Analysis
-
max time kernel
120s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240910-en -
resource tags
arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2024, 19:29
Static task
static1
Behavioral task
behavioral1
Sample
40f69fccc551dc0646b2bc52507f8d42e199b8fe8509729324eaf60932c24d7fN.exe
Resource
win7-20240704-en
General
-
Target
40f69fccc551dc0646b2bc52507f8d42e199b8fe8509729324eaf60932c24d7fN.exe
-
Size
4.7MB
-
MD5
61aae936b420e773ab181796edcd33b0
-
SHA1
82a6ee9219e1f710783a861a78aa8b0840877163
-
SHA256
40f69fccc551dc0646b2bc52507f8d42e199b8fe8509729324eaf60932c24d7f
-
SHA512
65cf66875f7865ecf729d031bb97cd427866dd51620ec7b265ead070aeecc60125156e903b0e2dadfaf2df01964d8b3cd0b089a1527631f0fb2d2c6350bc42d7
-
SSDEEP
98304:gFG5oe4fjX5MmJfX/lSiyUVkKgmehKD527BWG:/yMmdfkbxKVQBWG
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 4872 alg.exe 484 DiagnosticsHub.StandardCollector.Service.exe 3372 fxssvc.exe 1164 elevation_service.exe 2872 elevation_service.exe 4600 maintenanceservice.exe 2800 OSE.EXE -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 11 IoCs
description ioc Process File opened for modification C:\Windows\System32\alg.exe 40f69fccc551dc0646b2bc52507f8d42e199b8fe8509729324eaf60932c24d7fN.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe 40f69fccc551dc0646b2bc52507f8d42e199b8fe8509729324eaf60932c24d7fN.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\44ec78fdbb3a4e59.bin alg.exe File opened for modification C:\Windows\system32\dllhost.exe 40f69fccc551dc0646b2bc52507f8d42e199b8fe8509729324eaf60932c24d7fN.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 40f69fccc551dc0646b2bc52507f8d42e199b8fe8509729324eaf60932c24d7fN.exe File opened for modification C:\Windows\system32\fxssvc.exe 40f69fccc551dc0646b2bc52507f8d42e199b8fe8509729324eaf60932c24d7fN.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\dotnet\dotnet.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateBroker.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe alg.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler64.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7zG.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler64.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_88171\javaws.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 484 DiagnosticsHub.StandardCollector.Service.exe 484 DiagnosticsHub.StandardCollector.Service.exe 484 DiagnosticsHub.StandardCollector.Service.exe 484 DiagnosticsHub.StandardCollector.Service.exe 484 DiagnosticsHub.StandardCollector.Service.exe 484 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 664 Process not Found 664 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1788 40f69fccc551dc0646b2bc52507f8d42e199b8fe8509729324eaf60932c24d7fN.exe Token: SeAuditPrivilege 3372 fxssvc.exe Token: SeDebugPrivilege 4872 alg.exe Token: SeDebugPrivilege 4872 alg.exe Token: SeDebugPrivilege 4872 alg.exe Token: SeDebugPrivilege 484 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\40f69fccc551dc0646b2bc52507f8d42e199b8fe8509729324eaf60932c24d7fN.exe"C:\Users\Admin\AppData\Local\Temp\40f69fccc551dc0646b2bc52507f8d42e199b8fe8509729324eaf60932c24d7fN.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1788
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4872
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:484
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:2552
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3372
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1164
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2872
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4600
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2800
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5f85de700cce10a074f70c20e4649e0a6
SHA1654ab23663dbf60e55d111ed58102cf8df8ab2ee
SHA25600b3a15b453e1e399fd951f620d3d3d30b674db97a293d590a75ff18e016b761
SHA5128d11b9000c886c3f9a406517697e0f2df82d13542ff4979eaa8db617433bd31d80818b820dd7d4642761ea2e1ec7e2a838a69b07e3904ef78eb5cdcc8fdc8d5a
-
Filesize
789KB
MD595317a22d55f30e93e94045437bb29d2
SHA19bca6d2e054afa57f4838fe4c79d8e3f15e36810
SHA256350cf81d19a33ff8155a9ce106d09a86a0fed461e390db9470228be65258ee06
SHA512e92ef74461bbb9a688aa473a65b0c03ec15cab8847343d64af03fd17f92f4af737938d8871386f0adb58c2e42bffdf89e88c6817a0dfe98253f6481ebb160637
-
Filesize
1.1MB
MD595e9dee562d3cd403092f531bcf57b23
SHA1849d57bf3fbc67579869aa2c4116e9b1fbde0269
SHA2568687c2edbdce183413dbd6bcb5869101de8e21473ccc9676d3011b9f8f047bd2
SHA51230999d31c3dd6bf07dc0756acefdcf6ff9deb6c09019887c5ec0730d2eb30f6ef1b1e49af515cdb63d0e9bb7755456a41fe434449c71c37bcac6b6ce263539dd
-
Filesize
1.5MB
MD522a50733016d05bacc3cac33f502516f
SHA14ea6208d06aafadb7b4f1adc50b5df3bf0e83ea1
SHA25649e7d7ff8aa4223348e5f73fc294427c0c25fb93b135df2ee57876402f9f2db4
SHA51286bcf5677b255f4548e72e92c0cedea5e394c4e35b6c82c857094ef3b8679401c666bd7195478ed6ca7a7b79231a2f9d75f824cc76afe1f3d54b3b33f4752a0f
-
Filesize
1.2MB
MD5e4b627a381e455a5b8973b566923e5cc
SHA1bb14eff71e6bf8693a8021634dd0b0a9f0754476
SHA25672cc318f14819f7c0bd092121fb1a1ec59d82fdde099225b35bef1f4acbbc92d
SHA512304cdff974903b29b21b5eeea81e54ab017c6b385596e567a72ed0e8cf1bcc31ab6ed306f1e3cfcb8b666f1f6da9337f790db99fb7730f9e6ab04de722dada67
-
Filesize
582KB
MD524716b6a4b375dbc0c62ae101e3638b5
SHA14c715e96f49fcd247ba9b161a84f95141e0922b1
SHA2562e96e14a8cccdfe58f8a8e7f9886840feaae4ed74db86bdf610d396b99ce6e95
SHA512df01f9d2d2849db3650da3b1b9e30a15387e1509e675a9576a994910fc5edb504d03e266befb45a95959a4e306f3e70027266b87148644f2fc904c1f61b1dba0
-
Filesize
840KB
MD57b504d24656839822a6cc770b5c19a38
SHA1f40bfac08140b8778d81addeea4592541cf43da7
SHA256fd9d4e1a4a91b647b260c9d8080511682f72159c04e1d5f0cac6b289d7a71b65
SHA512cfe002e8aa8de612fbcb1313ac0ce87e0b747b57411cd4ecd55a1971e7f3884ef0c3abe2de3a0db4d663b9d95ff45bc054eebfcb64427e07cc045e4aca4b75ee
-
Filesize
4.6MB
MD59a30fbb2b3cb882a06ccab6a91ad4255
SHA11a4469bdeeb23a3fb67360fc04dcc84ac16f5717
SHA256ad06d624c58922d0e9ba21a160336b3232fbcfaa86622a9571e592707c083268
SHA512c0b619e2648b647f3129811422f0f3828fcd2bea9b64ae8bb302a976db1581df7d6cf588e9048dd0bd169862d54f0fd38897cf375cca2f11944649a6961fb47d
-
Filesize
910KB
MD5f128bb56e0efc4cf61369d959dc302cc
SHA117d9f871db56d3d04f609019b77fb021e8f854e4
SHA256e956772c7a3f2d5a8de278cdaef15358dd12a8c610f7a5064f83e2afdd62d5bd
SHA5124341f17008dd92dfa9ad56a1ec3db41e57801fcee1b08771a79febedf13e683caee200a214bf0b6819c4b2e2f97fe8bcabc06e8f06135cdaa74fe496706cb70d
-
Filesize
24.0MB
MD5ea1e62c7e99d6c833a3e6c8b077e486b
SHA12c79e3ebf5c878f7a164a17d475994f4241dcf1e
SHA25688393127fce1ba57a8c8baf3368ba3030792a0c2eca5c164f8f5b19584f6cdbb
SHA51254289cdea66c3efa75729dfc126d130b26e54099844a7adb5d194ab12224dec6bc482152c5e8ea24aeba810a7d078f629de1cfd847a82333b91120bc564cd354
-
Filesize
2.7MB
MD5d679142c33da68b3dd4900f244f84496
SHA1c22d9ea416362e4d4e22c38451e6d01143c9ad2f
SHA2563d01aa81d8d24140cc002dbfa383afa24e8837a2618f8312b0572e7de4ab71d4
SHA512db12fac84f484291e5b2d4548fcfe20d8f051388b3807a299d9548a3676cec7bc08ecab756f5dc292c2799c1aee3b2880149c9e7ea8df0a4cd6ea388fd41a8c6
-
Filesize
1.1MB
MD5cf0360637e7673147868189876b8f794
SHA1a1080b1a35b63379d61506cceed63491caa3b1d3
SHA256d57d68f5bc5dfb104bef3b87cb72928bb21b48e44cf923373569bc4b0be5eed6
SHA5122ecc38a2d1efb6e39d8329a1b5041731af40a949065544d8c5114900dc5f3d3a0769cfb510481c52522648c53ee737ef47a905e702f665dc0376e1887ccb482a
-
Filesize
805KB
MD5fb4d75df1a9d17b006848b1d9e7a1edf
SHA191399d7753ab1c9d1c04577ca13b6665cc7a6eba
SHA2569cb0b6661e0ceb46b32556399d3797b1395b02f693c6d05464ab6ae974fe1672
SHA5123f63398111a60ae0e4c65452cb84d9f4bb6fb54e011e9ca514a0440d8b0d81c9ea7c2e96c9d30f78a60ba70f482886108bc99fda9e69c6ca18cfd62f0950ecb0
-
Filesize
656KB
MD5023e4cf6030297aa077720925e4630c8
SHA1c2eeae2f73a3dcba5827e80209b37c61ec8d8969
SHA2566d185f5ac575fc177668996b9efc5aee77b96b461be519e0a89e779216d8ddce
SHA5121285aaf2f3571545e91beb9feb1dd99e0f0752ff7dc3e7c529d98659ab8eafa4e8c28f4fcc6c4634d2fe8eb5fe6c3cd38327598a582c5809131913d48e987728
-
Filesize
4.6MB
MD55ece092224a51a8120b15daae62cecea
SHA1719930f76fbbfdbdbc9409adb5bc4d3a2cc70624
SHA256a352fb47b6c3890e5d64e95788647a8e64c9f4a2561df6a1bfee5a0bac88ac7f
SHA5129709f069cc27bc2c8c3fc5f2780c4a7b933cf33c374b642e64baccab579997a1a9db5d6da69cb684aecc8874d54fa863a36020a79c16c9d1b6f6d36b56a3efe1
-
Filesize
4.6MB
MD55bf0bf501c012449fd27f145da724eb8
SHA17b241e6b6b6b5593de51f74f979668206218b66a
SHA25677fd8a37dce72e2b2f7819b78e2040f5b5b26b97ead0acd28148a8abd193e38a
SHA5122058e574751b1372b5b0164acf61cc8d0bd5e3d6358125eff4331aa17ef528ee87d36bb061271951913977ef5b11a9af73806da97787e0bbc764a29247265f5a
-
Filesize
1.9MB
MD5eb3845e104726a2c6f7635858368d75c
SHA177a38dfc002e6767caade4e0e2bfb2f137bfc1d7
SHA2560e03c574730af7cb99d3dac2d13be6b5c08682af380e4ec23b974bac94057a04
SHA5127f5dc94ae55c74fa4a784dd1f2d93ab1f9572d18ccb5fddbc7b97cb766963b66cba155081cbbd36e08e2b4b135de628b6b745e0b7912839546be6dceae614b24
-
Filesize
2.1MB
MD5cac55ce2aa4d532f951c169316988b80
SHA1cdfc2319118a67c5a8cbc2c161b980e6962d94a7
SHA256a7be840b04b8ec036602e4e9f24f22a073335832aa44854f88779ee3a380bc39
SHA512a7e085ff587b752fedb6de76925470b389b993be09aeaf5b5c23c3d7b2e6284830c97e2993083fd507a1860d99b90b6108daf2a74bdfe1827e3bb2f8b3290107
-
Filesize
1.8MB
MD5abe2a687cc65f2bb453c89055b2af35c
SHA10e8771a1230e197378ba37e8612c577884e3f04e
SHA2565a02ef053229dc27cefaa432b9490603894e5dccac591b250d11e0bd283cf4eb
SHA512731183f0d86c0e4d4976c76d4bfd47b23d326e67ff9b3077b1eb11a28325891d95b9a8aac98e5184c7faa8a57155b97d4284db7bdbe76cc04e40d29517ebd7e2
-
Filesize
1.6MB
MD57f899beaade059c2ff96f6dae6205664
SHA13eb88afec547a94650e0c362f5f9ca0a44996ab7
SHA256d8e6ae8b45f4f07552da39b63e043b4718c4f4d53d2cb550af0952fea62de4be
SHA51251268d0d9c7bc54265e20172806e1c9e2edfce2808c91a197413f0ba77a5e0f122f9e6202b41144ac7bce1dda65dc6b931fc95a832da81d0774f84ac24cd0a13
-
Filesize
581KB
MD5a7500d96d4c2a2e57d0d70ef87ee3977
SHA1d3c4c65c9b1bbe55100e9bdd13b3e3a1e67cf21a
SHA2569c6c524161614912fd6594c94f8b6c28c518363f43ca0d6643141d2c602008d4
SHA512cc1c10475264416b0644b25bd25e1ccd575cdbb408c60affce04a513d3e7fa9688cf85d9ac519ea94c218edb1dfd95399e63e63f43baa7f96c4dbad04ab662db
-
Filesize
581KB
MD5292d13c1ffa93834daf924ac43ac89dd
SHA10a7020fbf58705c70f38e9847c3bd430dec2f125
SHA256d149956c1297162e72f72ab89112eb31e7f2d180b8cdfe6e9ac2766c025bba18
SHA5128b5fee9f92b6f6586340463acb87a397987f9c4508c9039df3e2042f3df3ddab6056b629572b6e6c3ab029183e04ebb0aee0c68c66757b53db378a19c469e5de
-
Filesize
581KB
MD56fd5537f9fa16e22fa4f81b943ad6b58
SHA16d7019125e0a00c74593cef8a3fcb00898fc3f03
SHA25614cd32236006242b048ffeaca888347a0516cbd9b1a299ff8c634d9d5a57d1c1
SHA51294370a61d6a5b3aea39162afef87db48c33e5a9e9912b90355fd1298dfb93cc347b200dcea149e4a00e3235e5e8b2535788954010f2df9fac57a1fde34f18f49
-
Filesize
601KB
MD52f8d7c51c049fe2319b1edcfdeb817e7
SHA15545ebb6daa02f518dfc31b957579ab6ccad1d3a
SHA256b4452cc0c3cd58d7613c92df70162335ffcd10a32a9b8f61f6de9aab9aee806d
SHA512082f607cf2d4785a4ee08285017931de37e071593175511a35e402b08f1ee87dfc7e62c3c671d403b55b86a5104784ec150d014e4122330439b1304a7208c8cf
-
Filesize
581KB
MD5c8483eab34ccd1d27cef78f3b492f3ba
SHA12eb43a6cc678af9c98cde1e3c943bc2044aa1d98
SHA256d7148950ee946b1aa0c6db15e5239327c7731355ccc031297d47fe38093d9931
SHA5121e68690514c92c64e3a7365a3346f73864f406c0dfcb065b2b7c22fb68af3caae60da254222dc3601597b10c4a8a1a869f228d7552b95415e082c7eb0c1a900d
-
Filesize
581KB
MD56b8326091b759b80c56c9a3ee9d594b6
SHA16559cd50832a0d355a663390de10293044f63ac4
SHA2563e6ca1be197b255f06bca9f91ccef0ff18911231c1c54a3b4dd0794888afd534
SHA51220db4668c38006862c225181f4f56eb6b04e93bd47f2af1263d82d6cea012ae7f0b46c2d1186d79f5459d41bbfcc5472031e7203642c53fab199d49ace1882f2
-
Filesize
581KB
MD548d24c235cbaaa4dc64267f1e21cabd3
SHA15c3d72e0cfc99332ff33acf7ccb81fde86486b46
SHA25640a2b83414efa8a8f5df686a57259ea50fe864f726113af42a059ee0f0a0e757
SHA51242db2870cae7a090c671c2fa46f30befc6507472c4530f649f7854c1bc0c95dae1acd54b9a298e4a5de297b30abeb63cce1a171491a29f8a41b8aba363e451db
-
Filesize
841KB
MD57d6fc8ebbfd1ab2b61e9adb640c6ad3d
SHA138efc75e920768071b6eb4b9c839bad5780a671f
SHA256f849a34e94077cbebaff87032476a59b9df9fcab7f1388e431ec8e7e56d763c6
SHA512d4476112687b4bb4d3fadff1a1e0664868763f23dc18ac8bef7e9c8a130ae534891c60263424b4dee6a8c030108e4b6938c0e6395d081fd5dc36127b572afff5
-
Filesize
581KB
MD583a41c11933f0380f93cfa2908481636
SHA1bd554a6996045da74bc693d9b44b36c82c75e030
SHA256996e61305fe518ad2a36850a2dbf9b934392dfbd59a6b86a11a642d47d470d0c
SHA5122920b32ce83a7059a35e528f53b0a579c6de261b7e927267b09aa12bdc1575bc4a0cc268b4337733c02e763ba4d279b45bc0817cc8280a9e5a05eebabb527c15
-
Filesize
581KB
MD522d44f755c32c1c4ecde57140a643fe6
SHA18d683ad7e8ba9e1d40405606f5f526497b0815a5
SHA256d346d00b7179fcb24370807a30df3b63f38da280c261e68d34383e904fbbca37
SHA512e444beb0da1b003452741d18d222b9517230594aadae8389729fc68195d9104dcf39b3c24f1fe01edb2e9cb74d71c80f2d781eb52e26808884378de20c0315e9
-
Filesize
717KB
MD528a3f5e2839a17e1a26f7cade8642d26
SHA113bd37cfe463a1e52a13e9510dfb6d74cb01581a
SHA25649b26b9347f7ce72f30b93112f517cf8d25a8c18f062ed9f96b1a77d9583a5bd
SHA512c055afb93a07c5137eb2207245d9a146a2c66506813758edde5e40a21c25d20468ed6011a479ceabb457f0636a3e91816e26407258d612c37f1d56b5a143b28b
-
Filesize
581KB
MD5e12b24af963ffed8f7181f20dbb66382
SHA1ad5769e868364b267bacc6ae05b80261424eedeb
SHA256fcdc2eb62b7e5239711db7bcc784ee8e83046a4e655e17af389d764a6c9d190f
SHA512c061c7903d723cca7c3cbdcfa5b0db464095bad5bdd6179cd89cbcbb31460b4f83aede9cd88e345526906c7afddcab13c909263cbbba314558f43dfbb228de55
-
Filesize
581KB
MD5d36ab8714984d41505a0f042a58f4866
SHA1dd9927526335ec028e525014464dc4594a8a014a
SHA2568b3acfca781b0e39eb47480c94e4d173ea0bb08e2128ea56409f5addaa902a0c
SHA5124bda9847fc10b2bb129cca03b3d0a0dd09fb07b010f45ae5da3bae6cd48e1a887d56a5e809f7efcf5443aaa03325bc4f4d8c5732ffa1c16e991f8376edb673f6
-
Filesize
717KB
MD5825799b956a273b8776a5409455a3eb7
SHA140c867a50a272fb971acae19928f7425055cec0d
SHA256d2665e3baf673cf35b930bf5d10a7a7c5c378ce32b7177d264b8d6ff520fa068
SHA5126c0d0577a7d8d12c38253fb27306bfeb9b9157b11ffc2e6689a3a4f66dae1000e75ffd4740e6a7b3c6ef0d49f5825254c6aa3736ff02d82347ceb7109430cd87
-
Filesize
841KB
MD54b2f30b7975011eb37d96a7cd6923ab0
SHA1968071db3ecb0d2b3fbdeea2cc3056a28e268c54
SHA256a6ddcf809d92cc53809165477bc18e5e671f7fff4b028d111b0368ac5f83d8cc
SHA5121b658616117312df038a1771832bfcedede588193ab434f31265f4856bc8c0a27146dd4673908a3825d0491d8b451f05115e250676aba7c1204052a495417e76
-
Filesize
1020KB
MD51419dbea4e428db3b08e183dc24679fa
SHA14207bc7a352bee5ae4aaf2cca7a508c1a40ac46e
SHA256979a44524bd42992b95d32ee91ec33b7bb8ce161019b574e1fecc046e5bca56e
SHA512078b467857d20a3fe728cc07c80de76d9eee2100fa58c69a4dacc52d015ed61a03168992f9ec5682b40cafbb3858a98c0dbff23ace3b7130126962270345cc6e
-
Filesize
581KB
MD5a1237a8df9fe229339836f6a9e4762c6
SHA1392c02439ac60dadb618e2be7a1a926dbf721668
SHA2567ace7d0a6b2f7fe79d05c3dd2a06b02a26ae24f07d9ef4f29b67a3a4d77763f5
SHA5120148404665874efb640320bc44a52471e3e970276192fa593ad9b7acd05e76eaa763c001e89a559afc0f7f1eed9e3105ed1e999af1f618026b652828c0a55985
-
Filesize
581KB
MD5f21b757788230b5c9ec3dfb69952f9e6
SHA13d53102446a84df75d1e129b2aa3937e6b3948bf
SHA25602558faa52a10b5261dc33726ec42fbc55dbf0b1cb2ebc5d94dfe71cca21540f
SHA512acc5e5988beb3af2a691d4a2aa3f8d0cb8c86ce954970b0278dd3e5b61b4ac4373626c2e8a486a8b069446ffb4341180c2865ff96eb794d544031f35899b19de
-
Filesize
581KB
MD50ce7d7c4f0e351b1487ad2ead46783e6
SHA1f96a7fc250e519d25cb4cd6d2172d338f3fe1556
SHA256c52e86cb7b8e83fb72fe6ef560c42cabe2de2049374c689802f213d0003587c2
SHA51221861f4e68c92278ab52847bc9656031ae1f56d91dc4688b8f8a4d4bc98d1e9657cd5216fca528f17b421b10aad936d3d61bc74c29adcd2785dad5ea2e7f2f5c
-
Filesize
581KB
MD5e8f47df7f98415dedb21071251d00416
SHA122e646a486f73b20c725bb54a3393441da4f99f8
SHA256e9b262edc2e76d8552b0fe40345717699a5bd77956f6b762a7feb5a519575449
SHA512bda1d9b2131a8a25ac625a5103bb3a338f3cdac11aa513f2cb31030ebd3f653ee2b1bafc3bcd4704af40680d9196a2e5e5aeb7f4cd0e7315924d396c0a5e3ffb
-
Filesize
581KB
MD5bdf6f3b64444518be8e36f6a6b41a45e
SHA19f95b4d2dcc5157bab41134a69665716389b73b4
SHA256a0151068c9cbcda05249bcff62062a76dc9d4754cd8291f507c09aa2e67cfdf9
SHA5126cf2353b1bf54ddf1b48e39365fa9f65a440d5c32611a07630de9083b93e10cfd926de4ac980dc966afc41059029e5afc8618b830a4bc53a795ef41bd589a0f0
-
Filesize
581KB
MD5f0e5d0055900b5fe26b19482e53bd907
SHA15a5186bfad9956dd50fd9b4585b32d3fbc3fda9a
SHA256da9cc0c6a81f21bb4cecb06e3021793abd1b78d2da701148c3212f1bfa341be3
SHA5125d2adc30f16f3a08b8699240f6da386eea1f9a2f48abf4697895ebdf92b3a0bbd5d518c9c463f9d1e9593238ebe0a623325787fc972c5db5ba958edeee2d0e0e
-
Filesize
581KB
MD5f40df2d608bca689d2881fef797ee125
SHA14ff8aab2b6c3e800f1e20f62ed0bb89560520f69
SHA2561f6dc14462460f79f9e8748f0d2f8b6b68daa2f84ad831e110d213f19cd8eae3
SHA512a8ec39e5b053c7eba64a39a0921351bf565158fc9a1344d388ce143f2bc6cee74da66bc7a534a7f604556b5f7e53e4efdbeb86f856d12163562a2ce6da9148eb
-
Filesize
581KB
MD57559ba0836e434a557d694a041a28068
SHA178944c0ed5de3e07cf9bdfd3e7933b1680dd77e0
SHA2566507e6b980c07e03dc4f809bb5c81e28189db75bc08ef2e5e9953120e5b80c8f
SHA5124bddfbcf4b7f1183f5507e5351a91d657c89ce51d54a4c069465711cb3f5d5065c2aaf2b7da7664c660879e89b6d70ecae01079fb751e471e25dac7f0c0470cf
-
Filesize
581KB
MD55465cafb15e8996c6868bdc6e363cecb
SHA181d1b505c3550d83c8da44aa334f75c5f93d5ee8
SHA256a3fb7a4790d0b7c03faee6fa287f43be9dcdcf35cbda3dd165494d589c9620c9
SHA512daf2e0832b280e5c30b847a07ac30e31dfaa96dea8431f772b935f6a06ef398f287c5be8c62b589846c753fa5536a126565e6ad2a9f63b9c0a2d53bc107830f5
-
Filesize
581KB
MD530747cccd37b228feb72d63db21db8f5
SHA17510f3196adcf01d9503bc9aa759a846b4b70cf0
SHA2566d221356284e81e3d0c816e0773283eeb758fd73eae41d0f32597d08a619eb81
SHA512a27b7186fe1e214a5bbdc6fc19c78bb3de3518caea21045544e3173908b151a2d107a4f099e93a6cd7531f06c2588db0bf9643de2683a3edfc017cb221caac83
-
Filesize
581KB
MD509b4a33c38bc517e64fa9d9cd686e7a5
SHA187591f1733b52c56f620b9b12b2a0107084073bf
SHA256037099de1056b636a0fd9335a753b6c09ca807e29822c32a954731ad4308707c
SHA512685953050f362612d02592ca1019d73bf16a9450166036163a4c2b288ae8cce86e6b4ad6a059e6e98c030e7e6b365528a70ea4b0bd715c44bfc8860e796d27e3
-
Filesize
581KB
MD5af19169f856f01fe62f1670bbe538efe
SHA15398275f3e4fe8231975b8493479144d6a7e8dfc
SHA256f6bf175e35a5e23271f9e45571bdf10c507b0465aca651c505a6e6798a44527f
SHA512016be4a818ccbeff501645a3c7e2e1fedf2a19f5cd1eb3f4fafb2f18452297c97200c2674e74f9bc07d7f40945a9e9da0b0d527bd582a830529418ae88c338fc
-
Filesize
581KB
MD5c9489b1ec9ed3837bf9b9c8ca7ef3dc3
SHA1dd401040d157ce5ec73f8317d1f11e1215955e3e
SHA256764b04abe4d6ba231e8247caf7b0d17bdfac8ac1a22b4529c80870d3b7ddfaac
SHA512268d24a75921f942ea35687bbb44e39fc32747aefa7224a0f152b59094783b5c96ca68d32d47da407e18f9d62c6ec53d18f241917f61f2dacfa14beaad10ec77
-
Filesize
581KB
MD56c658e441f76a823a7aa09ed1087ff9b
SHA112b2372dbb1ffa999e4375d30638c94695b4fc54
SHA256e11a0ed20d5acbc9fea1e9fd8f63ab67b9c41e4b973fdb1e2e583381e973a75c
SHA51212ddce1d7be305b86e7dfc5064473f15edb01231e79c13e5e8c554faf72e008de01da452f79cd6783c80264aa4e1559fab9bc423593e6bdd0d72638f3e0a4d6b
-
Filesize
581KB
MD5dbacb11d348c02770fac2464b45fcabb
SHA11d97acdabe94022e95553ff6fcf096655b8296a7
SHA25630c55a1931e80093799c0ef56bc6c915d3d5dfd69cbf804693c0cb3eb91bbcd1
SHA512bcd4d05e0f4c57b8ac26b922144ff894fe5acf54373acaab955a6d2486a5be9493f43fb13bb0d05646c19ff31e04c178a268978de53057deace95f15e77e2ac9
-
Filesize
581KB
MD5c3743b347ff36b1635429bfd9d7e53ba
SHA18e5efe723bf0d3465bab0ee95aab7cdc72fabbab
SHA256f3a93b175d67653b11395922d92d43e5c11ded46f63aeb1890c1166cd11686ae
SHA512644436f551172fd5a842fded80e76b78dfaf1f33642708d377754d0933295c0f82599ec095f25bcc3b3c5530d81bca13256f1f6b588b5323447784c4c7323410
-
Filesize
581KB
MD5a7d37e14c2ae7ebae87b17e7477d086b
SHA1c196f65049a59ff5363c76c42faf02d2de81ce9a
SHA256a296479b0b0c35904c9c3ea16c3c087e1947ba34b73b22bd3f89dc9315e05a4b
SHA51273c22948e8d39a202caca42ffc15ac0d89fb286b460cece622a4cde80d485ccd122803495b925e3c899b5d61a003c9362947b4b9b614ca6fc94e48ccec74c79d
-
Filesize
581KB
MD506a0776661b3fc7bddf7942839a217a5
SHA1d5da5dfabaa28c265f5eb3861fb9c3d0d2ba378a
SHA256b2cc7abab58003cac795c581c612defcdea140f23f591cbbbe6ce33d4528b23e
SHA5124e823041b061219659d64c70c22a2ab29d23df5f37d42f6482f35a68eb0a641b6406921bec4f23eccf84651ee02f581a1ee7fb49718f2ab7ad7eac99a8421da2
-
Filesize
581KB
MD52056f234454b9b29d5e68ef2930821f9
SHA13c7409ace4a02553a1d8e712dac7ebe1cbe37837
SHA2566b06aaae24653f676313caf81044f7830cd7e1f74636c78527475fa25f382f6c
SHA512dc589b9cc502df465425ea70a16d3ce039707770d91cedff9a9b6f6d47ef7f0e9f42757f8161f7a58269bd7191e91ed038fdd564dea7fba06e7fe11aede23628
-
Filesize
581KB
MD52fcaec61c818bb86a0c45ce74429e737
SHA177bdb6c49d0d6e6b104e2769e37455fd85a5886c
SHA2567d7d93786aecb7f2c7f25f9f5d5fe0be1b5188636826b469360f1f50bc653b63
SHA512bf20ff31e06ff195f2b7f423d7fcc9bb3ba493db52d29ceb31c2914d492d6d773b2f222d612801612431971b340a5f9b8ce2813bc3caa27ea5f4803b269a76d0
-
Filesize
581KB
MD5d6efbd79b0a9ca6eb043a087ffa044d6
SHA1410d4101179e73da4d402377e4efa0e44b13fba4
SHA2567dfbc1529a157788421630efa001820223d8ef739099bd085432cbb7c306510b
SHA512653b1d7a9816a33062f1c9c26766d9cbc5afed8979afa41f320e879c7cdba81c3f38e7acc1d5d3069d83a8de25558e1a99224fe0244fe3cd93fa48cd946c8699
-
Filesize
701KB
MD5085c43a860bd015de144385275812ff2
SHA1b6cc7bd65eb586bba4b32533462dae543d40ca80
SHA25605e101c837fa1c70119692b7de12d5930b3975ada0604e6fb8c8a50c7c6eebc2
SHA512ae32d0a112045bc42741b48b9d9a5065139efb4ebb9e66cf072c9eece9241f2849e661f823b7b24d460086954c6fb9ddb06801cb02d2b835351603267d6500cd
-
Filesize
659KB
MD5ece0b3e0552a75576a43f6429b937da9
SHA1874536449fa567198791055779eb6974a0045e59
SHA256d5cb078409d495a0ef5e4400c747ccee01a3cd7025b291272615a395f9420451
SHA5125e3816df41a42824e14442787e9fa64ac60fc66979f39478c53334bd328337c3340dabf63d11236a9fa9023bdae987032d01586c4f6dfdaf9dfc10ceac7a13ad
-
Filesize
1.2MB
MD5ea8d8c2c8db1e5e3ee7ebb87b0e8a8e7
SHA1f24655714429d2b3e5fb1223cacc471f8a334cab
SHA256567c714cc3da79d2d834d78867cbef688193b444abdf7ed1d03ebc06938bca9b
SHA512ff936a5c2989c199b8a06dd0c881e0373bcb15d8cffbe77956b912fb7d6917b7b0c05748a4c9459ffbb42e89ea87c8e15e77681467b47860628c1ffaf9e14678
-
Filesize
661KB
MD529af7822c8e20e47e8db82d1fcc4c671
SHA1bca180d92d5f4d0e8d217e1a8961d17e2d6576de
SHA256cfac14df8f655d1b30f4b456b719599a3ca50b61f5ffb0d973f9d0b12d9153bb
SHA5129bbfb60a9b3bcb8965cb03614b389e4385030a291b92806548041b84fb262bccc3c8341f435ab7f27eabfa49b28bfe5e54161f033c3024f2adf289755b645b80
-
Filesize
1.3MB
MD5a70caebca3d0d2ee2b0adb1a4f3cc207
SHA12c093180bbf98260eb9b02ce1dc18935bac3000d
SHA256422b5b75d17e82732f83f83da9ab638a0336c30f13160ffd688157e942a7c026
SHA5123725197f520c69f366f83f4a3ea2970a4043bdfed46578fb1875929ded111f817fcebd83e0af76df55c8ca877cc65aa339a8ae9e02139fecda8898ed2b44d1a1