Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
26/07/2024, 12:30
General
-
Target
2024-07-26_ac8b758586141295b69cfda013405256_mafia.exe
-
Size
1.4MB
-
MD5
ac8b758586141295b69cfda013405256
-
SHA1
bf269a1aa67cba5220a9aea3856eedcc03ff9341
-
SHA256
2f14b315a1e3093f920bf1161af0aaea340c068914ca013466f143d31f6083ee
-
SHA512
a2f6887904cc0a0a44dbaee352fcaec3de1aa3640d193d7579f373fcb0a01a4146ffa0506240a3b76dec1e95078f7d487107d65589ba9605fe63ba43f3a13689
-
SSDEEP
24576:UcgGFE1snPpM6rVERyCAAaLeN8wMhgng:tgGK1CBXnUaaOw+gn
Malware Config
Signatures
-
Executes dropped EXE 22 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 26 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 64 IoCs
-
Modifies registry class 52 IoCs
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 42 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-26_ac8b758586141295b69cfda013405256_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-26_ac8b758586141295b69cfda013405256_mafia.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5e5bba093558c914412600b08139f9406
SHA1aade6a767c2fa25c0c46a3df20d139a0ac78a3db
SHA2569c2e8c916daa231fe42e3645d10d4ccfdef9ee7f897aa1ac7fb2bd6b6a0678ff
SHA512a57fa43267a9505f7fa87faecda3d649dff72faaaf253d4ae730b10dcc5923ba1b75dee198bcaf6aa94e270be746723d1822758acba30979d9b7349b0795c707
-
Filesize
1.4MB
MD5cb64ebba77032ec85b8aa7ad91f48d29
SHA19735a8fa61cc2afe23330cad3c2be70a43a18163
SHA2560f048e3e7fcedbf551aa39d11371220ca8b556d2b95eb09910e9f1364ddc9dba
SHA512a3e526fd114ff4c42e612cc4766cb5c7d8f2529998de59fad900a06845c8547247f52cd21127bfa9842fe4199d4d7132c6a41e4d382cc25d9bb9653f4f5d6790
-
Filesize
1.7MB
MD5575d7fcf95ff52384492893b3d87d0fb
SHA117c3c7a987ed24838b5cff8c195d9847ec10399f
SHA25677236efdfe87284bd7bdde22605de537c9579de8be52ff4e9020c2c833e3aba4
SHA512a0003f7c862084d53ac7e65399080aea71b9aff083c398089792c3651df0f76840aa51eeaa4a164615c9a25c870359cea166eed4454ebb29f2e104e8c20dab54
-
Filesize
1.5MB
MD50a571e66b806c795ffc2c9c192971f60
SHA15b8d6c6134ec1734a9b6c86bba662eb61df43e99
SHA256222ec30852bbfe9ed0230554c3fb9c5ea0199aae7c30c40de1528d1f79893b37
SHA512b61531b41b0640d82218da02ecd62ae55eaf19cd056561ae4a798d7548e075fd9287c8c9b9f69d3fa337879381f7e6cd3300d68db0b5c9344c33d4be4950bd89
-
Filesize
1.2MB
MD5136848008483f5eb836a429dd0078654
SHA113755afeb8dab9dc50091c642415f967bae5e648
SHA256d7f1078ffe9f280dfba927a90c31f1c9760554eea6a07ba6598a997b28739f41
SHA512be3b95bea1497809c1216c3904a720ae26ae35466445c2e874197764578d25b0345890a303f7c2fbede0caa76afe6b80cb8a87731b885dff56f144175f7b4c6d
-
Filesize
1.2MB
MD5bfcb32fb8b288b046ed083a0a02328b4
SHA10aaf9996bf8120db565d7046e959a6a28272cc30
SHA25670e35ec7a05fdce03a06c2abda49be179c44e2dd42fe6bdaf673e998e2758e4a
SHA51237ab6bc61a11fc2a3c00fa6da1c03e40b39b281b067afc63d79c7b806ebfc708af484861c01fa54a68db4c10ebe22b092f138beb981b25fc0c8e07b009f43f66
-
Filesize
1.4MB
MD5679245f6bc27d66e7efa0e395bd29d78
SHA1901121d1ebe778f7e76b11182a852a4f91a4730d
SHA256eae2efd5d89856973b2ff3e3b2775848790534cd7610ffec68de4a8e56ecbd33
SHA512c27e09cad2374b4fb7d82bb8ebcb22da0e0abc33b9e9c6031c467767e836f0ec286485d6207dd51b5aad323952cb4a9b5cd420d1cf2fb6acfe15ddc8e5975883
-
Filesize
4.6MB
MD5c7612d46b8e5ab498ff546343b5eda04
SHA1325530f0efd3e0979510784b7b42a8bd349915c1
SHA256328ff82f96becdf31a5c383230b195cb5443496c372a0ddf25b76313b7195845
SHA512f1367fdbb5b66539f7bc819656f6d57ac3288d25a3be740a5221d5428a25e17fe396e673c418bf0cdf11d279e5ac9dc3716701c6e7b1884e1045d694dfda2f89
-
Filesize
1.5MB
MD550bf1b2a48d18ffb4e1d4f83a8a44835
SHA18ebcfa6b2d2d7ea32e926d41f52124e30d8578c4
SHA25694be6251cf27029167e0afcb62d203fb102d7c98235c95d68cdfef519a1ff524
SHA512675f9d84be6ea8aa130ff593e38d2116b885a82c673c4b131ae54a7388369c88fc690fc069ff3736e4f53ed5409d59638068347d64a0ba66525872651e6a93b3
-
Filesize
24.0MB
MD510fc85556e43544bb019cb0365b5f4b0
SHA12552e028b22d4993d60adc429b76f6de947798bc
SHA2563355a31c5a09b710fb01cb95d0e853f8d07898a69bacac9a3959c082369e6a88
SHA512e8ada02d5ae42cfa4c4f1687359fbb2d09c068a2a303923b5a7916481ae64b08da9f7133e8a43d9e7500782283bb7f4ed9f45ab8f6bf9b72104fd68dd0233e40
-
Filesize
2.7MB
MD5ee6b177f8f90fed5a2f13c698c9110f3
SHA1a8101c9b4e8ed300d799428a9d8e97689e03f7c8
SHA2569e58888547a922ede70ff48df7ce5cc68e5b9c262e40a56ce9d437dcb6366e03
SHA512996b212853b8aba1c41f0ae5b7c2b1f2f75b5e2f4e8a0b8a88cfd965dd0e608dd2898b5dac73f51be71d9c9b0f59fed1205f247c8c6d008044d9813d012ed67f
-
Filesize
1.1MB
MD5818163dc3d633db462bf4395a7dbf7cb
SHA16cdee7e3fdf22438e032e1680f2911a550f7a903
SHA25648785a5343b9433e569ab3a09fb1014f24b7175d4809a9c66c38a6f899c1a89c
SHA512ba881d1e91428d3cef484517040b5c0edbea6c740d2764e59da38eb45c010c4927ae9403aebb9e9f88c3881912d9378da78481090c306171e96c3a334e2e225d
-
Filesize
1.4MB
MD54110bdb35c4dbe20bbcb112c75a2281f
SHA1f1c56c659bb1cb97d739bf2ba7ea7ed7dff3fdfb
SHA256b11476b8b0b34e3d094a0752257a1ec5fbb68ebdf22a59c2293591889a00d106
SHA51246765eef2dcecf54b2240ab8030ddcc2e69f68a755e69438e83b23602b2efa7ebad1b40911c360f7290615bb953c20c1ab3b91744d1f4aaa23de57a0d12b055d
-
Filesize
1.3MB
MD5d7bfc1ba60ee5207e32720c51aac623b
SHA1899d10a0f9d0a8fc5f0e41621a272280f380fdf2
SHA2569faf0685afe7de304644101e62984ffacc1c0c230a3f363a6801e8a5994a9157
SHA5124ae6169c27470d253d8f454332cd62e2672f71a43c60207c50ff69e148c8cae2f397e4b20c97734a1bf2e83e9516e4a1c9fbc5aa81fe1aaef2e96f27080d47c3
-
Filesize
4.6MB
MD5ae7bb772e8e16629d2af32db7151b18e
SHA196a60c8c9ef3b726187aa1122bca4a08dbee60ef
SHA2569b5decead71b6176dcf78f366559ed960fbb1553b2bb72f0cb83222ffee97bfd
SHA512b042413d62b82ad49bf32c9dfafe57cef38abdf98f1f5d6136caae9c35735bd480e3dceafd5232231ea0a4add8ef1a18d4c9b3eee9c69270340f9fcaca865202
-
Filesize
4.6MB
MD5ca28c9894ee52053d53fe3e7bf351235
SHA14dd461dc979254a536c94132b3a3dde1e4d6b49d
SHA256bb89c9fb25dafc1c27010546a32b72aafbf69fef9368499a10bbfcbf9f3f8aa8
SHA5128c8eb980f6f649793bcc41d832a6f67491bf241a686d9fda572b47fd7e0b23c14217c33fae39a0c5048018293922955e330a7ed0474d2934acbb8a69a18fbcb8
-
Filesize
1.9MB
MD549c9bfba8cb87b65159dbc160fe77f98
SHA1146054e9d66c2597635c3a616e88747ae047b7bc
SHA2562d6ae118e21be5fd6c4dac78f2f847c66a30060bea9ef10778925b9da15be4e9
SHA512f39440c597c0257b9ab3072331a27aff1cfa85a47f5ff56a2e139b29ef3648b2e557196535caba50628c9bdc0c63b5497297f8fcc640e3157f1e278ebda43cbc
-
Filesize
2.1MB
MD50f5380ff332ec7a0d9f120d0efb4eff6
SHA18885ba2804336f8c585daf88f22ca4cbed119e4d
SHA25688b0fb9d952b4a75e758f610f720b3581f100171ac48812b28291d14a939a742
SHA512112f6607893e3b4de328be41b506482faa8ec63eac49237d55d4b24ed85f2a83f59312c6473b52cb57aa5c4ef67150783155352227a5f54b3a366576fd5838f0
-
Filesize
1.8MB
MD5b345138224f2d98a8e4edb4ee21e4667
SHA149ab66c1dee599ef6c01a3e3bd4ebf9088b59855
SHA2568f72a8d851f0b22fef20fee85b4fac4144e22fc5ad4f2dd133adcb1461275e51
SHA512968ae59fdfcf42e6063b145d88e7be99b1c96e7b25d3ca683a3b5fa9335ae42ee70ea6e89c38d65b09a196646254d528f26e70a0bf0f2956c8e13fa99b90fdb3
-
Filesize
1.6MB
MD52a8fd724ec9baa5ca456752b81198720
SHA19249a86a9d183a02efe358549dc7ff9a5a56df6e
SHA2564582e5e4734a220a2ff18398c2e833175c1b1441b1f3673056b78222080708d0
SHA512d3abd9bf36c722656033ef41a554a5dc20010f29e2fa0433665cc2529cfaf4b5921f44694015a43f2ae004e671ccc33b9920a4e2f90efce2175280075bb9dc63
-
Filesize
1.2MB
MD5cbb5cc606cbcc947495cd33d2c34e4e9
SHA1459fcfa012187810e740aa0837400531f8315462
SHA256fe723e46a2dd361516b2205c50df4f7e6912507041d023196f0affa6deb877c2
SHA5125807caec23e59c2dc7cecb596d538968b3d720c9a10ada5e95f5a4f210cb361fd769f4ef901994692ea5e07435e19d75a02d7da76c1e9f54f6cdfe4b0bf35c6f
-
Filesize
1.2MB
MD53f05a46c7f92be36c8861df3ae323802
SHA1b2a6fad3cebc169a5e0c94de74e8f0b1cf7662c6
SHA25671eae521bca16c71a54213aef2b69015db0de576bcb9eddfe1576429e2b9d35b
SHA512f63fbd01098b67f63f6f62c14cc1cd9f04152421ee3a7e3177003dfd02ee1715d06c833b50e9bdca7edd0331dad45d2f886262898d01eacfa1bc28d54cc22d3c
-
Filesize
1.2MB
MD5c91c851f9470084dae707a25abc9067b
SHA1545ffdd8c937c60f9772b081ac1b089db3277704
SHA2563969a533f30384e69536e71c0e0fcf5132f390d44c952844470d9b7ee23232c1
SHA5124264142dcb72ace298e75d23d821b94dbed4d12e7d96fac047aa0788b1bf745d2216b65353d1f2b664c05f70b36bbd7000aa8240fccfcc5d4920bdc918c8d7d0
-
Filesize
1.2MB
MD5e409d41bbb5e83619d9684238ce80e6f
SHA13ec7440273a62c8a8dccb0921836e3471c546c4e
SHA256a4bb7916e98c3379528b6464437fd472b98d86f48beefd04971516344a74e5f0
SHA512dc1b7052fc7719bad1b220cc10835d98c7f103d4c9f3dd2e48df731a25c25f2b3b6315c6f3aea12f9b913d44a70f62cd6a7dd7f82860f65338a8b35e98894e02
-
Filesize
1.2MB
MD56c9aa23bd7bbd1fc4425f921d42ce0e3
SHA106498d1b2bfd5429110a4d2859b5364557cb63c6
SHA2561c98bee3f38c2dc053df2c45cd276550b45f7246115f4e105b6da1fe931690c0
SHA512c45d8b4e91f610251ee184a8abe88766d7fd284311fabae6a88667773a4ba909ce78a82cdff5e911d5c67d356e135d638f1eb4577cc90316fd6099a942f5dab7
-
Filesize
1.2MB
MD50ac97eea9c1a0898f1e3804dcacd90d1
SHA18d43f67571482d6d2dada02d175ae048b46b1226
SHA256769598879868f0a4b8f1f41f38f993fbe3261237488d2aa288ac07e722bb34d6
SHA512338c7b2e500eec3142423edcacc170deca0fc0f384cd5811f0ab04c2ba1a5542b97082472e039e1786e2e459b66cb669abd64c141386803b2c25779c885093aa
-
Filesize
1.2MB
MD53f46fbc81747f75433594850c23c31f5
SHA100588a7a60c68415a220189db45caecf2d1702de
SHA25667ed401b07ccc7fce5a9edce6726dedcb46166277b290eb7354492277c05206c
SHA51211cb61ad1c48572ec6022e9e765353e0657ea5c8caeb3598927e895f26655b6e37f213efdbabd6247461231eff6747ad0e91bd9dd60af70e564cdb9a36397ea8
-
Filesize
1.4MB
MD5c584bebba93cc71a3e1fab5bf3ccde76
SHA10aeb351c96c13327ecf4fe06712dc4c0fcb889c0
SHA256b9b6bfbcbcdb423c71414f38ec01c3007066b01a81bd34f9ec9c28e5136761f3
SHA51236d116726cc954db1c6b917c7b62ab6614d5d9bc78bc51a6b2b2b15c656d7d59b26539c5f60e886efc23293c951dcbaecdaabf5239a760135bc6e5a8b6dd09f7
-
Filesize
1.2MB
MD5d75359e9f5e8ac1579c7ae51fd8634b7
SHA13c6749bb55a2c171828df46cc55d2925970e5dc1
SHA2567c9244be6cfb4619bb51975bd7e8a827c752d1ab36052f67701c4e405aef675c
SHA51255741184c0d1d435a94e812ce204acfc5abd901be111918dbce227a572dacb055684c92f4f8bc2616d307844d6369d6370a71483bac7aa3d729c1e40eb16c4da
-
Filesize
1.2MB
MD5fa8334c6e4ee78c920a310603db2ccdb
SHA137ff07b515db278db5a9375b9fba05189d4bd32c
SHA256786abac991a8c12e019257f42c7ac51360d6aef3d84284926f60c75768baaf41
SHA512800563ce33919aa03697f77e1ba3ee6d97b80013f4e4c510a2b721795d6f44bd3407f4b7b833076f1a060fe8ebf895f2fbc3d6dca779a66da333990cf6ffb789
-
Filesize
1.3MB
MD59bd4525c24c129aa74e144cae8c7c4c0
SHA10a4b17c19b62d4ef75828ea5f3bc7dd7ae2f5b61
SHA25674f69851c9c29f44b34f2dc71be9707d5a7cd395f1f381219a433a88fc0daa7a
SHA51208661fd20d45b02bc62c9ccae0e0c1a38e622898a30212552e797d56f8c5d0870687d9a40390660ad5200168915ceb8f95682b4c854cfeeb22b07a9c644186af
-
Filesize
1.2MB
MD50601645f5a9496131bd72218eecfc144
SHA1840e72abb52d63a173884f2d52d97531a9c75539
SHA256c071a176aeef3ab78a8b28e163ccc712243be18eca7fb1a3a1abefa5ac09e83b
SHA512bd69b29c01a82fd302f8ffeec69bc0912be99d02a47ed3f511234bb435132d4d11459d8a289804f99e8ea4d197712351ea0f5ebf70f8fc633c1be20629f065ce
-
Filesize
1.2MB
MD51878d22e33872ab8f48bc84814c58343
SHA1ff6799f2a7e781065a8dcd2bad7661b7d2ef0ecb
SHA256da2541a37cb049114393b3a5e7e43e3bcb599ab208a5d067f2466f55b8e0aa4f
SHA5122449c2385ff6996b9442d208434ab7ab312fd571a41a687e4c3ec763c70d9ca04b8c7ba67e60fa449f08faa50b8786b2b55b3244ac14820cd9ac8b2d2dd92bea
-
Filesize
1.3MB
MD5815cb1047feca85d341827cf97277337
SHA1128224a7daf793f331612df01e09b4d4949105dd
SHA2567e5f9db8612ba93250bc40eefa30254849c89ebfd0c415dc45b445e3b5a889a7
SHA51247d0b690a05a49e34e1178b13324242741fc16ab249c30aed29c932d7ff78d7fefe41647f5cd1491fc5a8726933c3c2d5a8b05684bc368f24cd03c56b487d579
-
Filesize
1.4MB
MD52b490a7e8234da53100556bfde326657
SHA15772b2ac6a72d873f483ad0e218257fb91bd3075
SHA256b2fbd11122bb916fdc294ab67bef0412f64476aca2bcff3b3a12e87df17f5a9c
SHA51223e1ff3417507f1bc253eee2b0d3ee4135f3216399e185a844d9598f7dedb2ec1a91c9e88e5d7328109495a73739f3a89d693977cf1a3484e786adb829c4f342
-
Filesize
1.6MB
MD53a16a992fbcdec0b71810ab37ba5ab5b
SHA1c33799fc5ef4c0628faac2877c47825c525dd5e4
SHA2566941c05869300e3737b3c257be45148d5e2bca54b35412ae907619e8caf185be
SHA512e8f04f033c4d4d52c910b22c3afd77cbd794e11723f8a87656789e3214fe0fc5322a75d0b81792edb11cccaaa76e11a390cef82432bdbacca8a9a68fc59be70e
-
Filesize
1.2MB
MD5fdcd76ae6ab2368fe7502fd822a3491a
SHA1981e2059afef8a3e2664d474532b18dd84bd7b4a
SHA256ee034e5820aefa6c43bb2e0971d8d9c95c459eee3018611f50304171ea5baf97
SHA5124f47d0f1d2589c511105c0f9528d3e79fba6a4a0bc78a47d92095a307b7ce058c22a4f43b24d9918933b29d854cde3ed693c99e0ae9d0571c5f2c59cc1d0f114
-
Filesize
1.2MB
MD5588144d1d86ee8d961a45d68d1d9dbc6
SHA1b26608fc50947134d500fa683d6ccfea20512114
SHA256666871b5351e0da4a7ff26bca4de4fdd236aec96c0dbeacfcfc6b45183364c21
SHA512bd236f0728d28777002e961fc6c7a9dbf16d91adfd4418f484938ed1cc142a647b5084a099545733a0bfa014fa883da4a85fc9916121360d65fbe4f75722e108
-
Filesize
1.2MB
MD5f72a889b6ee240f5690e4bdfd76f9ff4
SHA1ec4b77a25cdb4e12dad627c996c842be9ff22dcf
SHA25683523126ebbdf0c50f8ab53878e7c4ce542c7c9ea5bd04263e406a8892e90b0e
SHA512ddf8e9f4549077b29a80b97ad2768366ad38a575f9c8edc803547a7244ed67f6eab9ef82ee92310cbb26b87fcef99c61428e4d9e0ef2dc5697a04201513f23bd
-
Filesize
1.2MB
MD5f347a99ded754fa8d7668713cf82209f
SHA1d27eb8ea0a2e57c72e0fcad6e19b2bf59730d3cd
SHA2565969ff810e2866cbfcff7aa2ed4ac0b2f72a24f996b6c48a612fc86bdaf608ad
SHA5125308d72b2c37d9617f26abf86289d4f954dac1ef0975480af1ed9f88ce64be8e800ba52c31bab0d4dd12e1d034525a697d537682731b2432ff5a3942858f0893
-
Filesize
1.2MB
MD5b800adf326dfdf5878ebc9c37d397805
SHA18d086b4fb1c9272ec789e8dda105b1398ba25a99
SHA2560d9756d1eeb3dc55610c864cdb97bcbcde0e5e6b254e44c3cd6c2e08cf34a4bb
SHA51264e56fe5e0be051c93482c78d085da7c4e56dfb3e41c769b6f8e6bf08c3cdd6d8f808bfdb17fe65828115f00597ea32384a3b87914e7d4a92d50cb84f77e8cf8
-
Filesize
1.2MB
MD55140e21ced3c560e575b68c81ca135fe
SHA158e38e361b4fcb4026f0237502d53ed03a129c39
SHA2567915ed2f11bcc20c90bc7cd7b2dc77a0a071ba8ec3cf990004078fe9a92755c3
SHA5129cdcbd45367c4360813ce8e01be6154c47c924196eacbeee5db3fdd8275771ef516d5608b7008b1a645767c01b1d847568b50285abe000ed99b1fec2342bef82
-
Filesize
1.2MB
MD5223839ecbe2c4978b1cdaaae9306365a
SHA1aa90cabc85fd7bd1817a888b6b124cac11503ea1
SHA256d6626a6419f211eef8b67a68a17c1b473d12b1dcf2b8dbd195b6193a4bea7274
SHA512666ff8ae9cbc94c9f47821e17a1cd09a2c27d6b8d5068a7d596e97f3fa4fff776c615ceb9fbb8edcc321944ce86d686b9bb3e20a56955c1e22579b9f3d46255c
-
Filesize
1.3MB
MD58a435f939345f3f40ec83c35c65c6bb2
SHA1605fb768d5624604e7df3cee5274cd8f5c157ef8
SHA256974a9bebd0d334cb9210e7dc6080cfa5e556c85cf8086882c979e048caac2c07
SHA5126afb9d0e86fd785d975337da4b6f9fe81e86628c62380fc61bae3c354cf9cbb8a4ded0c0017b1fb2a4921c04000788e7229be4248b92f571bc8f677d83e8880d
-
Filesize
1.2MB
MD59a554fef4b876b98ad54040af8052c37
SHA1232f8a199d412bbaf2da3a25f53ede7e93421896
SHA2567b6b3d1a4583a33c51b394126d6aca9c79d56b5e46a44ffc4fa3794015f12615
SHA5122dcd48931ae417c5d087b2848c04201850622f7aa7ea4a49006808a63d784e65c14abaf3b337702a7355880bb5f50330c33227c8f64ed06f7f0093d6987b1e64
-
Filesize
1.7MB
MD5006182189f8f29e17f40619fedf90208
SHA1e28a8a44b4e586ad50536b6e135e0944054defef
SHA2566169c9c4ca0b26c132d369e4e29efd1493b8ff21e7ef39cac8ddfba5387536d6
SHA512d8ba34eafd99afd29fb4fdef1b72ef9b47cf02f2897e3d9caf9701251047fc90430e9071d61bdd1e0b428d1b91fa5433c5f9a1cde15fc52fd8850d92a2c36cc0
-
Filesize
1.3MB
MD585fe8c601c083282b46a4be9f1fdad17
SHA1e4bb4c780f0ab0e71927c20c684707aaa15420b3
SHA256c3333528796504ae42c1135ea999b2847d414b5edaa6cfcd8f4f622e5f3cf5d6
SHA51238096a643202ba401138d0c7ef266488b95dd1d178a59c04f47d6875ba02d057a78c67f38a164c75f9567fd2c490adac512e7096777b0c0cbad5cd8a8f15b1a0
-
Filesize
1.2MB
MD53c53bd44d9c057ed296c0aa6a66f5dcd
SHA106552abab145f50fa8b36717b325204ad0753b1c
SHA2566a1c7504aa6c9e53a8d5c6990df00490dc4980c791bfd1dd10d51b035935d214
SHA5125c9c0137dc8b363362da7cd57cd5096b649d2ee4e7fc77b56bad257a67e3ae816bbe74032e5c8a305bd44a7e49a171b1b9c9e26dfec81ac5893a390e93fe8f00
-
Filesize
1.2MB
MD5d07ca8b12295dea620371c83dc19bbda
SHA11014db54c9ac453fc9609be4777cbfe8e01e7c9b
SHA256e1e9f2ce487b3b6ff938d038cb4fd24785a2ceb0c6e2fb76ed8d2b6ff07a920a
SHA5127d1f7d83c634fc9b80a46eb75f93f75715be4c63c36fcfc6bf5f5a51a7a88a7d118779682f9b855929221ddf9bee2ecf3a40725ef5baabdfd12e6507f19ee5e4
-
Filesize
1.5MB
MD59c5af7a0798ce4b6cfecee4cb37594f0
SHA10bcfd1f562a4e628f66ce198d67274bf855a8844
SHA2567024addfb215c26589905996c09f6793b650a30fc47bdc585bb01439e518812b
SHA512e9406295893b93dd9ceebc4f7db67a869ef895fe87763032afe3f772df5836be212d402188d6a714d989d346f9e32e1cec91168e15774610a2734f7946bf5065
-
Filesize
1.3MB
MD55282e1e3acbad5fa35ee6b119977601c
SHA11ce14e802efc23761f79108461e768c58bffd87d
SHA25671e941480abba8864109a6e22587eb9c6ab6bebbbc21b7de74803706e2430314
SHA51263019f289909f62d969a9608d2955498a03d1161975136ce58facfc21ad4d62f942a2af7a91d07912ff3cfe726f4e1f30f3e73ddec395295481544a8d55c67b6
-
Filesize
1.4MB
MD59827cf8c456e310d49387165ab22bd19
SHA16c00e2227f7f17271252b65bd6e307b4e2dcb008
SHA2562e4f6196d13d9eafddf0dfc8e4876435771e02085321db5403733f47ac860ae7
SHA512325ebc2a36a15ab94f2886b7e1dfc5769923706bd237c5a09fdfa45d71b7c1832b5a7220424c6226df7f2f4119fb139a8d7cbea52d8d434f5a1473c7fb3aeaaf
-
Filesize
1.8MB
MD54e39b5fc412337c1f867c701d5d9d368
SHA159ff4b2b2cc5122ec9da51ea043425563157037b
SHA256b0b1b00eb78e6cebfccd5170ff6291b173d0aef27b947eab9dc376791f568bcf
SHA512e21fe635fb74f3527409abd7a308b22874bd12905089813ff814aca0031e99e6fc7f2646d671a37b592d29d7569631b43dd1f9f48491d97db95158bef481de10
-
Filesize
1.4MB
MD57b190113ad413574ded71bf198b12235
SHA124c02fed692f02ecde0545d6174166f511b7c649
SHA25677bc610fd93cd90b1f72c7da8e84fbe7f305e6f7b22370049d02c4c7d704ed58
SHA51271498d358402a21ff492ddc88c3c08e9c5d9ed699d5cce35bb0197cdc85a1d4f403579e59d50f705edef0d56facff306f8b2397cbfc8ad2c61b3aada7a6bb683
-
Filesize
1.5MB
MD57a6723cf0d09bf0534fb1afb229c8f7c
SHA1641a55c9368f2baca4dc837ebe4f758f5fdaea72
SHA25695b2a24153f2a5b5632cfbcab253a5b1186821d10b191734ccc3b63ecda565e3
SHA512c42b272a5a4957b1f2614422c703c0028aaf5f3b79878ecce3cc53ed2246194dd407bfccba52cdf4ec9850bcd025c33730cd0f52a934d6d2d04400476488071e
-
Filesize
2.0MB
MD50557318f5c6ec5aa88d84cf93c69b578
SHA16beb383c67eba6d41a4faed7756e433f75c3429c
SHA256d21f203ab0ce14e75a76005ac88091ebf44529076d49918cd31492039bc2f485
SHA512e1074ca21576e294d2893a50cb8d36fa03fc2387cbd4dd775b7b3eae1acb5536cd630925d4e178f5e17c569129842b42d4995716a17da86f0093beb66f1f19b8
-
Filesize
1.3MB
MD56b767446020d715760d2371eca43d345
SHA19d64a15a9d711632f272dd872a6b41d8aa85832e
SHA256c23d35937cd026df0b85c1f64f8a72df7155c5fa6bedc7e40b56b4c673bb59c6
SHA512feb8e0a9f6378553b8ddd43d708b4fcc1badd0bb1f883ca5abc31e00493fc8a553406fc65b98e1a53d7bd27fbe20302aaf215cd95387f83b8e50f1f82b5dd843
-
Filesize
1.3MB
MD5e011e3a6023f483b2d869940cc9273a8
SHA1d9879de73f6a742541a07bbd4ad7cc81669b7b55
SHA256857480d8ebdd55d64db4ed3ef5c9f52a28d45dbe1f838c901ad047e11c097b4d
SHA512e906e4cadbc7057ecf1e3010f0a6c454f36ac78a79bd5b0b9829b36066e23b6026506c98c99b6196857842171f23e542c36b99e0dfc8fbc07f7f4fbcb6242bba
-
Filesize
1.2MB
MD5ef6cbc1233542d92d1c27a22833f6e17
SHA164956f06259e87970b0b97bb9b56a807a749832f
SHA256bb8f62a333f1c9d9befcb799f36c9715ae7e87514574834ad4acc0f9d1fb90e1
SHA512dfc7459f5f97818720e89c2d46e5cb32223acd3a776f403bc0121935081d93431dc9edfcfa8b40803cf14615fbd9a660df431e233084317f3abd137b8920ad76
-
Filesize
1.3MB
MD54c00d898842f4d05d87b5870c288079d
SHA1aefdcb1e794d059ce3ed4ff8d5649ccb7eae436c
SHA2560b29b81d20705eb7ece2bc1b77bf808aaac974efc8540175f6c0f2dfb76e8a54
SHA512973f79a708d1652b90286c22470c0ac8e5456b005708801a156a18990074b4f0033488038c15cf1ece9523ef4987de1d44317e467fac0c9c812d5f799ab30e23
-
Filesize
1.4MB
MD5480153aaad4568a3249597279c11d967
SHA15c120719e576e2d6957d2c6524a61265a75f11af
SHA25610ed27296fa38951d6da2657770fb4e2dd91e3d723b718dd1a5ceaf3394acc35
SHA5124af190bb4d280cb3958717f4827ce5b817250e186f66e7bd3f96ba7df84fd7590ff2b7f105bb260cfff169e94e7e285e2c9b45b85764cb7f5e96b242dd4c80d0
-
Filesize
2.1MB
MD58d0aa892f1a39a95e4ca69f45b462112
SHA1bf32b564ea97cba0145fe0c4b72757d004688d62
SHA2568215366bd03afe6e604b30dcf1e0dcbfc73a0ebb132146ad380239fcf8a69fed
SHA512f65b0ad5d45ae77948e0d9864bbea5ef0996b0ce2d8ff08c776e9a98ce813992658fdb73c2740efbecb43ea6d6b459d01080eb2bc4a755303cbe5f141cd8c302
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
384KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.8MB
-
Filesize
1.8MB