Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26-07-2024 07:06
Static task
static1
Behavioral task
behavioral1
Sample
9a082f4a06e66228bb10015f7c9fc6d0N.exe
Resource
win7-20240704-en
General
-
Target
9a082f4a06e66228bb10015f7c9fc6d0N.exe
-
Size
1.7MB
-
MD5
9a082f4a06e66228bb10015f7c9fc6d0
-
SHA1
68db3bda64ae113323c0a9fa145f8ae8a1c9bcd6
-
SHA256
c4335d5cc22eb2c629991191f993abd7dcd48580ad5b71402b8d061c1faa4391
-
SHA512
ee94103997b9f08c4818194324ac8bb3a3856004ba4b942e11c87a0a4e9088f076b04098d86e3129186c5af81a99b47f9c1c96faf9b7499308792895b9b3e439
-
SSDEEP
24576:Om3YCdCTYlBeyaIPta/Bnf9ox0H6Ulnj/C70AUnQWvu:L3YCUTEeBsapfKx0Hjlne70Lrvu
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 4244 alg.exe 3112 DiagnosticsHub.StandardCollector.Service.exe 2796 fxssvc.exe 2500 elevation_service.exe 3904 elevation_service.exe 4756 maintenanceservice.exe 3500 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\system32\dllhost.exe 9a082f4a06e66228bb10015f7c9fc6d0N.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 9a082f4a06e66228bb10015f7c9fc6d0N.exe File opened for modification C:\Windows\system32\fxssvc.exe 9a082f4a06e66228bb10015f7c9fc6d0N.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 9a082f4a06e66228bb10015f7c9fc6d0N.exe File opened for modification C:\Windows\system32\AppVClient.exe 9a082f4a06e66228bb10015f7c9fc6d0N.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\11ab117e720dbab7.bin alg.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe 9a082f4a06e66228bb10015f7c9fc6d0N.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_84812\java.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_84812\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.106\notification_helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler64.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateComRegisterShell64.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 9a082f4a06e66228bb10015f7c9fc6d0N.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3112 DiagnosticsHub.StandardCollector.Service.exe 3112 DiagnosticsHub.StandardCollector.Service.exe 3112 DiagnosticsHub.StandardCollector.Service.exe 3112 DiagnosticsHub.StandardCollector.Service.exe 3112 DiagnosticsHub.StandardCollector.Service.exe 3112 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 656 Process not Found 656 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1556 9a082f4a06e66228bb10015f7c9fc6d0N.exe Token: SeAuditPrivilege 2796 fxssvc.exe Token: SeDebugPrivilege 4244 alg.exe Token: SeDebugPrivilege 4244 alg.exe Token: SeDebugPrivilege 4244 alg.exe Token: SeDebugPrivilege 3112 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a082f4a06e66228bb10015f7c9fc6d0N.exe"C:\Users\Admin\AppData\Local\Temp\9a082f4a06e66228bb10015f7c9fc6d0N.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1556
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4244
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3112
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:380
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2796
-
C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2500
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3904
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4756
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:3500
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD530a176776d3c6058870571fcaf81def2
SHA19480205867d8458b24f458ecba9cdca06b95b4a9
SHA2562d953dac029b471172b48ae50888369c7be1bf8710013719cb64f0c7f482efb3
SHA512750c92667d68fed7b6617ef37f360c64236e178e540dd4f0301fc25abf9e57ccc3a0400a3ea5151257e395b133768452dfc784ad613c6f853de09b85d8ca248b
-
Filesize
1.6MB
MD560a4e486f9aa9cfa332bc91e7fd241a7
SHA1dbbfc85616398c8f68b1d255fa1e431a41899ebf
SHA25667aa701ffa7df7846c285c0717243b9b7b6c0c7a0585c73ea6fc345bf717e193
SHA5127bb0e09a63ed88243a89747d6de2435e294fad2966de2f32a89411eb8a6ea32ad005aadcbafc8f6909e90d662d01f1ad4efd2b7a393d6165c28f71f85ac322a0
-
Filesize
2.0MB
MD565a49c2c2fc7d3b6f663a6fe43fe6ec2
SHA107291d68c87c5f7deb821c583fe03b5a9ff355e3
SHA2566a53134601013dd6f85f8349b2f4f3e26eed9cb54cc40707625ba5124b357739
SHA512cedbf31109df3841348ba5b87cc57f29dbe452701a37fd427a654a651b498512433e0f404ca684b419d16c64a78bf777b0f29595cc02dfa0c0cd5cba61549a9d
-
Filesize
1.5MB
MD523f48f6776ae61ef11e10fe8a720c4ef
SHA1a50342c79d821cf8a8e94b2f1cd02a997ac3cfe3
SHA256424b56b001eb3e2179a52f6364f9e0d643a4cf01663384b04ff057756114e125
SHA5127e8d420443d615146127e3e5c8452822b9861b594357da86d217084d32589f430be8f25f62010f1438905ea173814b46b0cf4e226e80b0c982484958340494a6
-
Filesize
1.2MB
MD5d7f19daaccca2934ffd1145abd1f88f3
SHA1adf8ff51c4720c285c5cb8d18b32684bd89f799a
SHA256a9027c16d3eed0b3cea21e26f3a287c7821acc95998149eb1e364d80118e356d
SHA5128fcc85bbdfd1e6e0cc38a4322c2fb6032a2370625884786d0248abc4b6213b58141d0897ba4c8184c7c173359ec6dbece1e0d23bdcdfa92c4b57c085b61ea395
-
Filesize
1.4MB
MD5f800ac82656684d51e2e867988d991c6
SHA1d3e1192bd70a9a71a1798623751efc7106f055ad
SHA25636f99f8652ab7feb0ac8986145e16edadb9b9fdf6fc8f3756790c9b357b2a103
SHA5124d1c8ba3feb8b0f05debddad22453be2bf4502c79e0293ced331728e7c24b59e7585a92d4bc863d759c77d1425ca7040bb699f07e1f89b2e052c07b6e6049a79
-
Filesize
1.7MB
MD59a5e283a69fa8a4509e2535ddee58569
SHA19fec1fc9449b0625f0437bb94f9b1a78891d3d9e
SHA2564a3e06d98907b08f4a038352ea29d4f894d5fd442ca4e554a243507d42c0ae35
SHA512ca19900d39d8c6846af269dd99eb28bcfaae7138cfee1798588611de24f9c09243bbdc0436242d58e365552742e49c2859f6dcdce2613dfdea32509e767d4f9a
-
Filesize
4.6MB
MD5cceaa1e9f357035d1ee85b932dbda31e
SHA1c67abf1ca1f5fcff8dc2ffcce48f36005f78f496
SHA256d5f35eefb46e357d22a1d3c4c38383763013f194fea67475f65c5ae00aeb4d35
SHA512312f40c5f22e26a6eb56c1ac9167409e5f3ac5994560b7be5be5ef333501bf0c15e21d64edb6cb9a7f27f4182133d442a1ce3c2bbf2aa68e0611b8d6195faedd
-
Filesize
1.8MB
MD566085ad0acdfceed3efb71d8f4de53f3
SHA164e777c1860e47b105921a11367f3dc1ce34446b
SHA256647579256e39de5eb93d8aab4f8542fd3c251fcf891be6865f6183b7e019de10
SHA5124e9948c100c5c91639eb7c1c95d1ad65abff3192a7da166a234b9e0889b0e1380e9c4f3324a8d29118786e03468ebb4452e1aca9ebe8fb13c5e0514f5dec4108
-
Filesize
24.0MB
MD51fd2ae077680c89aaf877031163cd1a4
SHA134346b98963ad76c8e068900985ed89aa6e9616f
SHA2567e49ca852f64dcd581771cba39b24985760a12e0d7e8497af32178f037359e98
SHA512c70a362b37448e162af801cfb694e80755fbee9756c543b27a34831089980514cd85c93be943b05872cce42589d8b9bc4ad51c450d2d0a67ab27c57364dfaa87
-
Filesize
2.7MB
MD54c4a6a4efe4455c6fe724f556fcdc9fa
SHA1f6e0797e0b4df2e906ebe71a5a70c4d19bcd4d5d
SHA256be7fcb822c4e9c699da076abf95daeb4e381791d40f1c4ea176c0decf155fe79
SHA51262eef3e84b2a6904f21578a8088c7dfb89b72e7dd297dd108039d5337fa0d106d3eea66d9dbca8a8aff2ac1de568150e58b05f6c523e3a3773eb7e705356450f
-
Filesize
1.1MB
MD520cba3ac21c2a0b1a09959d25112ce33
SHA10763e88ccf623d20a6c4fe7dbdbb220fe32eea17
SHA25623c1e40ad93c22851d2aa387301932372f941e071ac832775f1455c1a1ee66f4
SHA512ecfd605fa81d070d43addc47047309ede658b6f1b3b4e3b1feb7a8f7125c264dfea2efa29b50240d04db9974169998ad3f9b47ef972c6ec83e6256a8f99c936e
-
Filesize
1.7MB
MD52e809e6a5657c168fd2d2e9a4a50211b
SHA12149870da725bde4599081423201c27c88cf20ec
SHA256301265c4e8e1c7be68f57ba4c180b6b8696625947caef4f548bd70a4810fb64a
SHA5128900d9eb0622e82429cccfd0f0c931a02bc9ebba334f59beae949e570b626c9fdb16117603beab4fb4a20ea16bf531d6ca9d63f6d4769a9226552b4cdef3d364
-
Filesize
1.5MB
MD517328a310047571fe71db8a5df439779
SHA1216b82a170f7fc2c7c046096659eabc66fcad9ed
SHA256af58022f01c89341f0d519492483a2e0bb4b00251f92ba4762389a9d3393eac6
SHA51249fdca8cc43788154951d4776f12e081560a2622e35021b952da9cd853d4e84cc1294283e9dde13f2c4a869993969353e5a7b07a54a5f32ae70d07cb50deee0f
-
Filesize
4.6MB
MD5684fcf23e88ff1f00e8b79d2f23410bd
SHA19f55712e8a464155bd43ff73bc98ab4bca79de86
SHA256193b38102df7fddfb114d9a717d6c987478a90ac565a6e61cb1504edbb134cbd
SHA512b9404e619bd9bf4f05ba5568abe5f162781a6329d2c1f8375c2690ea08a82317c9f5bb7ea51a9f05ba8d26ce85f139a48b3d66e7ca1bd407a36d64723030c1b2
-
Filesize
4.6MB
MD5c1729ca52092c06a74b6a36c52d3ad66
SHA124d9a49b80a9092c7ab80f2b518f0c76ad643175
SHA2567ef6138ca32aa4517dccdbbfda06a558140d0f7140b06bcf098381be5087a0d1
SHA5126f46d9fec68c00e428b9b229d4730c3ec5e4ea2b2e98ba560d6fb87173eaf4676d082318840fab2e95d918da4ebe24c26a436f6e038fc95b6b3afd4d1c93dae6
-
Filesize
1.9MB
MD5dac4b09f8ec4bc9f7e3ef6130b1482b5
SHA16c71c8f0aadf485d1bf74bee421c21082da58b17
SHA256c13970501ac6b38c418530226d8e31f2278183b51b05116b36a00631bb2c40ab
SHA512dad8ddf345f8962523a0607d8b83fbfea0c5bc2536c4c23db2da2fa1458550540366d5ed05612d4b1ff50c0df951163b6398782466a2671046edb11922667b27
-
Filesize
2.1MB
MD5aba918e4b53a7b4d3600f654cc9701a2
SHA10287f0f44708f5bc12c32ce810443fc11bf3a830
SHA256f7f5be07db9c7f3825ed37cceec4c657ee33a6a68bac776dde74204b84ab397a
SHA5120be3cb243bafb7c50437f9a3b8f1d819cdf2d24a4060b6ebbb9ee0a31a3caa56cbbc7b50a7dec4ad1bb485d8552f1432d283d5821ed7f581942ddd6d28e9b4e6
-
Filesize
1.8MB
MD5c0610d423a2322ba25078d7d3c81f6d3
SHA1972450555a3e75512b339b5b3a4a24269dbe9918
SHA2567814258ded5bbe8dce9460c441025d6bf0de233bd11c6128a9f83eb6b89b5e8b
SHA5125b2f08b1e49d20f537117952b91168db70621d95e55bde4ddce3be26b5dd007030b73d90311acd2e1086a4b757d3e458f7f941f262b94c79b77e8a9f8616fe47
-
Filesize
1.6MB
MD5522ab1d7a884d5d60e74ad97309794f6
SHA1a0783b7e3d2ec3d917ea044b52090626b94db7e4
SHA25620283b77f17b31cedda9ffd14c6f2bb8824263f49e227de54a0c751bfc75aa30
SHA5125c680b840bd5b6c61f1eb43974b68c51dde345a3511863a66e330e8d1fd2a649f2733f382220c2762778291be2a888a44611b61242692701f6ac5855a7a99a34
-
Filesize
1.4MB
MD5f689f3b0a750759278573c0a4ef4af84
SHA1d69d6b457de9e11e03f89415aba02a8b5e7867bd
SHA256e03b94b0f448995f4f5ffc50400f970a445ec725331374f4ab85f38e4ff51641
SHA5129172c79470c1e96280b6ec013e676224ae75bd58a018f5d98fd795b9a9bddbf0202ecbf3aa41e73e7f3b6d02bb016372d8719a54831004e7a5449ca39d312250
-
Filesize
1.4MB
MD53f195656cd934641899b9cb1e0991861
SHA18841ab2c9e8fd1da14cd38bd5f91aa04a3d9d0e4
SHA256922768243827203d09a5bef66d962c4cbf3a9c3307f6a6c0939903c16c36d388
SHA5120f1001f536ad1b102b15d3996cb53cd01797d545300bd5a8dacca2084300e00de0c3ddae70bf60a18a728374f2aac0264f120adbc8a20d4ebc49556455c556e7
-
Filesize
1.4MB
MD59e44c4b6c3a0308f19b7c58ca5a8205e
SHA126f1d76be320cec7859575c36a00380b160745c8
SHA256bcf6c02582106b9bc12b9b27f494cb83e166d78b24fb2208285680a3db39e674
SHA5120be155e3c6d8c5851e3943d950fde3c6b0d1e0b184797d86e46f812dfdd743de4875f693eba671792797abdcf3f0b8a783f6ca490a17196cc4dc948727c4ca10
-
Filesize
1.5MB
MD5523d2887f7fa44b372b0b8485f77f73b
SHA1f7f836ef0e3e03b2bb31cf4d09c89f19cf45fdd2
SHA256dac06dd46e2523e2bf92eaeb856667eedb481f8c6d92352232348bd980815b79
SHA512074da7e411a3084fa9d9ceecfa5ab9c20ff6fc70e971e3422b721b38039903c1e8330f8ea95acf877ccb16fc74ff9c652161d977437438f169dd4e3ca7041af6
-
Filesize
1.4MB
MD5db0480d8025822280db6a00d32d95b0a
SHA18005d0bc5f0dab739cb3435fd5ab058b8373b680
SHA25678669ff04feb5c325427cbcf56d77410dc4bd8266a73e5f6101ea3ad763405e8
SHA512f73e5d1cbeb7022eb200ed91c564c1a8f545f332af61c4afa4e9e4386d0d3cb1ff48a6bab18795fc32251bad64ec3dfa873d629799ad83708f78d34f5ea78b5b
-
Filesize
1.4MB
MD523a55ffae59d43c95830c6e938e3db10
SHA11416757f5d730211c45bf674e83275616b31261d
SHA2566a3e9c3e63fd60306f5c2884c2c9ed4f14d047a3a79cf670e7753a1a16a7f1b7
SHA5124a2726ee5a4330469943a6c25f3e06e9cef03cbdaaf3713e22067db3a017e2e0866e9ecb3df156a682c6333e3dff046e5d93d8e0e40b2ec9ad76b05cb3a1485e
-
Filesize
1.4MB
MD50322bca481c502188d8c299bdeb3e834
SHA182433d452a2f131eb41ec222139ce1a4bbe41a24
SHA2560364e71be8b86a293d122d481da9e3e320cc8c3bd31c07dcd3c830af41e41a0e
SHA5127167a439815fcbdb90e303ccb0f1a257e8e5f08fdbf54020bad41312240e10ebe4ea910f81f524c62beb696209e9ebb31b3859f64c06efd03b79493d648d3439
-
Filesize
1.7MB
MD57333a8dbd0d51b76fbcad3ec71bd4640
SHA1883d69eac73c60adfcc7945a885873d4a3a4262f
SHA256b331fbb859378664b60472cdfb83240e7a144e3a28087ebf2146266633958034
SHA51286c4ddee64fad2ad32d7ccce407a9d49af96b4263cdb827b8546632ac2061f6c0fec54a382c1a91e65257dadbbcc3e8da844491e8f0a10f8ae77d429d7b36d22
-
Filesize
1.4MB
MD54a77490eb8b2ea25121160e58c2f2730
SHA11fdfca3ea200d18b66d8a784c3d27ecdc65a16ea
SHA2562aaf209482941d27655e27b984e224487a83121e83a7b27fff877c56c0016221
SHA5122d83ab7e09feffaf11b8a57870110a431b39d0c8ba20135e0ffce228488f16cda2fd1c4d3bcc6b31f6df5926b82c5344284aa83ca2971803982b13a87c459fac
-
Filesize
1.4MB
MD50472ded6121a722e4c54efefaeeffb45
SHA1e3c44770d198b8a578bad8d635e461d56a627ddb
SHA256861ad7c38dad0f51524417f0aace2754a682249e2ed801303c093d173122d8ec
SHA512761fda0e169c8e4b053b6d3d47b023efd6e3b554934a04f60df481aae5d384a51d12e43d1e0a4c9efe08dc8a777bf289cd7f207067dac43a79aa4dff3dbe0e3d
-
Filesize
1.6MB
MD5b3427e1c9820f2824e5dc0788d44e4a2
SHA1946faf37cc8e2906c365939ee631dbf32330d23d
SHA2562090e875ef29a7a961d11bbc817baf0b0ff4e67facd6e73d66ad014efda25ff2
SHA51218bb584e46cc125abc7d4ac3c2e405864f82cc4dc099296eb725d5cfe3bebbe9393e392344ea64cf84d779173db62ed766ab70aa34057e9c76a169d1cdbe5c53
-
Filesize
1.4MB
MD5ee44b43724d037dda4ecb662d087ff7b
SHA1ae1e3d7d033fe0864d6b31a425f163ef9094ea53
SHA2562ff0f1f416527142dad7f1ac47bb46943b94a157c821e3a5e56fba04408c75d7
SHA5122e268496d4bea90d661ef74605fb16bdd4758e9bfdd30164754196edd9e8db59cbd05074d1e93433d3869898f9c92e48bfb64b9ce0592e1045e6a9345cab0f89
-
Filesize
1.4MB
MD5ba9554077971b51b8ffca2284f9354ae
SHA13e3ba82104de344540e26b8374ba0cc41ecf0190
SHA256b3bc46d10aa8ee659c865b92f70ab6f3772ccb2af7dbda3d07b44b524b5ce597
SHA512f57962f4fb7f7807ae78f71880b222157a55cfc00b07da7fbc1f593c8873150f2b8bef1de8f6c0394e1490314857d9782c481687118fe4369845654ca335d539
-
Filesize
1.6MB
MD5b8beffa8b0af53ae2082a84bdb0834cc
SHA12ecc3b2ab02bd2de80aed945759544a5822a5cbc
SHA25626cb03c8f2679d87b17f0e37e26dc0c86f89e367d29c9ad4d3f8de7ef6f03f52
SHA51208930e1c3c8d221a95c9f733504e2f601bb1b54fe31ef480c576adccfe2b4317fc729be76cd01d83112686e7495f514810185290ca954c0522d194f903f7622f
-
Filesize
1.7MB
MD5aa9dc42bda9794d9bef6de97d68af529
SHA185adea8de4f58aa2db8c31cb0a2530eeb0dce2fa
SHA256c608b5284b35f4db2e433cbb2e0b0ca536f16fdbcf30eeb304aa6f009c36d3d6
SHA5129b414d7088150c5adcf2151083a10d8bbd7aa2a8b9ce1c01c32f43cceea84a8b37b3789153053295a148a6c2c0f9961ed0937f9d2286faec7b954055a19b74af
-
Filesize
1.9MB
MD54c91a2dbd3af60fd3a0e14ce5eaaa7a5
SHA1f62962b1cd741ce5bb93a3d49972a0fb56408992
SHA256ec95ff53c55ad110a849eba3dfce13b6113d309702cfd3701069a3865726cdaa
SHA512db02196364a84b1154b6673e7efd54f84ae819408db200af19306969211b965abb68a85a4ec235d332a3ca2a9706ac4f90b026b28624eb4878cedbb24df14ce0
-
Filesize
1.4MB
MD5707b57a2b5b759000e9c31500b7ba422
SHA169ab78e6019772464679b2839ef9e4531e968813
SHA256d1146ba3560ea26bf7d8a1c5fa6afacfcd15b3138644fd1383f8e90e6973872e
SHA512c2c05e31fabf31efec486c101a6d5d36a68fd53f1f4a4013f5b4ef028c343c0585e18309346c3cc25cb6aa71cfdb31db6815cb8182de080cbc52a2e07aa4f8c7
-
Filesize
1.4MB
MD57e228b350d37adc37e7f05cf4af08a05
SHA1aa5766ff45487aef26ab82c808c2f6aa9bc92c24
SHA2561ea3329d8f8c0a090f53670d188a018a4c1f8b3aed33c1e111f8b865a0b7c9a9
SHA51298d83f01ec561e2d3bbf290853778e54692a4d7811dc07b6fbc63a9a67189e0dbd8748df017b188ffb2f09cae4be8a48724ce6542082907b0a00a6016d3144df
-
Filesize
1.4MB
MD589424967ab60527e74aeaf6b354df12d
SHA1e4a2b46288f26bc03b33a5ac1a2d8b9077ec4707
SHA256fb3cbbb4e8b50a51459ea720fbb06222e7cf84d5ffce65d534daa161d5186ac5
SHA5126b7afc88ab59766e04faceaa1f393c21663933c23b3beb6718cc043108402f10ba95ece9dfb889a1c2313adaccd48207b063825fc79a24ed8e75f09b4e50d721
-
Filesize
1.4MB
MD54dc48b7130d0ccd3b328d6ac6614acc8
SHA1fd89d9c6fb25f7ddc435243c20535adc20973d77
SHA25675527ec838a171cdf18c5870b679704b40658d441e16c0d3bd262abb114ff3f7
SHA512ed2fa6f71f63a9131b43b10b10b698316b49059605b4e1eb8aee0e511a0c5ec974d0ba016ae1eea515101729cc64757a801a5c0b00aa8b2d1353fb125d15f917
-
Filesize
1.4MB
MD558065f7cd405a8d78f78b6ccbf0f2f31
SHA19483b956996aaced18b8420bdbc08c3005efeb88
SHA2569037a174e515b72db033e50af545a72d41b48a70cb82ebcde38603df0b61e716
SHA512b09ad823eb388a3be9d8a9bb57bf6a74b1fded718a9ddef0042402606237c66e2df772b13840e3136da8de997e164b0cec89f2f3b4cd8e01851109a2295e6192
-
Filesize
1.4MB
MD53f29e49fc75dec782e59eb468f333c2f
SHA156c7ab5a426741f48b62ea9070398e5f05fe6b8c
SHA256a20b5c59342515e3995557439a2bc537454cdac4cac7bd14f6d895e746973502
SHA512bbfbcff023d12c42d2f42dcab5ac12a2522536a9ec93f8438d310ca00c9778921363cbbe7858a696da2d10d6a067859727757dab75695df13157c004cb67b36f
-
Filesize
1.4MB
MD528a0eaf2119fb7ed7d9e2c43d9e74e1c
SHA1412871a02087ce51615a457346461abb71f38f78
SHA256dcd0000d60ba1f88b55a64c0569dd69b3d47b912f9fd161000d3f23e774af693
SHA51222b551807a61fef42e917d6e94c790b245b0fe0f834378c11f5ef54f1e4b7f88b35551d8b3597dc3503d192caee9a60a7052472883b2069e74704a099433b5c3
-
Filesize
1.4MB
MD55437064a35b45ac91c08a17276228165
SHA1f46e8e0a528028c6342c94cf6419be7f6dfefaf6
SHA256160a5cdcc0fab1210649a63d16806a25877c520e7fd618a2b9cd99926d1ba4d2
SHA512f1f65e11f5f542bb7faf6ca56b444fae4bd14a11d8e4f598796449e2dd4a9413fa91160198541536ba67c75766790e745e1b2021844540cb8b9d1ff3e5c9367d
-
Filesize
1.4MB
MD586f3716d8b088b7f02b16282f2d7c185
SHA1874aee38dd00ac0f0a33be9ca1b492c257475653
SHA2562821f4f96310c1bbb5cfa3fc12154e5048e94fcc5e5dee9487a0ced2c226cb16
SHA512fcf84cd51c063e7c1dff89dcb8588e09f095ae53cb38206f5006c1a1f6ea8a1cfbd632fe3e7c3486d81914473847f4fa0548074fa7f8e2ce8a6d91d5484bcc71
-
Filesize
1.4MB
MD5efe247face4976d8251e09b6b012ecb0
SHA1b906a0fb275f431ad22457606393f82f10cbe738
SHA2560126165dd197b25499b21f664c5c5e91ceda4a4435a65aede9e3554a46b04509
SHA512b97af4150127c4c07fe0053d6ab2912832f62636f1fdaa62e949eb68d8256a7829426fc444c9b2b1707148e3ba00db8a2c38e283ba1ca0dc48acebcfc2e0536c
-
Filesize
1.4MB
MD57c79cbb5a88c043a4abb6a170fba67f3
SHA1fa83e1df4fc1d88d5bce2b08e0dea02a2d03fd66
SHA2565311c38c77a33546c34f247a498305709010099b67f59235ff0eac2c23051708
SHA512644edfd9f54171f3c0d6948f5082cff9009b04ab085d2c64f79d8f09f6e2076f89a314eabf2d9a8273998acaa4816207b31faf5739c5a1fe790171a355ac4c8c
-
Filesize
1.4MB
MD5afaf0d0c39556af3335956f5d44c6d0f
SHA1fc65e7e8a72b03f93775483f5ac35383daa982d9
SHA25628d4f2b62eb020ec28b9f2c052dbf9b5e2d5e7fbc37009136a38ea25c2ab00fe
SHA5128531a4b0d3bec7c4ded463c18b1280f720635775a8277dcc3aa8b6ff29ee963f07d8cacf35563ad3cd337fbee614a64213fa721c6f80f7be9c7ba61875e163ed
-
Filesize
1.4MB
MD56464da284d85d9cb6509695a5ae4287d
SHA1d1c0dba2cbecc59e3e0e955ce6a012c8ff90c5b2
SHA2562131fbd7c61f5d09551153bb970072f045f55520b7c3cb14dd0487710ace9830
SHA512c55d65efab2a5db96d2df710ee6dd59c8ffcd5552dceb3ff010cb3c552e9c41379a4facc56c35cfa00ee4c6ddfb1fc04a1a7b98c4d406f612401e407435c0b03
-
Filesize
1.4MB
MD5661e55119b68d734c93b0d25b8b898bb
SHA124a218b2feda8033e0b1748dd809b76780d67204
SHA256cdcd5f6047e61dcd1a935ddb439058bd6ba6ce72a9ab6b6337931ba030744f51
SHA512126a9952b580dbbb94e35dbe2d91a75edefc87fd2325049cf5f0341f8b6182bab02cd6f75204766f51c67df0d38d55b9dd8c1224389c254f6cf6af400c3954e0
-
Filesize
1.4MB
MD5510e85c4565306a4921fe08be9af92fe
SHA148b5258efaa1227a3c1cef7856573d167842d853
SHA256615245e32eda68185430df766ff2719a72cfe594dd1edc4495730a325052ff9a
SHA5127942a7485676090dbccf937494e9d1cfdd54d7d052a508a604eb74d517795f61081898c28f371cf4776988339a8471f89af8ddf37447458522876e687ee5eac6
-
Filesize
1.4MB
MD53bf5a506e9955137c121241fed9ff390
SHA1d838b3ee9905fef669c81ddd86dcede104af42f0
SHA256f0fcec2dcb22948b1e79797731878b7607c073cfb812279de91415a9b31a5939
SHA512d543ec670060798765b56d10082481075ec8a40cd44020ff595b5a3c2e9e2c29678a846a9b616775677a76f910b63bd5d45da01163bc07bf08f8827aeeadb354
-
Filesize
1.4MB
MD5311ed1e438dac8c97da46b18b877cf61
SHA11002d9744dd2c30b8f4a8803552ffc0c7e8f6163
SHA256c9a09027931d6186d20674ea6bae08462b5a0d6de63c79aa89201f2cf2c2d2db
SHA51234d30d1ea02d5f47a2b777f9b37ff97a2dfe904897ee9cc6f55e3f1ee44202a3d893ca54984829de418490b013daf095ce598cd4a7d1e485d78b74851a22e7f5
-
Filesize
1.4MB
MD56bce2fe7f885261222e8bc09881492f6
SHA16fbbd49f469c6d9572e883687db0436659a3ab7f
SHA2564d03cdefd89209a144c4342b09eaebb824ebf15e1d614a84eea7a5f6cc2148b4
SHA51226256fd78e5ca834661026c45666532ec4d0ceadb9bd0c8dc60ca00922ade5dc50614ee14f41fbb872423be0618fcf59d47ee9d70fc6ade938403cf812e3002c
-
Filesize
1.4MB
MD55a958d128139f70bf6c84d46817dfd1c
SHA1869b03c17f676df292fec6ca2a12f1dd9bfa177d
SHA256423485323da27630180870db01a958b1760ac37ad0d7e6873aca9faf428dc00c
SHA512a75df95a90cc6d2c785711f53f5e275068c90d2d1b2c3a741d0a0ba34c67a5da6f3aa0e8dfc1b36ba8f5a91d55e87f68d9fb64523230b69dac2f87e5e8ff0342
-
Filesize
1.4MB
MD5882ca1bccae9100985a81d4d2a5bf093
SHA13c6d133f52b37f87acebdba9216916168006a351
SHA256014d586d0851120f284ea3fde7d93089e462bbe1871414a508b2fccd76aee3a5
SHA5123146293027cb6df80938f059ca9c4e49da94aef1c0f11b059232a20ed153c0662c3897e4dd9420f910ae774dacb6f35c07a8bbffc76c6f5de1ba7afaf837e351
-
Filesize
1.4MB
MD5a2ac4a2fb9dda771543fc49bef5ef2f8
SHA192701c4024a0568636545ff263dea163507d6c81
SHA256a1f1a5f8bf3302722c702bca5797671b2b6fb51435b24d1ff939893aa1fd5cf3
SHA5125caacefa7dfc183997ecfbae2a11f247a7345d907960f1ce17c500734484e55b757f94255e5a3eaae187af05f94b92efd1b092120b6d9370fd08ab456c5c9ec9
-
Filesize
1.6MB
MD5c40d233245f22de22e0937e9d6141b58
SHA11dd5e687259c59581a08da14406fbdfbbdad75a9
SHA2566dfa7dacdf54916a41355e483d5536ca029c9a41ab0016443a06783ba34cf104
SHA5129bc493224be7f0ec3e696a28832d1b29031e2c9f6823a7543d4f8295ea74c45bc22ca1a721a2001e7a1937b679cac6d52887f489d9a7bacf46115ac5b23ba961
-
Filesize
1.5MB
MD50008abcb38484eb2148181f2b094a91a
SHA1b460bda667a59833f57cac9151bf53fd24e38aea
SHA25674990bbd56d1349c669cac2bfae9e195577365aeaea9ef515877bc343f89d788
SHA5121a7c424b4d0bf990114396637c69edd562e8b5a6783443f406a0daf62a45797d0e75dc57663e8a3fa77d0127140f44ab94edf9882e4f3aa0dd02133aed610fd5
-
Filesize
1.2MB
MD5ba3911812ba8875db6cf6b2ee9864569
SHA1e6059194a4cdfed2903666d72104dd0e7ca201a3
SHA256e8dee7f832c032636bf1ddf4b03e9293d95bf1a3711ef94df53d69d1075358c9
SHA512dbd1a0698a3e6d415a57d4f2381091fd225191910edbd4cbc5ff2b4e89b4793af720527ee5df3f124556a4a27d7c557497a8dbaceb878dcee439528dcdd104ef
-
Filesize
1.5MB
MD58c18c8d5e6d694376a522be84e8d6a3b
SHA142a78d5b810dc62dd26a750c9655014312286e43
SHA256669500abb9b7849034a25c9f8ed257fb3834c3a1b83af704e93e8f9496e44c90
SHA5126b606234e0589af73a4db24fc605c58694f05199c0078cd2c20ae8454ab838c31e66eaad745a8ca2523c414ce7f6d03e06f28e1fa5c732d4f631540ada6e949c
-
Filesize
1.3MB
MD5de2139d27c75a90d12ab5510bb031e01
SHA1a68a3a3fe58d4b5c41749a85ce1df376650aa362
SHA25605f80d11ae0d1399deaf1960f1aa8d540ae892b3bd4d26a3387c2617cd187491
SHA512d000b5780cb2e67562cd9388563f460568086c64345c6f6dbb714df8cfa7c3da6e31fdf3ebb8e6a16aa31176583d1a7c096c846c54f0a93d819330cdddebaa5d