Resubmissions
11/08/2024, 12:15
240811-pfbgvstblg 7Analysis
-
max time kernel
183s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
11/08/2024, 12:15
Static task
static1
Behavioral task
behavioral1
Sample
SMM_WE.7z
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
SMM_WE.7z
Resource
win10v2004-20240802-en
General
-
Target
SMM_WE.7z
-
Size
137.8MB
-
MD5
ba8caad77da3183dd7fc088c6af3be8d
-
SHA1
5711b71e1ab9242c68331eb5f8c3d980e1eb3d63
-
SHA256
4a08a6514a9bb199cae62c8a6ad799f064c3ed0c933c01eeafa59023b24aa56d
-
SHA512
11e92f77c43a4854e4b181f11b3ffd880f3dd34278484fa3149b569938452769da2b54417048e6f5513d4b06f8755ac2ab6cf69822ab8c236eb28da8aa428cda
-
SSDEEP
3145728:SpUyxHzFQ8AqPe7QhetFTUgD4JqFpWhk7Y25YNk:6UoBQ8A3tFoXqFYuU2ok
Malware Config
Signatures
-
Executes dropped EXE 5 IoCs
pid Process 344 SMM-WE.exe 1524 SMM-WE.exe 968 SMM-WE.exe 2976 SMM-WE.exe 2304 SMM-WE.exe -
Loads dropped DLL 33 IoCs
pid Process 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 344 SMM-WE.exe 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 1524 SMM-WE.exe 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 968 SMM-WE.exe 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 2976 SMM-WE.exe 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 2304 SMM-WE.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202 rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\0\0\MRUListEx = 00000000ffffffff rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\0\0\0 rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\0\0\0\NodeSlot = "6" rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\0\0 = 8800310000000000e5588b70110050524f4752417e310000700008000400efbeee3a851ae5588b702a0000003c000000000001000000000000000000460000000000500072006f006700720061006d002000460069006c0065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003100000018000000 rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Applications\7zFM.exe\shell\open\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Applications\7zFM.exe\shell rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Applications\7zFM.exe\shell\open\command\ = "\"C:\\Program Files\\7-Zip\\7zFM.exe\" \"%1\"" rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\0\0\MRUListEx = ffffffff rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202 rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Applications\7z.exe\shell\open\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Applications\7z.exe\shell\open rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\6 rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\MRUListEx = 00000000ffffffff rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Applications rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\0 = 19002f433a5c000000000000000000000000000000000000000000 rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Applications\7zFM.exe\shell\open rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202 rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\0\0\0 = 4c00310000000000e558226a1000372d5a697000380008000400efbee558226ae558226a2a00000043f8000000001200000000000000000000000000000037002d005a0069007000000014000000 rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Generic" rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\0\MRUListEx = 00000000ffffffff rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Applications\7z.exe rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Applications\7z.exe\shell\open\command\ = "\"C:\\Program Files\\7-Zip\\7z.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3 rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\0 rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\5 rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\0\0 rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\0\0\NodeSlot = "5" rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\0\0\0\MRUListEx = ffffffff rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Applications\7z.exe\shell rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\SniffedFolderType = "Generic" rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 03000000020000000100000000000000ffffffff rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2436 rundll32.exe 1860 7zFM.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 1860 7zFM.exe Token: 35 1860 7zFM.exe Token: SeSecurityPrivilege 1860 7zFM.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1860 7zFM.exe 1860 7zFM.exe -
Suspicious use of SetWindowsHookEx 16 IoCs
pid Process 2436 rundll32.exe 2436 rundll32.exe 2436 rundll32.exe 2436 rundll32.exe 2436 rundll32.exe 2436 rundll32.exe 344 SMM-WE.exe 344 SMM-WE.exe 1524 SMM-WE.exe 1524 SMM-WE.exe 968 SMM-WE.exe 968 SMM-WE.exe 2976 SMM-WE.exe 2976 SMM-WE.exe 2304 SMM-WE.exe 2304 SMM-WE.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1644 wrote to memory of 2436 1644 cmd.exe 32 PID 1644 wrote to memory of 2436 1644 cmd.exe 32 PID 1644 wrote to memory of 2436 1644 cmd.exe 32 PID 2436 wrote to memory of 1860 2436 rundll32.exe 34 PID 2436 wrote to memory of 1860 2436 rundll32.exe 34 PID 2436 wrote to memory of 1860 2436 rundll32.exe 34
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\SMM_WE.7z1⤵
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\SMM_WE.7z2⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\SMM_WE.7z"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1860
-
-
-
C:\Users\Admin\Desktop\SMM_WE\SMM-WE.exe"C:\Users\Admin\Desktop\SMM_WE\SMM-WE.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:344
-
C:\Users\Admin\Desktop\SMM_WE\SMM-WE.exe"C:\Users\Admin\Desktop\SMM_WE\SMM-WE.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1524
-
C:\Users\Admin\Desktop\SMM_WE\SMM-WE.exe"C:\Users\Admin\Desktop\SMM_WE\SMM-WE.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:968
-
C:\Users\Admin\Desktop\SMM_WE\SMM-WE.exe"C:\Users\Admin\Desktop\SMM_WE\SMM-WE.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2976
-
C:\Users\Admin\Desktop\SMM_WE\SMM-WE.exe"C:\Users\Admin\Desktop\SMM_WE\SMM-WE.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2304
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD54e16dcab5d51e96c4a75a474a14361c6
SHA187eba991de551025cf72cc16e6cab28120944b07
SHA256bd0a41b6f52f02d26fd79f0a6e28c2fb15bc06cebce91cf19a7b84fda58e0591
SHA5128ca679806fb835adc6abdb2216649cc82342ca7cb04ad4bd51cb3dd152e409c0e1e65127adbe85cd387cca24dfaa283f6296ed720cf622cbdf2e2ed8a9f6edef
-
Filesize
172B
MD506c19f2910a6a55d5d326cba5e9a73a2
SHA1cb5f47877a4084de1d1424af5d9a9ef73a679bb2
SHA25612956fe9cc78e872e0ff933a9e858027496eb9f0b6c96ef56cc6241f8ab052e2
SHA512b1a2ef7c8283b5382d8a6beb129f43315de49912284a3d595d8d8565ee1062369645260e7359ff76fcb04610b8f98e6835846389c9b42242c37cf71d8ec41eaa
-
Filesize
112KB
MD5293336c46761be409f96d26887b32f4c
SHA1b15b8e631b1466e7aefcd36d9c2506c3760f8f9f
SHA256035fccbb2cd74fb1e66bf77ad0ebd3824eb309230aa7728e0a1add67dc10cdeb
SHA512971e72af3ff7b3db66126f2fd5f488f38dd82ccd6247e0db0d493f34db0409a3a040366f31da0759feb9bd2d013c18205e4e177b65181e0452d7a0586eb0864e
-
Filesize
116KB
MD54f79e9e0ab0bb8d1f33686705b28102b
SHA1a55e6f34e3914a6d45a2c46af67df16a59cdbc33
SHA2561147bfccf2ae5ca3ffd271655a72bb70b4eef8868dba2a431ca80bf9565e3709
SHA512f7041715624842ff58934e539392f0d660cdad280d92c08bb09d8855ad5266e4836d5233236ea4c9718d18b620444c72ff19f91a9225a8b42636853d190dcc94
-
Filesize
10KB
MD5b9073d18ce3ad6cb4bd5f526a285c7f5
SHA121741a0125f1b2d6c6eebbbcd83f9c0e3ec9b771
SHA256945e97f7d86f62ce7acce7f7c6be06d31cc97f2f87968fbf0e55221f7317a984
SHA512f2f399ee1bdd9aaf4d5ea98f2af2ae2d3d69d32aaa691a43f9e1a547d1179eee940955d26e4f48a625d6ab06588810385a5b34d5135684e883fb306374414bd6
-
Filesize
14KB
MD5b7b1a09f60f841b31c521ca7c25e6abb
SHA1114402a2425595253b5059d9091aa7cb79ba858c
SHA2569b438f26e16a5fe3e7fccaf563a15d1ca87b20b923234e303394329c1500055f
SHA5125df6da359641a1722d178b3a5c0efc3baaca1b1502eed4037d2a850d83cf619e94f12cb18fe778971ada19d1135a3127a91275d920bb1456c7815bdf02742dcc
-
Filesize
6KB
MD52f8d244c3b9c6840d529edc6887256f4
SHA1d46ccdc4d23f40cb8e5fa6d728737a11e6642e90
SHA256986135719cee21365db7a5fe0b580b84e0b9937d321ed589041f54949ac5b3d6
SHA512aed5d01c835ff6a654d941096e7080002f1811ac0fa462bd0da61718dbb57bdbbb8b7d9adf80861e65acf8d272b3a35147e0f9deae145c2f73574a436b3a7fad
-
Filesize
22KB
MD569dde8514b302c8e713d9db19af9d31c
SHA14be7311db81edc8846d57e12d6b46274fbaa1f84
SHA256ddaccf7a8ebed90f99b8c35f323c749198fcf94d2ba09f9b5cac23fe297b8313
SHA512934a8c5c25bb5bbf62946c07e6c4ed726fd7de1e1f0a38089d66bbda03464ce83b3ecdcb6fac3884959db4148bf2b4d5b4d35a4a3acaeef3fb20ece5b3783092
-
Filesize
16KB
MD532c0da29c162baf600a84b2c0d8dd266
SHA1b50da4da630893a07dc25881c598b329edd26d8f
SHA256c2a425632c4a61b9318d0029a19145fee507eaf60158d316f9046705e72f7bde
SHA512385ab1ec8c83df3833c67de1babae17cb226f92dd8558117325ef523db2b95f8bda33ecdba2dd65b7b6011332f2463806f499a4747395ee453e4d8fac03de1c7
-
Filesize
251KB
MD5e07cc1e8349b166a85b6dfb0d6a5414d
SHA13ce26c9aeae5fb2aed8a7de1b758ddbf11353870
SHA2563516a4e4b4d9f6347ea232d57cb83ca2ed6a3c9f334a41de21039a87fe29a0d2
SHA5124c9bf407e196898d8152972ccd9f088a388205677dc729f090e4cb7a70dd03bdba2cc04609894f6622be90e81b57dd8e6447244d8ba07791d1b7ca7ab3d97ee3
-
Filesize
14KB
MD5c4df51a466d9956ffa5fb3845eba2524
SHA120a4b82543e3d069fe165cd9831346a2a6af5400
SHA256cc2db46541abf34fd7ef497fb9185e7a35e39f9669213a8bc6c47252e4d7b61b
SHA5129393b588bd9fe58f874885576be7697f65062831840c45267a17d1bbb3bb3d4f8f6f2407047a165b6ed2267ad9ab575786463b10774e7f0fc8f860ba7eda5b97
-
Filesize
14KB
MD5f5bf8e0dc09c939cc97d3dc20d0406c5
SHA1a392eaabea949f65a900f0f2a9bd1c3fef9e74f2
SHA2569bc469015931ba36cdc553b61332e73c79bc8e088c5beef01c5b0532f4d419ec
SHA51214a47b2bc818f10d766744d8bbf7a5561fed252747c0591ac14a5dd8cc225b4f16891da7a595be2f45423c6d5182d72c4a83bc949ada11c8d8f77cbc99441783
-
Filesize
14KB
MD5447e6f8dcb9d825db391acb5db2f6f1e
SHA1f30381da331ae2fbe4e89ba7d4fd13eb86ccfdc8
SHA256c87e4595ea0f7a842c33c63a26a57aed37357bfa6c8e96b8b65653c793839cc4
SHA512f1048e5a41edf694713b54cc6424fe7ba3c51949ae898038db0bbb355206be6ec526fa21579f2dbd787c3c146ea1964fb4c224af64063dce5d9808a0b914cdc7
-
Filesize
14KB
MD587166d6584a37cd3aa5dba69335b0b75
SHA1eba95c31d6fef7c7f745c5c834416525a928712d
SHA25601e426e0412f614e6be453e4f57479ed82206694ae258d444dc39da10ae95513
SHA5123e87aedb7bc6b37bb04447512c18ea5f4d2bad8f0a84da420674e73a9764469ae22775210a429f95a2562f6d9480bd9f747dfa622dc485b1f450012c55ea01a8
-
Filesize
23KB
MD5a539eca3719cdc6b16aa00d03b0bec04
SHA14de593d30bdf2933d605b37b56bc6e4291759aef
SHA256e33b731c32b30f7a3e00e6183e4017c562360680160f54eb44dc24dc40b0cd7b
SHA512095af2b509a7f09ac683cd2af94c33520a82e8309fcbbdebda945c8c403f2d9c577095c8e28f588f27b433b33a8f375129c7a5e0e89bf1a67552d54224babbd1
-
Filesize
19KB
MD578b93eb6535fe275b9d47b65f763ed1f
SHA17a978c103adc0ac7f437024eaf3995dbc2b7f0e2
SHA256de6777e0655dca0a6b5d4bfacc6a09228d994e9b4b180f79dff2ddc5c376bc0d
SHA5122f8739ffa2874a430ced88d25f9cd1cdd766d2b550391dd35e0402f583eb4614220321ad1984b33dd78cd3803c0ead6cff4e08e394d1301f433308e08b2b457b
-
Filesize
33KB
MD5c7a4556c98ead2a8752f5d07b08108f9
SHA144834dd3cabf2719341730da7dba19bb7e8b53b6
SHA2565e307b8bb4ca1159198fadcbc742e634348b113e3c8339bc69c1f279de8aed39
SHA5127078180a6266458c034f63bdc698cfed50f9ccd4f0b43ae00526040b1d4d478addfa5240c62c61432980fee1e56c856f9cd82393511eb059acfdc14906f20cee
-
Filesize
31KB
MD55f04e5db3142fd653f707e10720f2a4f
SHA14329b2d34dcf323951b33e3b7836149f4f712854
SHA256303c903eec473cd88ce3ca28fa484a6fc7462d9ee13382e2a1f83c9ed287f7c0
SHA512d1c51613713c97c486f2a0644a0380339a6b49bf4e1779920ec308b78e42ce2c769722f87c5aeb0b9b19f40d931aa69c3f0960b561ee5bfbf487e2c5bc09beb2
-
Filesize
10KB
MD563f69872f8732964f19f700785f3d99a
SHA1d6b5c159d79ba910c344e9c40efa6a17e6a74c70
SHA25639da68c0f2b215e79b330c0e83a69041bb79cfde368c33416831f4ea06a87a27
SHA512ad1e15e25cfaf824359c71cd655c9355129bc1da4f1733997ddbb28571062fb41476866c950a87e7f4765ce0169375e3ef7b27ec9aeaef152c23934f2c296b50
-
Filesize
9KB
MD5724e8d82a7e0e62fb295414e726e1565
SHA18ef642c924529758e54b58884594eb4bab66745b
SHA256918721cebcf6830dae2cc4ac30c7d9107e84c088e1383fbc9a689033c5a93e54
SHA512bec7dffc1e571418d3645f7afbe7bcb1a6c29d94ae849e31938ff503ad4dcc793ee9748843064c01c5c0abf3cdeb14d21613d10c9843b2be89be03058927630a
-
Filesize
18KB
MD5755a36bfcab803b111b9294e9a468c65
SHA1da6c028a62af247dfbdd876aa0221a7548e81c79
SHA25603a1ca3252256a55b6b3cb015ce29b577122a3198f8743320c0f651df25f0c80
SHA512439c06b82a6e8b67e031191359cdc0900d04bff149f5aef41d89be74fd7f7a6efc0efce30d3b1bcbfe0df28723fe664b4661381c5527de0d41b11c0de00c9cef
-
Filesize
8KB
MD5be984aeb10d02d6d6fc4f63994b9458e
SHA1fbe53e253f38ed75cf29f75f6aa50e501dbabb83
SHA25612d59d84cacf2311b2277c1f929a92840d1dac3eb60afbaab001548caf93642c
SHA5120ed68c5a4e5983a6b93d33353f5e915c2f12956710a86f1a7ec8cab97b3d5c6107af4851af38ec56627900d6fb1a05ad159c75deb5907e24483c6b8881b47e16
-
Filesize
48KB
MD513a0fd3bc176e9fcb5308b4d379b7fcd
SHA16b93cb14bcefd949edde10d18df35c1589696be8
SHA256be2d4af7e9c6a3dcad82423061729cb06f174fe65fc3c818ce9be31aea7e9e3e
SHA512cf805d479f70262bafc605d3c448f54a9afe9cfa9b15a26770b25788f330fe6b472bac9cd27ddf8a271f2384fc52b480736d9675bac45974ef33faadbb23d0cc
-
Filesize
278KB
MD52e14e401341985c03e032d22fe8d3ed2
SHA11cea740fe1966e89d3ee628e054a433cbf3332f7
SHA2569df66d67d27300b3235aa0022f20f6e4fd0c0a9bae2ecd30176afab7b6d34264
SHA5128e5fa4faba3637c63889dcb71979277232612c74f756562f119636fbf37f15db0d8386d480d2e7ca68c6159a736c3c580cdb5bf47ef89422b2bce39441df6a46
-
Filesize
73KB
MD5bf9c4f28d65fadd8e3dfe86d8fa27c92
SHA144023076dd9c5c3ce7dd8cb61bf23547ed32b8f1
SHA256ded9c46dcc4ead9c371fa967921bc590befa6abe4f9d33ed9e777e7fbc00a5cd
SHA512c73be258ed411a0be62a4788554b52cf23a683245f1290a644d2b9a5cb2a4017af8162bf18bd1785fee67a10fbee145ed6c31c6123c7c6de77c05abdd9420541
-
Filesize
67KB
MD5519e36825862d0d55926c7b0b3886772
SHA11adc2ac836ed87ea305b0374b3f72dd2d3d2c04c
SHA256d8a7bc6b1ccee86c2bb6c4639c021ec82338ade262fac4a451a9f8ae37ea0a97
SHA5125cff624489e505aabca31c5eef9b0aab9f5034c076e93364cfcdc94d8954085da50405721c4822b1d7dfa01482113ae30b31f5191055968748e99ba11dd41454
-
Filesize
305KB
MD5d9c23634e649368c952d6b3d52921d23
SHA1ff9efe85ec7a7b759b1b79f8091912817716ff11
SHA256486046288e7c089fe49566494c38bb4ba063a685cb86c3daf761a851fb5437a3
SHA51296b07fb04ae05a510f4e1957ec2983439071797570c3efc21b542f19f0e99b434872877d6725836f0231d0edfc7d82a98f090d763bf790a14ad0091f8428c49d
-
Filesize
301KB
MD5956c0665f749a1989269e197d4b033b0
SHA1b0749e3996140af60145507f1b1366e2db6bcb61
SHA256b9246f65ba911ce758d9d780a4dbc8fedee80fcd57b3f8a241b5d329f5a1cb17
SHA5129456f0103ecca5bf13a67343eb8bfaebd45eefb328773014df4406cc801096bdd4e391245bd34bd059de2575c334c7359d72620bdf167df626efe93b32c6aa6e
-
Filesize
289KB
MD56f69a00a208469c3ed62e02d2dce3c7b
SHA1774ba921841d5613dfa2acd1894597c187522e98
SHA25685d118598ae4f307c9d8c3e3f7ac374abace87ecfcb7b1cc2e3bab21a997e6e6
SHA512705c960cadc765f46f32b62f96c5d0231ffd044e1404ed83a0cc97dbbfc5317bb1adf43b6a299d68e70785e77589f317cd0da428d3f23e5141a02d30a9acae99
-
Filesize
272KB
MD574dd4eb8d1c79945f2e13e827c2edff5
SHA18727a046f60187fe4244c0acf25ef6b93349dc9b
SHA2563d0cece3f4900c47adb8e57f04e548a5cb7b77370a8b720ac2a7ceda86467d5c
SHA512645bcc0bd45c5cce25e30bacbc06d5d8455c8aefbae3e26878081b8f62bb40a102fd6e69ce44a5d24febd0816e33cff9b24137a55437d606162680511e4bb3db
-
Filesize
303KB
MD5212c33e88baed0773342276a2e100246
SHA1ae3d0073cec2a399cfc405545a8cb34cf3c041e7
SHA256e977fb832914f0cf8641962b37223cdd16a3d1b57dfeacdec523e841384e154f
SHA51289e2ca21ca68041c31c614eeec65b0e3b7a8fee83430f67e45691dc9550909373a1344de20257fd3f0802179d9bddecee2755e828509a1f54c85b950beb6ba46
-
Filesize
526KB
MD539f42db26c07e27225ea1e0c631dda61
SHA160d407316dfad55aad9df65854f28dcaa78d9ece
SHA256edffce0c8ea77dadba0de0201b3d4ea392b2a5a825ec484b9846fe3a227992b5
SHA5124f242587159b07f6a3abf02385857b4d78487963cc743744a26fa4982bcc170b31b0ea9c8558e835998d8e87171779e6f29b912724c299be83ca892ea822b71c
-
Filesize
520KB
MD5e757923605a9996992817a888d516f5e
SHA1816907b1c35cd57c61b496e098c2826a671a3d87
SHA256c4959de31d280136a72942c1419aa371ef8d13331683d00c9d22b9d24d9d629c
SHA5124126a65cadd2d31813093d9760f3c038b920bf6cb4d126279877f330419b4b7d2ef7b721e68d7cc1437fbc82e53a58f6e5a6ebfdb1d91c0904b5ba8d5bbb374f
-
Filesize
386KB
MD50f665a671ca7860facc2b74e8654e671
SHA11190f105d253f5f45c7cb5516f4776b835e3fbbc
SHA2560c90ed837ceaebc0bcc45eaac544deaf453a12787445b9419d1a68a62a27bca4
SHA512685cee8cc0a3099071afc09e7fbfbc9a8c1fdb833d3ca6306a3ff7a02febd96f266be923cfbee0622c889425d02b5c39dd3c3fecb99b5718ebd82aab993117b0
-
Filesize
92KB
MD5a5dfd705e5090c99393f30f383ab2ecf
SHA1ca3f62f9073164ae9c9e98a9bb2340961cab977f
SHA2561080ea8633cb0fb762f4705f29b22ed2e0926423933e7f549d670565b11788f0
SHA5125163b09118ce7e9c9d8036283ae8f08a34a3637a2039f71cc7aa3d58c41ffb026e25278d2f77cedddb224b0cf8d222da94dcfcd2dabed0ec9ef9c55b1c7bdf1e
-
Filesize
84KB
MD5a693ada2622f9dae379d55bdc305af35
SHA1aebc85e729b6d40ea0d0562707e8ff87663ce0a2
SHA256683ac7b9bfc2f9020c5dd948578e2ae703878647eaa54c054c58a5a2bdb82246
SHA5120d7dd70b50cfbead6ebc668cbe5395c3eb01b56a42b30244736157ae621325a39164e10dda2e5f70f7ac36806e07cf7fd8d5d106b3d28a721585ffea7c3e1a88
-
Filesize
177KB
MD5b33ec80ead7599f8892f53310bdce52e
SHA14f9442f10da0579f64bc81234cb2da33b831f40f
SHA256df4c69523a24a13fcee0a73961973b27c979d76f670963fd3dbc8576cc035b1a
SHA5126c364bee521e050b6aa339ec878d9387b97682f91f8dc636f62f3717a959760d31c08d0f960c5ed2ed69ec141106c0564a0ecba29955ba86eeeb829a67cf2bfc
-
Filesize
172KB
MD517fa2b93a6a2275130a7aef001a14a3b
SHA1f3f4db3aa1776619b8454f36c2ca4a24c0885051
SHA2565a47eb1dea08da8b9bb1ca32a1d324029b937d3fce8a3412b1d4816ff7ea00c9
SHA512922eaccbe36f6ab75589a9dfed619e30383db2c19b4b038020f38886799c1fc8b5650ae149941e33006cd8609327905e66cda92af82403c52e4dc39e531321ca
-
Filesize
7KB
MD5b399531bce1367ddf4ffacc367be587a
SHA1521fdc2bc94320651e46c5300a428a52efe95de4
SHA256a98964546ebb1f6eb34f6c10c1547bd33efc325d260f19ca5c337400cd3ce169
SHA51240b413686913e0e076a6a1cb0c4f16e0248813c2b54aa62ecb95d606b328c129e88be087da499ae4a105a1763ba075b0cf3e20d513624a8408ac50a913902eb7
-
Filesize
6KB
MD5055313af9c2cd66da39a82fa1fe67eed
SHA143eda647ea5ee786014a02a29c00c32875f5cfce
SHA2569845b4b36a7b4bca9ddc73c21ab7cc25c6c016e7af8559be0a8747d39670a399
SHA512bf09a5c8d40935f0cffe4a4a6ae762f3b044d2423d412ca8c862623a7c91160d0a2c084e193e5cf39960e82d1f721cfee1a69b50cf0f821b5b539ca14f22ebde
-
Filesize
6KB
MD523280fac662290c78d113f5ec7a15560
SHA1fe89a17ed1b8a6c27c24d63f88ebd9b6d543416b
SHA2567fc9a74d6d461aab6ddf833b7c547cf6bcf7e2ea8ff5e16584e62c4bb34433ee
SHA512ff051902a47df05fec2e9b052ac3d16e13a6802af401dd8daee6e29c483bdea1eddd61da514f3ee78e95afc1c3e8ee9af0d1b123b023fecd1195925c27ed08b3
-
Filesize
22KB
MD5131156ac1a3f563266fb13096dfdb178
SHA1a19d6994e0a920e7bd2836b3d0c4c0b9995697a7
SHA256de403663017d653646d15ce4e267e4060c1bbc53ab74542c3a20bc8905cdbe55
SHA51293c5f9b1f0ef78292ddb6aa4649ae6ee70676dc862a9bfe6b3d68b629848d8bbfad7ba3d1a7bb5675df3fd7b5ce4586f704bb471135a9533d661c0efb8d3ad08
-
Filesize
7KB
MD53fd80ee2e269f65031bc9a95038a52f2
SHA118695e4c8ae05431c781ef9626a63d9b8352da18
SHA25667d2f131e1960d08dee8b3af6fee12880c404cc76995b7ef337465e7d0cfeedd
SHA51211cafc827725029f617def19b1e8becf6c5457a2cda212bc09a70fc9e49041e8d653247d2cb96e008b8201565eabd56f874cf8aae400457c738daecc0864aa03
-
Filesize
12KB
MD5d9924c888ebcf4be41c85a0c093a70f1
SHA1fc9da1c26f4bd08c87ad734a7d9d74643f3759ee
SHA256573a194399810a7b376def2afb5b18bbfeec2692085f9c34a4d953f19a1ed3c9
SHA5121144bc35a03507fc640aaee17915ed7b25851b34b354837821ed225a05756c46a70d43aae3f99bbb0670fff01a1f3cacec81eb1137ba1271dec9bd9adc0588f9
-
Filesize
731KB
MD5a6df5248bd9579e339519dbe87a6a0c1
SHA11ea0ea79ae6c7a8e323fb7bbb6415e287ef6f031
SHA25662bdf06a073a6eea271484a700d862f7e1ac60de34c79ea1432a953bfa37fa5a
SHA51295eaf77c23deb38ab61f20d02fd6d59b4b6c8490df8e6888d420db04667d1876dbe750e0197befcc28d862cef5d129824764387cd902ad48bc40f43e227c0b8e
-
Filesize
10KB
MD57781700c70dfe16428e5ae2166d829fc
SHA13e203e59ecb2e64d413e12b07190ce366b98f17c
SHA25699c59de8f8af0885826f0d8577bbac8ec0017345d88b14af40b5e09745563038
SHA512e8c7dd2695720f0124ddbeafd5d9a60e0423751a03b5a8a23bbed0db8107f183cb229e56b04b9a54de8d625ce721350f4319989676faced713fbdca85010a20d
-
Filesize
47KB
MD56cfab3482485cb13a29914ff9e068039
SHA1884f93ee85946ce524b420d7720c9e78432f39c2
SHA256867eb02f4cdd04e7f4e9ddc3d2c25bdd56d91c20f73271ae7efa7f0e02999597
SHA512a8f4b922b3652a739e0194c8c3dab4f32a659aadf4021a699819b14f5e6b1e789dda21d64bbd3201acbc5ae497101aa31aa31126f20ad182ee09ea9095f4d22b
-
Filesize
480KB
MD5ad3112eb67dff3f9015c5fcd037dec61
SHA148ef244023ef0c044b692be89fb809745c164b86
SHA25624aa51675b16c6eed555a55501acfe1337df56fae005971a16a6581ec024a21e
SHA512a90bdb576b9297b0b88a8e8913faba8cb0acdc632d3785df0ddc5fc7c992c8d289011f61152b510f476a5fbd756905cf3088dab033455fe3ce71b7358f733835
-
Filesize
35.0MB
MD5951bc8c1e19fa2d4138562f90bba473c
SHA140a48c68c2113a44ef4e3b5d3ca65d7c54e64660
SHA256848e6e91b8d1524f0e7996fddb02fd742bbcdf8c668dd6768933f1f7f7384211
SHA51282b1172091466b6fbbd0ecb34e548ac0714c751bdd9f630683e268ffcf2a7bbcc9b38df5086e22e7faa1e7371ccfd9a74eed296d906d4e57fbc4ec075387ee26