7265306ab89c4993bf15643e9318cac3
SHA512752dbd7c0c0cbd40f9efca7d96751b1ce7340beb71442d375a806ca558388c17deca90030c1ef01e2bd126c9d37979f5b1eccae3598e36b836b24898648dd79a
-
Filesize
1.4MB
MD5b1c69b8d5d3bb0d96a1d4ce83131f195
SHA106e31b0b52a639c66d208745372510a90c9b1dbc
SHA256aa165ef4fec38212793eba3a5ff4d292afa0460ec096fde500394e6555868c28
SHA51251bf572dcb9d48f961b1b5b67e0b300b5cd1cf341d5c57a927964660c3b73b4dc3bfda6218762adc309b8b44d284eff42c8e509750bf63022d661d1334170890
-
Filesize
1.4MB
MD57c07de815055cb7e42b3b76181b1a765
SHA1bbf852ed54beb1e039bfa67d6b9fcf258796c69d
SHA256407abaa24ccbc4cb98c0b1bfaaf9a127ccb6f4544f785bb6d6324aadc72765eb
SHA5124411aad9e968242bb329b12fdb3091658c9d3f7671c94019a6f100181965696606d6d8d4f4af79158c73e3c4ccd2fce78194cb9cdfccb88f1754fcee892e2357
-
Filesize
1.4MB
MD53e524dd331a650e4d3fcff01ff031f6d
SHA1f97fc54b9ce4670d351c03d52f811d997a0e8897
SHA25611e65e7ae4ee3ab08c493e57efb271b3197e6633b43fed34e634cdbe77472fe4
SHA512d5b3246c991dd00fc4c729522eb32cd43bb691db3a7ceae064b48ba790944585eeb908ba2f5997555b8e8e9972ea7efdd7b9e3f85683c4df45904f7debea578a
-
Filesize
1.6MB
MD5355498da93a6eeefd701d5213ab1bb00
SHA11082470754df003c698cb365a92dca35dd7968bd
SHA2566fdd1514b127f11ef5e5aac6d1538370de47e323e4436d076f094cc57897fb90
SHA51204db8896d1769f3b81483a32357e849968c1b0547b1aac27aac7470db5fa74327bc060c32280f954138de38204d5e722c9f743f52ee137e24b0fef0913a1dc11
-
Filesize
1.5MB
MD53172db82c8c789a89d4376f95877dd6d
SHA149a8e4652e8c05e4df3c91bcdb4c916695399450
SHA256841599920cfb6f38505dfddb362dfd96340b981ea0be52ada13b9e50b377dcb5
SHA512807cd80e2bb905b040955bf86bb926a5829b0df5bd05a6da2d0d5c8f63ccd0c4d5fb03987ae279de7e236ff60ed674141459a6a297535b22442cc461d707833a
-
Filesize
1.2MB
MD58313be5eeb317aa624120e7a95a72eb7
SHA1557e916c42bb8de36ee8d5ce5ea0275784ff9a49
SHA2566de476c143f7875a501dccbd269a6049cbf1b8adaa32ffb80a5a2e97d7450511
SHA512d6cba6f3002ce3e5507fe8844de5ed574db9a1645022482d6946829875ec324d6e309316d2b9e29fd35360a7b91345974afda010fc5a86847adb98b508e941f0
-
Filesize
1.5MB
MD58804667376d7dd1dd664267c4ecd9fb8
SHA1cfc33c57b436f6f75a53b19f46ddb1a09ffe6da2
SHA25679ddc2a1b1a47129f15e218c57eecfbfe1a510570a95e2116ab7f7e476ee7188
SHA5123caa753b26313f6295c3fa66ba8e2c594fbfee3e44e83bc5a750d5e9d5cdb9722b08c0cfbab7a4e9a2493e143fcbf656d443207a54200b65a4bf2b31de939fae
-
Filesize
1.3MB
MD5b2a182b707cfab2e923e6e5819ee2e16
SHA15e23a45859febc3dd38514412875574b0b5a7bd8
SHA25684ccea37c1dc604fa4265e5371248930eaf317d56d5fb5c0ac9c503368c3bd78
SHA512b51fe4162336490c0844f448968a0aca6009370d94abff6ccb9c760a3f42ba39a99015b501b3f4937e77128ccb34d820c6d4d198b57d5dda4ee2c71590321e20