Analysis
-
max time kernel
110s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
05/07/2024, 00:37
Static task
static1
Behavioral task
behavioral1
Sample
audacity-win-3.5.1-64bit.exe
Resource
win10v2004-20240704-en
General
-
Target
audacity-win-3.5.1-64bit.exe
-
Size
15.3MB
-
MD5
65b8b69effe3a23dceea7497e9fc196d
-
SHA1
8176cf59d1ba0564fa23501ad30c772234035081
-
SHA256
e3d6691546cc57c27972fb3f233d626e3e4a362ecb00955d90c71b25ea0bc0c6
-
SHA512
6680567c79edc72d1c533e41addc04ab3974d6723340185f799537c446e4886b507c666a14faf927bd51c4502f5ff5e46cc29ed8891695f2ad943239208e6a45
-
SSDEEP
393216:yAPrvXCG0cTxJQ3ywKE/WpLakO2X976ZIBtHHhbordSBqLTnvM:yAPDfr1JfbES62X97Eat8SBaTnk
Malware Config
Signatures
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Audacity\is-R8RHP.tmp audacity-win-3.5.1-64bit.tmp File created C:\Program Files\Audacity\is-MCIK0.tmp audacity-win-3.5.1-64bit.tmp File opened for modification C:\Program Files\Audacity\lib-command-parameters.dll audacity-win-3.5.1-64bit.tmp File opened for modification C:\Program Files\Audacity\wxmsw313u_qa_vc_x64_custom.dll audacity-win-3.5.1-64bit.tmp File opened for modification C:\Program Files\Audacity\lib-project.dll audacity-win-3.5.1-64bit.tmp File created C:\Program Files\Audacity\Languages\ta\is-GRNQF.tmp audacity-win-3.5.1-64bit.tmp File created C:\Program Files\Audacity\Nyquist\is-U52E0.tmp audacity-win-3.5.1-64bit.tmp File created C:\Program Files\Audacity\is-G3865.tmp audacity-win-3.5.1-64bit.tmp File created C:\Program Files\Audacity\is-52NG8.tmp audacity-win-3.5.1-64bit.tmp File opened for modification C:\Program Files\Audacity\lib-effects.dll audacity-win-3.5.1-64bit.tmp File opened for modification C:\Program Files\Audacity\lib-numeric-formats.dll audacity-win-3.5.1-64bit.tmp File created C:\Program Files\Audacity\is-BOUNC.tmp audacity-win-3.5.1-64bit.tmp File created C:\Program Files\Audacity\Languages\oc\is-NJABB.tmp audacity-win-3.5.1-64bit.tmp File opened for modification C:\Program Files\Audacity\FirstTime.ini audacity-win-3.5.1-64bit.tmp File created C:\Program Files\Audacity\Plug-Ins\is-K4PFQ.tmp audacity-win-3.5.1-64bit.tmp File opened for modification C:\Program Files\Audacity\lib-sentry-reporting.dll audacity-win-3.5.1-64bit.tmp File created C:\Program Files\Audacity\is-C2UFG.tmp audacity-win-3.5.1-64bit.tmp File opened for modification C:\Program Files\Audacity\modules\mod-mpg123.dll audacity-win-3.5.1-64bit.tmp File created C:\Program Files\Audacity\is-1IK4K.tmp audacity-win-3.5.1-64bit.tmp File created C:\Program Files\Audacity\Languages\cs\is-AULK2.tmp audacity-win-3.5.1-64bit.tmp File created C:\Program Files\Audacity\Plug-Ins\is-VU54V.tmp audacity-win-3.5.1-64bit.tmp File opened for modification C:\Program Files\Audacity\sndfile.dll audacity-win-3.5.1-64bit.tmp File created C:\Program Files\Audacity\is-9G1C5.tmp audacity-win-3.5.1-64bit.tmp File created C:\Program Files\Audacity\Languages\ro\is-16KM6.tmp audacity-win-3.5.1-64bit.tmp File created C:\Program Files\Audacity\Languages\be\is-574D8.tmp audacity-win-3.5.1-64bit.tmp File created C:\Program Files\Audacity\Languages\ja\is-0RH8R.tmp audacity-win-3.5.1-64bit.tmp File created C:\Program Files\Audacity\Languages\sv\is-G485V.tmp audacity-win-3.5.1-64bit.tmp File opened for modification C:\Program Files\Audacity\wxbase313u_net_vc_x64_custom.dll audacity-win-3.5.1-64bit.tmp File created C:\Program Files\Audacity\is-7K1BR.tmp audacity-win-3.5.1-64bit.tmp File created C:\Program Files\Audacity\is-AI8CJ.tmp audacity-win-3.5.1-64bit.tmp File created C:\Program Files\Audacity\Languages\tr\is-61RDP.tmp audacity-win-3.5.1-64bit.tmp File opened for modification C:\Program Files\Audacity\lib-ipc.dll audacity-win-3.5.1-64bit.tmp File opened for modification C:\Program Files\Audacity\lib-wx-wrappers.dll audacity-win-3.5.1-64bit.tmp File opened for modification C:\Program Files\Audacity\lib-exceptions.dll audacity-win-3.5.1-64bit.tmp File created C:\Program Files\Audacity\is-V02QF.tmp audacity-win-3.5.1-64bit.tmp File created C:\Program Files\Audacity\is-L2BP4.tmp audacity-win-3.5.1-64bit.tmp File created C:\Program Files\Audacity\is-MD0B8.tmp audacity-win-3.5.1-64bit.tmp File created C:\Program Files\Audacity\is-3URLQ.tmp audacity-win-3.5.1-64bit.tmp File created C:\Program Files\Audacity\Nyquist\is-N9H9H.tmp audacity-win-3.5.1-64bit.tmp File created C:\Program Files\Audacity\Nyquist\is-MANS1.tmp audacity-win-3.5.1-64bit.tmp File created C:\Program Files\Audacity\is-8P3MH.tmp audacity-win-3.5.1-64bit.tmp File created C:\Program Files\Audacity\is-I3MEG.tmp audacity-win-3.5.1-64bit.tmp File created C:\Program Files\Audacity\is-QU87J.tmp audacity-win-3.5.1-64bit.tmp File created C:\Program Files\Audacity\Nyquist\is-0B6C6.tmp audacity-win-3.5.1-64bit.tmp File opened for modification C:\Program Files\Audacity\lib-import-export.dll audacity-win-3.5.1-64bit.tmp File created C:\Program Files\Audacity\is-A9B9G.tmp audacity-win-3.5.1-64bit.tmp File created C:\Program Files\Audacity\Plug-Ins\is-OU00O.tmp audacity-win-3.5.1-64bit.tmp File created C:\Program Files\Audacity\is-9UIKL.tmp audacity-win-3.5.1-64bit.tmp File created C:\Program Files\Audacity\Languages\id\is-572EQ.tmp audacity-win-3.5.1-64bit.tmp File created C:\Program Files\Audacity\Plug-Ins\is-L27IM.tmp audacity-win-3.5.1-64bit.tmp File opened for modification C:\Program Files\Audacity\vorbisenc.dll audacity-win-3.5.1-64bit.tmp File created C:\Program Files\Audacity\Languages\ca_ES@valencia\is-9TRVG.tmp audacity-win-3.5.1-64bit.tmp File opened for modification C:\Program Files\Audacity\zlib1.dll audacity-win-3.5.1-64bit.tmp File created C:\Program Files\Audacity\Languages\ar\is-O3444.tmp audacity-win-3.5.1-64bit.tmp File opened for modification C:\Program Files\Audacity\modules\mod-mp3.dll audacity-win-3.5.1-64bit.tmp File opened for modification C:\Program Files\Audacity\lib-preferences.dll audacity-win-3.5.1-64bit.tmp File opened for modification C:\Program Files\Audacity\msvcp140_atomic_wait.dll audacity-win-3.5.1-64bit.tmp File created C:\Program Files\Audacity\is-5QQ04.tmp audacity-win-3.5.1-64bit.tmp File created C:\Program Files\Audacity\Languages\vi\is-O98VK.tmp audacity-win-3.5.1-64bit.tmp File created C:\Program Files\Audacity\Plug-Ins\is-OOF0P.tmp audacity-win-3.5.1-64bit.tmp File opened for modification C:\Program Files\Audacity\lib-export-ui.dll audacity-win-3.5.1-64bit.tmp File opened for modification C:\Program Files\Audacity\lib-network-manager.dll audacity-win-3.5.1-64bit.tmp File created C:\Program Files\Audacity\modules\is-H8C4I.tmp audacity-win-3.5.1-64bit.tmp File opened for modification C:\Program Files\Audacity\portaudio_x64.dll audacity-win-3.5.1-64bit.tmp -
Executes dropped EXE 5 IoCs
pid Process 4008 audacity-win-3.5.1-64bit.tmp 4940 _setup64.tmp 2872 audacity.exe 3832 crashpad_handler.exe 2352 audacity.exe -
Loads dropped DLL 64 IoCs
pid Process 2872 audacity.exe 2872 audacity.exe 2872 audacity.exe 2872 audacity.exe 2872 audacity.exe 2872 audacity.exe 2872 audacity.exe 2872 audacity.exe 2872 audacity.exe 2872 audacity.exe 2872 audacity.exe 2872 audacity.exe 2872 audacity.exe 2872 audacity.exe 2872 audacity.exe 2872 audacity.exe 2872 audacity.exe 2872 audacity.exe 2872 audacity.exe 2872 audacity.exe 2872 audacity.exe 2872 audacity.exe 2872 audacity.exe 2872 audacity.exe 2872 audacity.exe 2872 audacity.exe 2872 audacity.exe 2872 audacity.exe 2872 audacity.exe 2872 audacity.exe 2872 audacity.exe 2872 audacity.exe 2872 audacity.exe 2872 audacity.exe 2872 audacity.exe 2872 audacity.exe 2872 audacity.exe 2872 audacity.exe 2872 audacity.exe 2872 audacity.exe 2872 audacity.exe 2872 audacity.exe 2872 audacity.exe 2872 audacity.exe 2872 audacity.exe 2872 audacity.exe 2872 audacity.exe 2872 audacity.exe 2872 audacity.exe 2872 audacity.exe 2872 audacity.exe 2872 audacity.exe 2872 audacity.exe 2872 audacity.exe 2872 audacity.exe 2872 audacity.exe 2872 audacity.exe 2872 audacity.exe 2872 audacity.exe 2872 audacity.exe 2872 audacity.exe 2872 audacity.exe 2872 audacity.exe 2872 audacity.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 22 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.AUP\ = "Audacity.Project" audacity-win-3.5.1-64bit.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.AUP3\ = "Audacity.Project" audacity-win-3.5.1-64bit.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Audacity.Project\ = "Audacity Project File" audacity-win-3.5.1-64bit.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Audacity.Project\shell audacity-win-3.5.1-64bit.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Audacity.Project\shell\ audacity-win-3.5.1-64bit.tmp Set value (str) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000_Classes\Audacity\URL Protocol audacity.exe Key created \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000_Classes\Audacity\shell\open\command audacity.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.AUP audacity-win-3.5.1-64bit.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.AUP3 audacity-win-3.5.1-64bit.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Audacity.Project\OpenWithList audacity-win-3.5.1-64bit.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Audacity.Project\shell\open audacity-win-3.5.1-64bit.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Audacity.Project\shell\open\command audacity-win-3.5.1-64bit.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Audacity.Project\shell\open\command\ = "\"C:\\Program Files\\Audacity\\audacity.exe\" \"%1\"" audacity-win-3.5.1-64bit.tmp Key created \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000_Classes\Audacity audacity-win-3.5.1-64bit.tmp Set value (str) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000_Classes\Audacity\ = "URL:Audacity Protocol" audacity.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Audacity.Project audacity-win-3.5.1-64bit.tmp Set value (str) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000_Classes\Audacity\DefaultIcon\ = "C:\\Program Files\\Audacity\\audacity.exe,1" audacity.exe Key created \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000_Classes\Audacity\shell audacity.exe Key created \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000_Classes\Audacity\shell\open audacity.exe Set value (str) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000_Classes\Audacity\shell\open\command\ = "\"C:\\Program Files\\Audacity\\audacity.exe\" -u \"%1\"" audacity.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Audacity.Project\OpenWithList\audacity.exe audacity-win-3.5.1-64bit.tmp Key created \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000_Classes\Audacity\DefaultIcon audacity.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4008 audacity-win-3.5.1-64bit.tmp 4008 audacity-win-3.5.1-64bit.tmp -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2872 audacity.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 2104 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2104 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4008 audacity-win-3.5.1-64bit.tmp 4008 audacity-win-3.5.1-64bit.tmp 4008 audacity-win-3.5.1-64bit.tmp 4008 audacity-win-3.5.1-64bit.tmp 4008 audacity-win-3.5.1-64bit.tmp 4008 audacity-win-3.5.1-64bit.tmp 4008 audacity-win-3.5.1-64bit.tmp 4008 audacity-win-3.5.1-64bit.tmp 4008 audacity-win-3.5.1-64bit.tmp 4008 audacity-win-3.5.1-64bit.tmp 4008 audacity-win-3.5.1-64bit.tmp 4008 audacity-win-3.5.1-64bit.tmp 4008 audacity-win-3.5.1-64bit.tmp 4008 audacity-win-3.5.1-64bit.tmp 4008 audacity-win-3.5.1-64bit.tmp 4008 audacity-win-3.5.1-64bit.tmp 4008 audacity-win-3.5.1-64bit.tmp 4008 audacity-win-3.5.1-64bit.tmp 4008 audacity-win-3.5.1-64bit.tmp 4008 audacity-win-3.5.1-64bit.tmp 4008 audacity-win-3.5.1-64bit.tmp 4008 audacity-win-3.5.1-64bit.tmp 4008 audacity-win-3.5.1-64bit.tmp 4008 audacity-win-3.5.1-64bit.tmp 4008 audacity-win-3.5.1-64bit.tmp 4008 audacity-win-3.5.1-64bit.tmp 4008 audacity-win-3.5.1-64bit.tmp 4008 audacity-win-3.5.1-64bit.tmp 4008 audacity-win-3.5.1-64bit.tmp 4008 audacity-win-3.5.1-64bit.tmp 4008 audacity-win-3.5.1-64bit.tmp 4008 audacity-win-3.5.1-64bit.tmp 4008 audacity-win-3.5.1-64bit.tmp 4008 audacity-win-3.5.1-64bit.tmp 4008 audacity-win-3.5.1-64bit.tmp 4008 audacity-win-3.5.1-64bit.tmp 4008 audacity-win-3.5.1-64bit.tmp 4008 audacity-win-3.5.1-64bit.tmp 4008 audacity-win-3.5.1-64bit.tmp 4008 audacity-win-3.5.1-64bit.tmp 4008 audacity-win-3.5.1-64bit.tmp 4008 audacity-win-3.5.1-64bit.tmp 4008 audacity-win-3.5.1-64bit.tmp 4008 audacity-win-3.5.1-64bit.tmp 4008 audacity-win-3.5.1-64bit.tmp 4008 audacity-win-3.5.1-64bit.tmp 4008 audacity-win-3.5.1-64bit.tmp 4008 audacity-win-3.5.1-64bit.tmp 4008 audacity-win-3.5.1-64bit.tmp 4008 audacity-win-3.5.1-64bit.tmp 4008 audacity-win-3.5.1-64bit.tmp 4008 audacity-win-3.5.1-64bit.tmp 4008 audacity-win-3.5.1-64bit.tmp 4008 audacity-win-3.5.1-64bit.tmp 4008 audacity-win-3.5.1-64bit.tmp 4008 audacity-win-3.5.1-64bit.tmp 4008 audacity-win-3.5.1-64bit.tmp 4008 audacity-win-3.5.1-64bit.tmp 4008 audacity-win-3.5.1-64bit.tmp 4008 audacity-win-3.5.1-64bit.tmp 4008 audacity-win-3.5.1-64bit.tmp 4008 audacity-win-3.5.1-64bit.tmp 4008 audacity-win-3.5.1-64bit.tmp 4008 audacity-win-3.5.1-64bit.tmp -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2872 audacity.exe 2872 audacity.exe 2352 audacity.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2848 wrote to memory of 4008 2848 audacity-win-3.5.1-64bit.exe 83 PID 2848 wrote to memory of 4008 2848 audacity-win-3.5.1-64bit.exe 83 PID 2848 wrote to memory of 4008 2848 audacity-win-3.5.1-64bit.exe 83 PID 4008 wrote to memory of 4940 4008 audacity-win-3.5.1-64bit.tmp 85 PID 4008 wrote to memory of 4940 4008 audacity-win-3.5.1-64bit.tmp 85 PID 4008 wrote to memory of 2872 4008 audacity-win-3.5.1-64bit.tmp 89 PID 4008 wrote to memory of 2872 4008 audacity-win-3.5.1-64bit.tmp 89 PID 2872 wrote to memory of 3832 2872 audacity.exe 90 PID 2872 wrote to memory of 3832 2872 audacity.exe 90 PID 2872 wrote to memory of 2352 2872 audacity.exe 93 PID 2872 wrote to memory of 2352 2872 audacity.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\audacity-win-3.5.1-64bit.exe"C:\Users\Admin\AppData\Local\Temp\audacity-win-3.5.1-64bit.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\is-7LJQH.tmp\audacity-win-3.5.1-64bit.tmp"C:\Users\Admin\AppData\Local\Temp\is-7LJQH.tmp\audacity-win-3.5.1-64bit.tmp" /SL5="$70062,14974996,956416,C:\Users\Admin\AppData\Local\Temp\audacity-win-3.5.1-64bit.exe"2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\is-82504.tmp\_isetup\_setup64.tmphelper 105 0x4D43⤵
- Executes dropped EXE
PID:4940
-
-
C:\Program Files\Audacity\audacity.exe"C:\Program Files\Audacity\audacity.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Program Files\Audacity\crashpad_handler.exe"C:\Program Files\Audacity\crashpad_handler.exe" "--crashreporter-path=C:\Program Files\Audacity\crashreporter.exe" --crashreporter-argument=-u=https://sentry.audacityteam.org/api/2/minidump/?sentry_key=37e6948db02f43ac856bf7edcbe9731d "--crashreporter-argument=-a=version=\"3.5.1\",sentry[release]=\"[email protected]\"" --database=C:\Users\Admin\AppData\Local\audacity\crashreports\ --metrics-dir=C:\Users\Admin\AppData\Local\audacity\crashreports\ --initial-client-data=0x284,0x288,0x28c,0x280,0x25c,0x7ff80c3f7e80,0x7ff80c3f7e98,0x7ff80c3f7eb04⤵
- Executes dropped EXE
PID:3832
-
-
C:\Program Files\Audacity\audacity.exe"C:\Program Files\Audacity\audacity.exe" --host 588374⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2352
-
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2ec 0x4781⤵
- Suspicious use of AdjustPrivilegeToken
PID:2104
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13.0MB
MD5757db4d37d824c61986b2ebd90d147bf
SHA1b21ce7f63267ef6f0769bf49a0c3a9a3334be21c
SHA256e5906bbb4195d0276128b2a9bf150eb70843858289f7b68ee1868c44aa627afb
SHA51250846987e795078649abe6f963d8b56c1311727dd846d9b3503fcb521e4b727801e0a4bd2a27d234127502d6c818cd45be503780e95969ccf18d8b1860ed213b
-
Filesize
14B
MD595e15c085988c0b3a0435448b51e2198
SHA1696863b3211762c9f2eeda7882e34e808eee95ab
SHA25629e4d55e0c05be59bcbc7606a5bdfb3dfa54db83624323a72abec6800b8db97d
SHA512edcad00dc92d3a8b2ce3707c38079570a43a93798d7bafd031cb99864f6f2ec2ac8feaea13b4830062ff9346fae1ea03bf680a55d0d379a63e47950cee11f143
-
Filesize
336KB
MD5d3e58de531549b7df533a4f671117bbe
SHA1b9673d145966c79106483362c90c4ee9f474ba0f
SHA2567df4315463d17aaa9599588625eeb1a6bc922287905a91e0449da3a5cc256adf
SHA512271e17bbcbf513ca816a59382e03db26ec190518f578df431bcc3b791a040c668e910943e79025b5e96b6a5a81ecec855bd6cb7f8c8a844ec6f435e82afbaf31
-
Filesize
294KB
MD5c2e6042b679bb25124fb6dfee03e1660
SHA184fba7081202f4cdab59b1d84cfb7fabcd6f36c7
SHA256687a1003b179488db9d34d81ebf0b800def67c822cb7a17281fd5781830dbcfe
SHA51238c2fb3352c043c231e69fb0a75bc6ff077a0ecd3af05c43c26ab1ff8baba29ef4ffdf4ff8f97357b4bc9a48dfdc759df313c89da94a10a8143fea63cd40e3d7
-
Filesize
445KB
MD59ca86b5e1823370aa6953b257e51a71d
SHA136d79c1e7c8c9200ae071de1fc554c5d6a3e962b
SHA25618ad59cd6590b949cefdc82546d98a73659f38f69e17434c32998fac9b16d060
SHA512daa367d8060ce032c9822962b0ff2b8652154a4eba970b40b4b03a837a90d9e0526f275be477a67a8ac6af28339886db94d59dd6b3a9bfd687a1b9600076dafb
-
Filesize
308KB
MD5be51215fb62e2a9cd0a7ec308b415adf
SHA1c97d89625d8e8364e2a8025359957f6101e996d1
SHA256619b3336144b2572a4ebb160f01f508de4a482ead4bc7c6253786fd0e7a49252
SHA5129fc8a9429ca738638f0c48b33809187eeb3d7ad307313b13b181e6cb36aaa448ed52007e5e642f9e97d55f561f9a542480845a1c9182ce308004fe5044efa4e0
-
Filesize
79KB
MD55d6617fd370db1d2eae431f6ab0a3b76
SHA183a2af689d31e7902a800012f0bc26706e01cbf9
SHA256d16a334e4a6945a790639ef0ac18444907a7d25f163197c964a5548b4cd7d0c4
SHA5128b60c3c079da0110dccb79100d14ef4f6b0ea3c3d15fd7f0e83cd6ad6705b0dae1fc4634b54d64739e80d8c7425e84ab0999e04c9df10e8702e2cf0ed7ebd78a
-
Filesize
322KB
MD59807c8c91f9170a47115b165815e85cf
SHA18b1a69b648eee4b690d8a1e46fefd696e903216f
SHA25604e2f2b5c0be0369b6187c71f1763db767e86ca08d8ef20a764e2d4e87d8d062
SHA5129925ef3c476624affd4d9a22476138bb4d8cd45c0b74a09fe3fa1c9e7e528b19f1605295f4d40be10f99a17b50fcef3566729e3d55709e331beb85cf604ca44a
-
Filesize
286KB
MD5551741e38f9bccdb96835404f1b3020b
SHA12c2fd361c9b74bba54799cbfb01aced571b87f23
SHA256eb5a5a396087f3d924d00bfe2a5bddf51d47d712c932b7db96e9d4f5ef95920e
SHA5123cef18e54fbbf815155995e93904bb266abdacba1485275fa415ec1a08fa3526ebc17d66d165cf10eb1ef9957e194482f7f78b32ffbafc8f935fb2ecc3b18184
-
Filesize
159KB
MD5deda7cc5dc7af39a8adc3606e399d2ed
SHA172aa1b89ccbf34b9459dabac7a13ef7a841a1fd9
SHA256f907a651469a3cceac8cdabf3fcfde7f93302dddc4536d21daeb05d5bc24a096
SHA512789943aa0e3eb7f4786562b1ff6030e8ad76c2396e8a09396d86d7ec510b41e448a798dff8d98024bd85a3fbb16bbb9c48c817b28441c8c9381c402ed0cf5877
-
Filesize
69KB
MD55d6871b37b18568367b2e013a8d84b25
SHA162cc4e20e0506b69689a81131cffd629ca3e8412
SHA25635c9ad7df753b0921fc1a00ae0a593b77a5aa35bb4a3223b44d2be47e290b4b6
SHA512cfc1e6639fecdb13f6015fce888060605431a56a98845dc518e24080c705d59f2bbe2359fe7f47f9c5a4e0697093b79263fbde73e5649b3abbd881ddceb329ea
-
Filesize
76KB
MD5dd79028708fb566f2d7745e91661d79f
SHA106da9f46d6cd01589d6f9771a4f92b0e127e192d
SHA2563bef5fcba13f2fe9decc01fdc4e5bdae480ebf833236dcc23ef7c09cacfe26eb
SHA512322b5167eaf949ad3accd9b07720f71d22adcd9cd807307f0b91806190f68bf3e3f3d31027c84bae605de36b5d3e20a95a1076ec11cce2c3c0090d5dd10e80a9
-
Filesize
372KB
MD57f5b6b447f603ea9ffd20bebf46777f3
SHA16c8631b06aeadf71773312a20780ba214607b163
SHA256cf6d25186d31be5c0437b63668063762454abb2ff947774040ea4fe57964d794
SHA512def0c9c8e596a72da3bd3afefc9d3210bffc777ff5cd15914fb6d9b48db2633c72355acc6f02da1d00f8df6d308f6211428ca9f8e25fd36fbe55a95d44d41d8e
-
Filesize
144KB
MD5c4383f686cc8f5574dfe03737d9beaff
SHA14115f72866c46dd0543fe234b154267cbf9b540f
SHA256ae2216c07ac72b30ca58f569ba25b30dd5fbbbff688c0eb8989bffd3a74eae95
SHA5127afdd8debbe5934554cbc9660709d28e8f6bf07401983c702ed069d97cf513ca093086b29ecf6fc6a0327fabeb7b66059adb9bcd6032e14868bdb91852f95acf
-
Filesize
507KB
MD51ace7607fbb7241a082da77bc28905d9
SHA121df26fd87a6716057d185e9676407667d20311c
SHA25665895354b6d4e29c409bcf2d0869337fbb25c135854babc8bacd9eb685e8bfa1
SHA512c34ddc32c7fede4507c51bd0ac7b0b08f63aaf4b099a1c91ade3ee9bd791e0d6d03aa3c359fd2a65eccbcbfb31a692a5c83f29976874cad967c9bc0fb1513ffa
-
Filesize
445KB
MD533152b5de49c18200e7dd89e9604cbd3
SHA17974067f76d226cb32b57397c2972ecdbc4fdd4d
SHA256d8717bfa49cb016537858a13e152b05ca56d65709a1d0d99a760b3551ffb3fd1
SHA5126a183fbf4c10a3a7d914fcd96e1c6c452396096b716d038fb7cb2d4fb5b4305420a6c7658f344a10129ed327ae3781012cfeacfe872764e6dc50b76098d73649
-
Filesize
263KB
MD5d6166bb1902e4e4d1dfdc2a240e5881f
SHA1ffa8b1b0f16290f2a8939c5f9d453cd6b3cc3701
SHA256611ab8a374406b7ad00b7bf9eaa8052d64c6f53b3b16936a1e20151b2c3affd6
SHA512379a6826f54263506164fea6b1eeb841149d696110c1ff202a5a1f9a44f6b20a743e66096a3b31d279cab1112924320c444fea031abbf70e2d04173fe0571918
-
Filesize
343KB
MD5817d3390540e6ad9d6517a1f0c6faf98
SHA13f8f8832a8bf83abe596168ee9257c7e2bc05f37
SHA25605e7c0982364afb3288db8857fd3660e6aed71a2860fed49509a471bf546e0a0
SHA512e1680fe0d5c7eb548c3cba378809a102fcccf99f3bacc68c7335b7fefd091ac0f8361b90d73c9a521733ba6f35c9fa11535bc52c93c80ab9802277f8c2973b9e
-
Filesize
475KB
MD5a9af832112efa3a002eb27b72e4056d7
SHA115282f9e5089648f54a9dd37e2aa855611439357
SHA2565c2bcc401f60738800bc1a794c093803cc6bca198950caaa3e79cf9a06b52a3a
SHA5127de3360fc2779a1df8b3105e7be61838981dd65d30a34e9fcd1b2b272e8ac4ab0128f8f82304a85daee8e789619be2a2f59f873cfc68400fbed5885dfeb8267a
-
Filesize
219KB
MD5ba248cc9af1bd5beaa276a7b8e3dc0fa
SHA157e0c2cbdadb1fc73d4b3993c1842e50f8436cbe
SHA2563c3f219e8591961688190951481801038f82a381c2cc6a4db4e680995d1d1a88
SHA512c3c1588a50ab4da748b3a57ec35ad3b4b310164096129b33e9e4db155ca3183c029e2188cd9bf151a792dadc40ea71f325cca528335c7109b5ff63b4774e03d3
-
Filesize
392KB
MD5ccdb705f8aa7037c9bdeb34ac900acf5
SHA1ac0782bdda70e1a3ad13f5f44b9da10133367077
SHA256fd5f55deb76f47079d055904aaafdfd2dfb1e8dc2e9e21f94bb105eaf067fb73
SHA51233639c10bc6ae68426092d34d1544c7cf0545e9626427fca9ede1f2b9d685156c765e34fe57eb4b285cf194bad6ca4e9088506a09abd590cf857373f129451b1
-
Filesize
114KB
MD5b2d148dec148a5009e3754e6d7300bf7
SHA15512e99383f65abae0c001cb02de179ebe6a775b
SHA256438d28d0f3259e3934556b408af970af4246f4c4b8eb05aa3c6b0f2b0ae5ce18
SHA51222ebcd4dd6fd1caf0854835ecb579754b5edf17157d4e7db0c42a9c16f3e516542ef30ebe8c1e649cfa76c72a885f583aa6d1e64f3175bd6fc4776934b20468e
-
Filesize
2.2MB
MD537c4b44e4950d8bc2ddc1776b70dccec
SHA15b98c3fe93884f8e07a354bb670928427fcbeb23
SHA256f6e394ae8a0f91980b6613856f144c0f244dcc42b8d739c1d47f88a145183551
SHA512aeaad4b5b7da055db8ce06c96daae0a600c3fefe297043e222be7ac767f0bd67e44831e53419ce26308aee8661c5ac33a1736f592bd49d57e5999fde062493b6
-
Filesize
426KB
MD537858abf2bfc000109b4ed6ddc37a2ff
SHA10c557b38319df91e1f611b61e4d75a10095937c7
SHA256572f506ea4fc5c2ecef9b0727e0c576f5ddc8694884d6ca2586aff7edd6d89f5
SHA5123a2c6fa767a7d6a715f71e5413dd1e246b3ba02bcbb580a1b6b07a8bc0c9c2b266dc831884e519062e769d10f2985e5306a604af1b5c2b989759473ef5e3dedf
-
Filesize
105KB
MD5c906313750ff92cc35c43d090d4d1fd7
SHA1f6f104323576e77db91e990e42d80a65cc63df6a
SHA2567401e82edebf048f597db69c90491cfab9afc45692197eccbab23a5fd0824d44
SHA5127e510446221c92ed056d6ddf10c124a4e469df05d378a491068e629e1082c434ad1121ca7acb514b2a26ca6f1f6e3e150b759e3bd001ad43bb6d4ea07ea78b7c
-
Filesize
91KB
MD5ee1efb0d46edfda751b99679dc0791ff
SHA1a45fa5f7f81d38f293db3ac8eb2741ec7781e81d
SHA256077225e810dc64ed9f49139f38f05b16dd2d8dd62ee113ffbbd9a39f973a29f0
SHA512dcc706a0673777352ca553a6c8fca9334c64513c6bc92b87b87b3dbc9ef0e8eb29b60e8a7af4679a144ece21ebcc05380db0929415f54057adebc5ac3dd214f3
-
Filesize
134KB
MD51395194c8f357a922394a3f7ff4b9f12
SHA13b3aac35d40c6a835e54b80b35ad51a6c5363a37
SHA2569d869af0fe5125b2d0c2b581a465726272d7de693a089e7e493be097fb7defdf
SHA512a99b7119b3953e39f708956bbdded2cd4ab27038385bf1664d9b7fa9928d1ce45a253e00c7728699d2392f3aec7506b2f79bc6bd205e5cb105d8580c56c260c0
-
Filesize
244KB
MD5fbca31f9006011fbc21764d3503c924c
SHA1a6ec25d2fb2b42be9c0f61797033247abd0552e6
SHA25677e8c31b9ab8de1e59d7c706cc2cd57ec22939cee4a32aba222d94ba04b4fb83
SHA5128316ed23353d5219e4f1537a19e27bbf18a4b3524ba705f7f6c2bcb491a3e1fb4ad441b0bce0ab07822299c200b24504eb429682b413808ea0506961af6188fa
-
Filesize
535KB
MD5dbe06dcdfefa13618e188122ea83bdd1
SHA12052c4f2f855cbf4a3ae39c9bcae838a98446bbd
SHA256ecbd9eb1dd1894b2bb68baa66be7024457eb2019a6fb606ad5f34cf342ed31b4
SHA512d800d048a6513673650ad94d30547241f5da4da0247dfabfa986f960e2235cbd9486917878318683588e0d2b8ab58436d372bf24e17eb366352eb0492e61214a
-
Filesize
469KB
MD52ef04a857d6f99bd7ed208d355b654c2
SHA186c9ea58859234a0ff9b850ee85874f2edfdf06b
SHA2564e69dff56e3d73519297104e0273db43ce159d2a42f73da9e9ef98098e2994b6
SHA5129958e0c069d53c0c400c9e1c5318d43960fe09adb47e3cf69f75ecb9df0ad502c04c4d78b05a1823047cd1db40bb800a8e832d19af4b8ddebb9329083acf3fa7
-
Filesize
344KB
MD515a3256680f3a6d462c6b89dcab0280d
SHA11c0865a45f50d346b93d0bdb18970156a9986ca6
SHA256456a88a53cd9db933db805e0a5ceb99625e74d28f25efa1bcbd14a7742677922
SHA51281e02e229ebfd714ea66110c49dc44860ee29e08c3515ce84b8925a44ce2e791dc5d889fd985ea0510d2052cd0ed38c1f4bdc9194304f6f4f78a0d6ba60cc178
-
Filesize
70KB
MD5297dddc414908d918ba681a76762a0c0
SHA10b9cefd61973171ba248832df7a7a8f6618ced17
SHA256e1c3605796434b59cae35fe8cfd8bd6ac78c5eaa54c7b70b282e4eecbf595f8a
SHA512d9fb5cc443a6e18e52f7154a7a25b75082b11af966c7aff0e75e9de557ec062440f54b9f6665286e0fab9422cf5acc79bc8e8650029b6a752037bce6e5ebaf3a
-
Filesize
906KB
MD54b6c3dfa5b2e10b9e60a899da4debf06
SHA1b10957bab7958fba1a0737c4f0eb0838f3738bb9
SHA256350fa70494827ece3a8d2f71cf89b2b8fb56cc842b311b4ef16f9a735c93d12c
SHA5121c9835def7e3c446cf714034dc41fab59febc3c5b18450328e9aa2b02bb67bc45459465e9cca2fd5a68700d32a069b595091831a435d898c135aa72a086489e3
-
Filesize
10.3MB
MD5f638d3d5d96dbd1fdccbbe6deab7ca16
SHA17cf4f88e237b49c00f1b60def78e07c2e6ca426d
SHA2560fe8ecc2a91266f8d5b38fdb900a178190548eae019b04dd78245343a16e0600
SHA512e1870b4d5a502ae478b35cdf42fd896210a8ef22ecd640fc8d9ae237b081e327e3adab35f27a84b410f8312a419bc2e989ee61284ce11dd2434b08eb24485dfb
-
Filesize
731KB
MD5066e4f6156d3d9d9fb363386a4e799bc
SHA11da694d32c018157afaffb0d3961f27a6cdfadb4
SHA2564b5c0f497a3bc2fccb399c3125741024a191834c3cfdf12c0375165b1688642e
SHA51274c694eae3d2fd36628900973a514c1ce4701cf5947769209bd95c722a2374886d9ed80e2e0921932500f730b32a897b72c4d0b8b429710f81da2fe9237a24c8
-
Filesize
250KB
MD55c97ee2884fcf484a4d2ca06bd0f3006
SHA1e6109615ba8ea4cd4bcc79efcf456f82a31fa3d1
SHA25623e8ec37d47f3a268013770d05f449147c9683d88c7d46fcc6c8d5f32c3a4b13
SHA5126c904d4a4b1648abd8f01404fffaa2ea067627310854afcf28e7cab62ee3214bbc66748f43918435c90660c6fef48b105f18240577c1a74fc6a9274d6c65f5df
-
Filesize
3.2MB
MD585e061d92c59f771bcfd6a132c5d90b5
SHA11f0f549922428ba3610128760910d7532d3a7b13
SHA25650e61029fe28baf61e08e7028b5bd4c5f16d0fd52b2c72bb1d259f3bfe1163a0
SHA51283cc6229bbf5e2125fe9b02a8007157ca51bbb4dbb34878e234ddbe95b81a04f1869a802356799e017124ba63206aee8071fc584e64560b9a922cc361a854666
-
Filesize
6KB
MD5e4211d6d009757c078a9fac7ff4f03d4
SHA1019cd56ba687d39d12d4b13991c9a42ea6ba03da
SHA256388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95
SHA51217257f15d843e88bb78adcfb48184b8ce22109cc2c99e709432728a392afae7b808ed32289ba397207172de990a354f15c2459b6797317da8ea18b040c85787e
-
Filesize
5KB
MD58c00be6308a5b6edd494f2d67403c45e
SHA13e49143d3eff9a17525eb81a16045fbf625ba141
SHA256a375363ed45c53b4decd865c2f1a1895b9a5748418bbc99404799a3b995ad50b
SHA51247974cd448aaac04b55824bae177472eca01339d1b3e4cd028535500ea88b6c07baa4225c42be77500c63804e9008a2c0e599fcf66dd40a30c447bfae32769d3
-
Filesize
8KB
MD590d3bf78d11a52f706d148fdad0e85a4
SHA1e1a969ec31602be4947d3a3d6c8ad6467ae9c3d2
SHA256e9c739447373d39d74aa82f9bbc2e1474ad815508860fa670cbc5b2cd1f57b02
SHA512b8ad42f45f4421b0ffac3438f438234dbec994f8ea13ed0036b452908c3b625b0955c607bb4e1ad341454646b60cff6ba7d3c25c5d6d0076875d0a5877e63264
-
Filesize
6KB
MD586aaacbd3b6a92034a6c3d8d560bff9d
SHA1bef46c2fa9108a0a5751f32c38361dfd861c49eb
SHA256072fe8fd0065aac8a4f68297d737db5d7e12a58c57790366a692661075d68890
SHA512eac231e083e82c24fdb641ec73ac09fe1df4e7bb53f0879426ed28e1ff824f239e123dfa42595731454e4418cea7d7d5389d243edb5b27ca1b0f6614a289687e
-
Filesize
7KB
MD5f16122a70c66690e5eb494ee8edb1df9
SHA1a06aa11a537ca0fbcf66315a8a89de8aa1c1163c
SHA25689d9385b7ea77abbac9daa6f0c0913b289bc6b4fce56d6a12a576650b928d904
SHA512b5f6fd8214445ac2820c6f495375bb85ebf5528c5dfb7f34269c684e09c1d186b55887776a29f26070ee497fc2421b381420cf95f623bc08853a2ab7177091ab
-
Filesize
8KB
MD51a9c70984fcdae21882ebae5a9cb1fac
SHA1e3463dc37619d7df74f403430b548d8830558677
SHA256656fd7005ec6e3061d01e4f31eb3ca2bb4e5874555739215890d90f477be7c12
SHA51263a2979dc2961fc95da4df1f3de198154fda23685cc3e517cf6e0a9f882b061c8c305cce6aea6e976e3501a6d8ee06349e4ea76fcea274562ec759fef830732b
-
Filesize
1KB
MD5521f79c9db64e9644d1e8a3880f28c0b
SHA1f7e6209cac811076ae8f488ed6c05dda6c67da22
SHA256f71279d64c049f72876decf1c07b5fd33d71b22c25a12f474042695fb9b96507
SHA51222e69a12c0b26ba4e892ca6e776646ca07d84615bdfc749e4349c6a3621fd3abd1c2c0d678864887ea6d71151a4a1b250253e59ea4958222da4e7803b8f2ab59
-
Filesize
40KB
MD5e8b22082dc8ee481280b1431e334ec98
SHA19243db56a1031e8d97dca2d0cf8444de086bd0ea
SHA256efa0eb1093629005397af04f9cbf05f0230f690d2d469a2dd9e7ca23af4973c2
SHA5129a44298af784cd7f6ed0469ae238b67d0f56873b2f84b238ccdd24af79b1351e1432c987c8be315a0b187aab041605147f68c19c90939eada1eb8d95e7a26e45