hxxps://drive[.]google[.]com/file/d/1-uGQ8pZqR9vXr64vTDIa092Rn8TMwLxb/view

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2024 05:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1-uGQ8pZqR9vXr64vTDIa092Rn8TMwLxb/view

Score

6^/10

discovery ransomware

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	Present.exe
File opened (read-only)	\??\T:	Present.exe
File opened (read-only)	\??\G:	Present.exe
File opened (read-only)	\??\I:	Present.exe
File opened (read-only)	\??\M:	Present.exe
File opened (read-only)	\??\O:	Present.exe
File opened (read-only)	\??\Q:	Present.exe
File opened (read-only)	\??\Z:	Present.exe
File opened (read-only)	\??\A:	Present.exe
File opened (read-only)	\??\J:	Present.exe
File opened (read-only)	\??\H:	Present.exe
File opened (read-only)	\??\K:	Present.exe
File opened (read-only)	\??\L:	Present.exe
File opened (read-only)	\??\S:	Present.exe
File opened (read-only)	\??\U:	Present.exe
File opened (read-only)	\??\Y:	Present.exe
File opened (read-only)	\??\B:	Present.exe
File opened (read-only)	\??\E:	Present.exe
File opened (read-only)	\??\V:	Present.exe
File opened (read-only)	\??\W:	Present.exe
File opened (read-only)	\??\X:	Present.exe
File opened (read-only)	\??\P:	Present.exe
File opened (read-only)	\??\R:	Present.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	drive.google.com
9	drive.google.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.bmp"	Present.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2045521122-590294423-3465680274-1000\{E6C9C709-73BB-4975-9DFD-7CEBD5AA342A}	Present.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
5404	NOTEPAD.EXE
5860	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1728	msedge.exe
1728	msedge.exe
4040	msedge.exe
4040	msedge.exe
220	identity_helper.exe
220	identity_helper.exe
5148	msedge.exe
5148	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	6100	Present.exe
Token: SeCreatePagefilePrivilege	6100	Present.exe
Token: 33	2412	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2412	AUDIODG.EXE
Token: SeShutdownPrivilege	6100	Present.exe
Token: SeCreatePagefilePrivilege	6100	Present.exe
Token: SeShutdownPrivilege	6100	Present.exe
Token: SeCreatePagefilePrivilege	6100	Present.exe
Token: 33	6100	Present.exe
Token: SeIncBasePriorityPrivilege	6100	Present.exe
Token: SeShutdownPrivilege	6100	Present.exe
Token: SeCreatePagefilePrivilege	6100	Present.exe
Token: SeShutdownPrivilege	6100	Present.exe
Token: SeCreatePagefilePrivilege	6100	Present.exe
Token: SeShutdownPrivilege	6100	Present.exe
Token: SeCreatePagefilePrivilege	6100	Present.exe
Token: SeShutdownPrivilege	6100	Present.exe
Token: SeCreatePagefilePrivilege	6100	Present.exe
Token: SeShutdownPrivilege	6100	Present.exe
Token: SeCreatePagefilePrivilege	6100	Present.exe
Token: SeShutdownPrivilege	6100	Present.exe
Token: SeCreatePagefilePrivilege	6100	Present.exe
Token: SeShutdownPrivilege	6100	Present.exe
Token: SeCreatePagefilePrivilege	6100	Present.exe
Token: SeShutdownPrivilege	6100	Present.exe
Token: SeCreatePagefilePrivilege	6100	Present.exe
Token: SeShutdownPrivilege	6100	Present.exe
Token: SeCreatePagefilePrivilege	6100	Present.exe
Token: SeShutdownPrivilege	6100	Present.exe
Token: SeCreatePagefilePrivilege	6100	Present.exe
Token: SeShutdownPrivilege	6100	Present.exe
Token: SeCreatePagefilePrivilege	6100	Present.exe
Token: SeShutdownPrivilege	6100	Present.exe
Token: SeCreatePagefilePrivilege	6100	Present.exe
Token: SeShutdownPrivilege	6100	Present.exe
Token: SeCreatePagefilePrivilege	6100	Present.exe
Token: SeShutdownPrivilege	6100	Present.exe
Token: SeCreatePagefilePrivilege	6100	Present.exe
Token: SeShutdownPrivilege	6100	Present.exe
Token: SeCreatePagefilePrivilege	6100	Present.exe
Token: SeShutdownPrivilege	6100	Present.exe
Token: SeCreatePagefilePrivilege	6100	Present.exe
Token: SeShutdownPrivilege	6100	Present.exe
Token: SeCreatePagefilePrivilege	6100	Present.exe
Token: SeShutdownPrivilege	6100	Present.exe
Token: SeCreatePagefilePrivilege	6100	Present.exe
Token: SeShutdownPrivilege	6100	Present.exe
Token: SeCreatePagefilePrivilege	6100	Present.exe
Token: SeShutdownPrivilege	6100	Present.exe
Token: SeCreatePagefilePrivilege	6100	Present.exe
Token: SeShutdownPrivilege	6100	Present.exe
Token: SeCreatePagefilePrivilege	6100	Present.exe
Token: SeShutdownPrivilege	6100	Present.exe
Token: SeCreatePagefilePrivilege	6100	Present.exe
Token: SeShutdownPrivilege	6100	Present.exe
Token: SeCreatePagefilePrivilege	6100	Present.exe
Token: SeShutdownPrivilege	6100	Present.exe
Token: SeCreatePagefilePrivilege	6100	Present.exe
Token: SeShutdownPrivilege	6100	Present.exe
Token: SeCreatePagefilePrivilege	6100	Present.exe
Token: SeShutdownPrivilege	6100	Present.exe
Token: SeCreatePagefilePrivilege	6100	Present.exe
Token: SeShutdownPrivilege	6100	Present.exe
Token: SeCreatePagefilePrivilege	6100	Present.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4040 wrote to memory of 272	4040	msedge.exe	85
PID 4040 wrote to memory of 272	4040	msedge.exe	85
PID 4040 wrote to memory of 3008	4040	msedge.exe	86
PID 4040 wrote to memory of 3008	4040	msedge.exe	86
PID 4040 wrote to memory of 3008	4040	msedge.exe	86
PID 4040 wrote to memory of 3008	4040	msedge.exe	86
PID 4040 wrote to memory of 3008	4040	msedge.exe	86
PID 4040 wrote to memory of 3008	4040	msedge.exe	86
PID 4040 wrote to memory of 3008	4040	msedge.exe	86
PID 4040 wrote to memory of 3008	4040	msedge.exe	86
PID 4040 wrote to memory of 3008	4040	msedge.exe	86
PID 4040 wrote to memory of 3008	4040	msedge.exe	86
PID 4040 wrote to memory of 3008	4040	msedge.exe	86
PID 4040 wrote to memory of 3008	4040	msedge.exe	86
PID 4040 wrote to memory of 3008	4040	msedge.exe	86
PID 4040 wrote to memory of 3008	4040	msedge.exe	86
PID 4040 wrote to memory of 3008	4040	msedge.exe	86
PID 4040 wrote to memory of 3008	4040	msedge.exe	86
PID 4040 wrote to memory of 3008	4040	msedge.exe	86
PID 4040 wrote to memory of 3008	4040	msedge.exe	86
PID 4040 wrote to memory of 3008	4040	msedge.exe	86
PID 4040 wrote to memory of 3008	4040	msedge.exe	86
PID 4040 wrote to memory of 3008	4040	msedge.exe	86
PID 4040 wrote to memory of 3008	4040	msedge.exe	86
PID 4040 wrote to memory of 3008	4040	msedge.exe	86
PID 4040 wrote to memory of 3008	4040	msedge.exe	86
PID 4040 wrote to memory of 3008	4040	msedge.exe	86
PID 4040 wrote to memory of 3008	4040	msedge.exe	86
PID 4040 wrote to memory of 3008	4040	msedge.exe	86
PID 4040 wrote to memory of 3008	4040	msedge.exe	86
PID 4040 wrote to memory of 3008	4040	msedge.exe	86
PID 4040 wrote to memory of 3008	4040	msedge.exe	86
PID 4040 wrote to memory of 3008	4040	msedge.exe	86
PID 4040 wrote to memory of 3008	4040	msedge.exe	86
PID 4040 wrote to memory of 3008	4040	msedge.exe	86
PID 4040 wrote to memory of 3008	4040	msedge.exe	86
PID 4040 wrote to memory of 3008	4040	msedge.exe	86
PID 4040 wrote to memory of 3008	4040	msedge.exe	86
PID 4040 wrote to memory of 3008	4040	msedge.exe	86
PID 4040 wrote to memory of 3008	4040	msedge.exe	86
PID 4040 wrote to memory of 3008	4040	msedge.exe	86
PID 4040 wrote to memory of 3008	4040	msedge.exe	86
PID 4040 wrote to memory of 1728	4040	msedge.exe	87
PID 4040 wrote to memory of 1728	4040	msedge.exe	87
PID 4040 wrote to memory of 4260	4040	msedge.exe	88
PID 4040 wrote to memory of 4260	4040	msedge.exe	88
PID 4040 wrote to memory of 4260	4040	msedge.exe	88
PID 4040 wrote to memory of 4260	4040	msedge.exe	88
PID 4040 wrote to memory of 4260	4040	msedge.exe	88
PID 4040 wrote to memory of 4260	4040	msedge.exe	88
PID 4040 wrote to memory of 4260	4040	msedge.exe	88
PID 4040 wrote to memory of 4260	4040	msedge.exe	88
PID 4040 wrote to memory of 4260	4040	msedge.exe	88
PID 4040 wrote to memory of 4260	4040	msedge.exe	88
PID 4040 wrote to memory of 4260	4040	msedge.exe	88
PID 4040 wrote to memory of 4260	4040	msedge.exe	88
PID 4040 wrote to memory of 4260	4040	msedge.exe	88
PID 4040 wrote to memory of 4260	4040	msedge.exe	88
PID 4040 wrote to memory of 4260	4040	msedge.exe	88
PID 4040 wrote to memory of 4260	4040	msedge.exe	88
PID 4040 wrote to memory of 4260	4040	msedge.exe	88
PID 4040 wrote to memory of 4260	4040	msedge.exe	88
PID 4040 wrote to memory of 4260	4040	msedge.exe	88
PID 4040 wrote to memory of 4260	4040	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/1-uGQ8pZqR9vXr64vTDIa092Rn8TMwLxb/view
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcc5c646f8,0x7ffcc5c64708,0x7ffcc5c64718
  2⤵
  PID:272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,2246772289156335275,17628815823685708705,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,2246772289156335275,17628815823685708705,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,2246772289156335275,17628815823685708705,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2246772289156335275,17628815823685708705,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2246772289156335275,17628815823685708705,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2246772289156335275,17628815823685708705,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2246772289156335275,17628815823685708705,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2140,2246772289156335275,17628815823685708705,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4660 /prefetch:8
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2246772289156335275,17628815823685708705,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,2246772289156335275,17628815823685708705,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6700 /prefetch:8
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,2246772289156335275,17628815823685708705,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6700 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2246772289156335275,17628815823685708705,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2246772289156335275,17628815823685708705,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2246772289156335275,17628815823685708705,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6628 /prefetch:1
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2246772289156335275,17628815823685708705,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2140,2246772289156335275,17628815823685708705,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,2246772289156335275,17628815823685708705,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1776 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4252

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4268

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1188

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5620

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Present\readme.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:5860

C:\Users\Admin\Downloads\Present\Present.exe
"C:\Users\Admin\Downloads\Present\Present.exe"
1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:6100

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x528 0x524
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2412

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Present\links.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:5404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
99afa4934d1e3c56bbce114b356e8a99

SHA1
3f0e7a1a28d9d9c06b6663df5d83a65c84d52581

SHA256
08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8

SHA512
76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
443a627d539ca4eab732bad0cbe7332b

SHA1
86b18b906a1acd2a22f4b2c78ac3564c394a9569

SHA256
1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9

SHA512
923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\319e4827-1b12-4264-80ae-9dffa7013478.tmp

Filesize
5KB

MD5
e1839269cea8ca70fad6daa30c2d5056

SHA1
513901afcfc25ca693570b49ec9ce50a8e9d3883

SHA256
7a819a9d91328f23f08b268b536428bfa29b0899451a3f828a434b6491d7fd4a

SHA512
d9ae3ba1c2ca1f7e1f6bfe0cc655639619a0ea4cdc6f51f95710a556dd0d889f758a9552fe5287ea23c66bd4957fb4e23e89d24de06b0c7015805b719b2303b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3b2d5c36-036e-4008-829a-423ebde109cc.tmp

Filesize
3KB

MD5
db855959d6a1e50cf18392bc7562e910

SHA1
8922cd28dbba2bb138a2bf5ded781fc8a503673d

SHA256
59a2552a7703ba1d4b36c49ae8175ca6ae7e4f1734d4f6aaad75f47f5dba1956

SHA512
71c326573275e56914b444a4f336160f58bfc0d4a87bdb4bbfbcba535a5a43e527f3a4e119b77b6c0d166638f913884b4e857858e66bb6d2043357a49d380040

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
d0ecf0b17d2254df0549bad819f0b1ed

SHA1
836b29b86945aa89f720ed7572ef2c8cc82c5b90

SHA256
b0433ea088b99a348806daafa23002602ceeb99f5bfc0db88927c926879d4043

SHA512
d5244b5fc31d6a659297a0f8b75b0046a97d550ebb269fefed2f6291552fb3f9f120d895738c1691b06ad8e1a44eb7cad67076d9321c4a63b9841f623b0ceacf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
b414fd1307713935c54181591aaad14f

SHA1
ef438018bc75131e4593ac650cb123070fc79e73

SHA256
1f2238e3256615cf4eeaf31b70f5dec3c6f34bc88b400cf157baaec3c2e5d65b

SHA512
0248af813a31a8f2d1fc68b789571b01e1caad82c67d25acc0fe4243555474df006cc92cf2ab30deb95c4ce4c180d65fcc78b7dc49043a5bec294dcd92611625

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
269f09e5f3135e3848e8a05e390a3f93

SHA1
a5dc3ff4b67eb992fe33e9bb2ad892bd78781811

SHA256
f06138f21e4e54e98f147815af0432fdd23c9842b13b10a61008334b082cf9dc

SHA512
854c1277f1e41cd5fc023edcd0b5f4a73cea9aa60e50acaf36d2b81b953bd3b69f79bd3af1b398387530aad71e9878f32595f18c197fcdf8d4c8dacbf432aab6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
edeb78ec3cc9930010ee9f6a3cec23e5

SHA1
d1f4f36b058dd468c6b52c7cba0aee81fac9c673

SHA256
d82f45a520b113d7813242814e575acefbef99e61bd2637a860148093898f2de

SHA512
1026bc86a1825201da0cc2bbd69b49d2105ca16d56579e832920774563798691ff42a4737cd1c9414337a60102aa48ad6d151660b2904f03956436b4044a0bf5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
36c7fa37bf4d89e170de35129d46a639

SHA1
f8d9e0b16b9ea27132d24ab051598083d8b3e8b5

SHA256
db99ba39533edccd8e44fbff6c3932742bd4a7c325205164be149bc123f31481

SHA512
ff03b89f1e6d2d71bcb18e8f7b4a11d2def0e4ef8656867a70d315b338350167ca381f09ffd3664773fe1649d9b5a96c66a5059c471345a26eefeacc28f40fae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
de435edbad9055ef26a8c090a6c83648

SHA1
83b1d487ae3c47ddf37e728c043cb9e6dffce447

SHA256
211683145fd9889df79cf30d19ca1635b1f5fb8a774f5189bca0cf060149e959

SHA512
9f8048fe3fa7ef6bcc3cf21966d78fc11ae05d85e055debccb04c7f8e01d1f2081c7c360dcf839244c5719acf5fe791ea4dfb27995eea76fe79a67497738f241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
584661ef6a3975e4bc5702b9efa5d652

SHA1
4b7ce06ea835e2cfa859e96175bef27a6e1df7de

SHA256
877105b6761ac791844d826773dbd97cd9992f0b497d2993f41a68f464bc6a5c

SHA512
39b158ba580af2e943b6de35f2950fc237b7516d4db334bf0bea8a82b9caf46ff3113b9a4b137943c94ff60a58a502cf640931b8ee26c604ec76a3f603a450f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
640KB

MD5
da695ba238dba92915a3cce3a2f032e4

SHA1
b87e57501a80cac59e48299a4d6d249a131dfa85

SHA256
2517d215bd570872eb24424bb7923e4ab5b0590e9e37c355bc1cfd333aa7d64b

SHA512
7f1d6ab1ab11f20315948ee90c7eac6f29c9a3e023d3efcd49efd1208d73079e3995cfca04f3fe612344b8c7e65a77c6804f931bcce9ee110fab701f31413f29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6IJLDY7V\WMPebd74df2-ed6a-4b7d-a153-4d37299f52e0[1].png

Filesize
3KB

MD5
9cfbefbe3b55cd182310bb4cca258782

SHA1
1896601895aa6b805dfb273309b511e85853e0dc

SHA256
21fb225cc08b3b9b09dede07f5f69c0ec36d66354051baf575d0c727b6c94374

SHA512
0d0f98d342336e91e65a4553a4252538359da904323e98d94c5d4f62763fbe15ef17b01773e6749058867b27c167b0b55a6ad77545715d29cee8a53eda3b0484

Download Submit
C:\Users\Admin\AppData\Local\Temp\cursor.cur

Filesize
4KB

MD5
47fe7529ac587fde0704b319d9f2cb06

SHA1
08cca4cea4c9282284abd9eef87d93ebaf2c86af

SHA256
a66fa961070aadde45d30fb0b7781c2dcc1d323d9f818320180d39296ad7e9ae

SHA512
a0acb0c1ab0261bf239c46d9fba5a445cb77755a54e7bce8676ec1c871c0b77eb34f20d35014fa8a7c5973b813e5e4121b4c774a104d646684b6faf682192950

Download Submit
C:\Users\Admin\Downloads\Present.zip

Filesize
44.1MB

MD5
173757dfac57dea66b3b45a961aa073c

SHA1
b9f79bd06ca62f9c3755825f0516538bcf3aa949

SHA256
ce50320de9c8bf1347d9a66927a65b9dd6ef5eeaaaec97551f61f239423d20e2

SHA512
713788d23728fe1b1887cbc4893a6924b88bb852a812a17e23f16ef34f10c02441ffacc19db49c3ccb47a7d0950efc1bd6d84a008729065251cef60c19adb30a

Download Submit
C:\Users\Admin\Downloads\Present\aud\1.wav

Filesize
2.6MB

MD5
e21b576b90a4efb7da97c783ddd0bd8f

SHA1
ff9875a60f81b792005a0db448312693977cb97f

SHA256
441fdbd8422cc4bb6a1bfdf3cd983c82d4578ca57a1db2424a54ade2fd945313

SHA512
64c7bc552e37dcad9ea2e435217e750a5fe6640f74151116b77a200f6f17d26dc8eb88831fd3127f0879a811378fd45911e130396ed3828cc181c91cb34f41f4

Download Submit
C:\Users\Admin\Downloads\Present\aud\2.wav

Filesize
2.1MB

MD5
fc82237cca5b3f823e4b7395b17303e8

SHA1
04fa66996fa715cb9f8df731c88a89b5bd7a429d

SHA256
2e5c3f1a8ec554b9db4fd49e919d63ec0070ee2c7714653971bac43f51e778ff

SHA512
67ca8efcb0b5aa13b05b4ba7f3d51b077ad16dc2f01c8a443239ca4a245d49e6adc221703e658f58f85edf0febf6d489aaf0e92775988e058d3fe842aefb5fe9

Download Submit
C:\Users\Admin\Downloads\Present\aud\3.wav

Filesize
2.7MB

MD5
d56edd3948e8fc25c296c01391ac707a

SHA1
29cda9f0cced5b8ad8c16e88b3755f6659c5ab16

SHA256
2fb1308f71d0378f0a9302e886e910c3825fc5c1dfb83fc4870d4c332dabb51d

SHA512
ee35981da65e6f00ee6229ba43862b2dd9c67455df392218a155d83481e0854d8e511965305a8c8755499dfc7a0dc98a9e594f3ac555ae248fa4f754c61046e7

Download Submit
C:\Users\Admin\Downloads\Present\aud\4.wav

Filesize
2.5MB

MD5
ccf1bb77997ba306b54a81c06c4daff9

SHA1
2c045ba9e34c61a7608a905ad5e90882fcfe44cd

SHA256
e91a83e38e7bbd6a85e9f8d245986437039f188380bb43aae2defc57a058663c

SHA512
92eccf1e607419874bd08f62961c774b0bd732ecdf0c94af5f71fc1822295eb715508de67d0b5bc368240e96e93bc38f0d5556d57d047f16873910f938706793

Download Submit
C:\Users\Admin\Downloads\Present\aud\moan12-101soundboards.mp3

Filesize
12KB

MD5
2d2c6bcfa306fb23f6ff0e007e79de87

SHA1
177681812206a40fac9116ade7c00b4ea6456b08

SHA256
33155c28048589e32cd9715826c23e366ef9db61ef052e8b12bec566dd3df2d5

SHA512
a369bb85b0fe1e0c823eacec7eecfd02f9055a5dc2bbcc51ef864e88c434a5382fd1dcd6f20e75b42f7b2d08239ae6efe260687ce71149f7a53d6828196126f9

Download Submit
C:\Users\Admin\Downloads\Present\aud\moan13-101soundboards.mp3

Filesize
11KB

MD5
f9eba17ac6b131914dea35a4a559d6d0

SHA1
5a0dbb4650f97c1b20509c82695690092da899df

SHA256
9d014a16ce3e9b29fe32f187d52296b777790f3a22ac33696aa6d8adc974a9d5

SHA512
63ae798ee5233279646e1e3e469708e37fe5fd531aa8b019e04b55da38d81b56f8fbabb1414a2f299760ec6d3f3261fce9665f1e4efe4f3cd9a26335a59abb64

Download Submit
C:\Users\Admin\Downloads\Present\aud\moan15-101soundboards.mp3

Filesize
10KB

MD5
2cc67d771118354b0351cd21f2a4f5fa

SHA1
307ca11574e369ec336ab78f2ad662c0dde7cf9a

SHA256
147d7a1f5a30679832662d0d91489f2c76d966b01eb59a7575934c9739901180

SHA512
b957c866fdd076fe0f41d066cd90f7927e135687eb2d192fcfde83a643254433e417d6d2b8656444f6dfec76bb73869456968100fa78ca0002487a10dc859bfc

Download Submit
C:\Users\Admin\Downloads\Present\aud\moan17-101soundboards.mp3

Filesize
12KB

MD5
736021b4fcb827f7404d576baa4a407f

SHA1
44bf5057f1010d13e9a92ef912c00ce6f4028b4d

SHA256
18abbae814660e3f542093ba22ebbfd031192bfc40f25b17bd76d70fd1fb53ff

SHA512
7a0559885b6560a5179cf8a831ecc071096ac5710f5710f7839799ecb7529c678badfba1185ac0bfaaff1ec1239bc99d11464d0f4de0b30473792092b9217b6e

Download Submit
C:\Users\Admin\Downloads\Present\aud\moan18-101soundboards.mp3

Filesize
101KB

MD5
f33898c696bd35669183750e4194635c

SHA1
0cf25ebae7f7f6d604dce4e69e78ccf13fcde863

SHA256
5ea1cb59148827bb7161e9a0cb893e99245d9fa9f9ec803768d6ee59d7ef6df5

SHA512
194381b2c645ed4fbc0ab334c13617385cf8f711a49de4802aa2f937fbd8058a8c5ec3505a5b3e24ba7c9f666646136d5e7837bde9756e820af8f5eda08166e0

Download Submit
C:\Users\Admin\Downloads\Present\aud\moan19-101soundboards.mp3

Filesize
20KB

MD5
333aed8793601f7abdf20be7110be995

SHA1
910848624230f9209ee6475a4b76194088719087

SHA256
9727269e5f7f049315bd6b4071f8c04dd906d6b79e7086da31f6ffe69161c3ef

SHA512
c360ae4689c928be125488f55d250152fc1cd6c45b44113960e815e312fcd018fb5cd43868ccae5ad5e65e77a12997ffe70cd085b3bb27bab53fbbc44c39b4d3

Download Submit
C:\Users\Admin\Downloads\Present\aud\moan20-101soundboards.mp3

Filesize
11KB

MD5
f92afd789b29417e582250953f3d42bc

SHA1
ffc4e8ef33d45c16bf5904b5d4d0a89fc2200b8e

SHA256
0ff68c6d7b00d7a20b3f2f3a0f103a84e4fb42ce3eeb9b810e9acc1b9ef8bfb8

SHA512
3669421c94e2fdc0c34eab4b3b60633be9f4a1d94b90f86399529e4b699290da995112f84379ea97b8ddac314cde67cc239765814e8859cc6e2d8d3e7adbd6b0

Download Submit
C:\Users\Admin\Downloads\Present\aud\moan21-101soundboards.mp3

Filesize
45KB

MD5
696dfe23545cf0f0fbbf1f4483158c83

SHA1
92a826e13e28dab5aaeff83cf2aa7ac869c58a3b

SHA256
a34461c7e5bc1a868ab828cf939c5755f77fda9cb663ecbc2c7455738a1c133c

SHA512
d1a5c8b55d4721be820d36d93e9e10c4f292e35f6ac31bd9a79b5794912194654bd493636fb547827c8d9dabbaf9724fae0784e7c01f272f74f194b3e76c059c

Download Submit
C:\Users\Admin\Downloads\Present\aud\moan6-101soundboards.mp3

Filesize
13KB

MD5
9c373696a569ddc2f935a1fa199ba4f6

SHA1
9a0594aff903a8275b5bbd060106cb8ddf93525b

SHA256
1f568ee35c1b8c1ea19c7e895b23a9b43e6aa5ac13395be11d557cd22a0414cd

SHA512
5d44cc94fd13c39542e550d936b4aefe1cdfd8d82d6f8a831b5da4c40be97fa796448aaf104d29ffb5cd7ba063e1b26016773ecaa38d5eb08479d8ebabf4ca3e

Download Submit
C:\Users\Admin\Downloads\Present\aud\moan8-101soundboards.mp3

Filesize
8KB

MD5
c20d413f8483431485dfe0399d293db1

SHA1
73e16020f17ebcf10f4f618522928a59df45c11b

SHA256
b72c23720cb7048678fd9bdbbbc254cfb2cc7f2ca153770de6eaf9b9985fef13

SHA512
53ce084665088c31284ad3700e454ad24aa5436836c8cd74c4284e220d3c17dd5e84e7bfdac4450fe8552e7c51e056ca1a71e02163ae085e853b9711ca6f8ee2

Download Submit
C:\Users\Admin\Downloads\Present\aud\moan9-101soundboards.mp3

Filesize
9KB

MD5
e141b361e81799c1e441fec2085634a3

SHA1
f53d147312c1e46385cffa2c79451e4278c076d4

SHA256
9e2488b705dbb5b5b99aecfccc5354a7846ee82b45b01bdf42041e245f6381c7

SHA512
9e58151e81502942d1ef324b1b5452d3f89ea610583a2a15ce41dbeb06593f1c11334e5f1926e4fb361125a6ecd1aa02cd599d81053e1160b42b69a263a811e5

Download Submit
C:\Users\Admin\Downloads\Present\img\033fca99627657c9f49c021bf8b22a3a.jpg

Filesize
774KB

MD5
033fca99627657c9f49c021bf8b22a3a

SHA1
c1074dcdc9c5995c31dafff321489b51f529c637

SHA256
4c0a27ee83b5768db2650fd2d918ac5d1106c7d09cf3ffa5ffb277d50632bc66

SHA512
75251b266932ee2a2d26691abb24eb19521139ad7ae961eb4a46b6f9f8979d2679019fa1725f38a0e1941fa61cbc6185548e71f211e501389651c730a086304d

Download Submit
C:\Users\Admin\Downloads\Present\img\1a241bde60a5d50bc7294fa20cbda55a.jpg

Filesize
279KB

MD5
1a241bde60a5d50bc7294fa20cbda55a

SHA1
a9d956593b913ad2cd5807fbd834204ae8acd99d

SHA256
e50fb2dbe3b54f83b1e8d1dcf9594e782ba7269ad43ffe4dafc34078a43461db

SHA512
7d61c2ffd998d5c239bfcbf032f28e0fe36016b8704edca98b20326237dbaddba3a43e60d4aff27a69a64ffb7a284cc01451215c0659c67fb4364776c2f870e2

Download Submit
C:\Users\Admin\Downloads\Present\img\2482a6c33527fe35cfb1af4c689ff5fc.png

Filesize
616KB

MD5
2482a6c33527fe35cfb1af4c689ff5fc

SHA1
36895bf0df481865b82829517af8b6ece2b78f15

SHA256
ebdbaab0bf94f81e48ffa981fa0b4a473de5323a2c0080caea7d83cd6e856aa8

SHA512
d653053e4ad74d10874ffb23dfabdd7a341bc8f137e9e393614edc49e79a1e6c65feda9b92859c86330b36aeb8473ed684d5db778685ae81dfdabe5ee16a3e63

Download Submit
C:\Users\Admin\Downloads\Present\img\2e756c62bfed7806b4c608704f30b8e8.jpg

Filesize
343KB

MD5
2e756c62bfed7806b4c608704f30b8e8

SHA1
6e1bf02b254e7537ab82248f3b9ce6a461cfd56a

SHA256
630a6626877282e2c9aeeb69b8a8400807eff369e50e55444286326fcc91f1ea

SHA512
d14a7e7107cef1a545d972b5b371655c174372e3e590877d165c10fa34592c0e73cb44c654e1b5cb6c20171d89a51250e59eaba72053c5c8ea28e43e7c759e11

Download Submit
C:\Users\Admin\Downloads\Present\img\4001f8dc2101182f425f29aeecc8cf39.jpeg

Filesize
486KB

MD5
4001f8dc2101182f425f29aeecc8cf39

SHA1
0cb84aa34a19a83e53286d1800cf25e521ca68eb

SHA256
c4df5109eca02ef594f0d2d18575ba22d43ad269e181f16021d6e84d2773f99b

SHA512
1d462d6b49fdf1279468581856440ee9717819275cbf90ebfb1f351ddcbe99554121b8deee3e84ed79c2e8622f7e07c9b0f57b998fe3a9337b43680df12731ca

Download Submit
C:\Users\Admin\Downloads\Present\img\57a1a541c3dc2fb5710ea0f95402e7de.jpg

Filesize
358KB

MD5
57a1a541c3dc2fb5710ea0f95402e7de

SHA1
b593fcd69b2c93de74f2ee832dcd8cc1260f0b59

SHA256
fa81c1057415a85551bef9f5ffe34f7429e59ebb62a4a4c029e4043481610e71

SHA512
d22bc1b5ad46b200f45adf3b8ce947557ea5322b8050b0d1d7ab968d4fa008cce72f32193828fc69080627c4d93566ecd3735ac1fc13cbc2dfe34683101bf136

Download Submit
C:\Users\Admin\Downloads\Present\img\5c1062a129353b8d757af85857d17627.jpg

Filesize
149KB

MD5
5c1062a129353b8d757af85857d17627

SHA1
c3e56f1206e75d47c290ed7e8bf1cdd7131a0ac5

SHA256
806fe686997144c63624c328a29ca6031e6f1dbbe25752dd7d7c7a350d0e7462

SHA512
264fef27082ff594baebfaddd7e241f44fcb330ce91bc00e3a2f2b7e550e10206d33079187d4930bc0a8392ef547895c39b326196bcaf6d09200b59b79f16ad6

Download Submit
C:\Users\Admin\Downloads\Present\img\5ea5e2d8d64327e94dc94a58ee10a50d.png

Filesize
673KB

MD5
5ea5e2d8d64327e94dc94a58ee10a50d

SHA1
14ed220bc58e763452ffcc8a4161f67da70f1ab2

SHA256
47278e96bcc4fad3b2188ccfdd421fd7142fc83143023b41b4b01d1d5542d83f

SHA512
0398d90d2827e8592eee9271853899664003888ac21802fdead768c82cc3ba48c815f7f3667341230507e94b6f35d62f730d8d96fdc216ffd188af79d79659df

Download Submit
C:\Users\Admin\Downloads\Present\img\744e199f9ae42a947af4819078bb18c3.jpg

Filesize
397KB

MD5
744e199f9ae42a947af4819078bb18c3

SHA1
d06bb5a4087790ebd0e0858e8951eea00b2c3eed

SHA256
0c306392e949543409dc0dd6b2602fab0a1350d332011231a98b80cfa3e18077

SHA512
1ec8a21afb9fdcedc3f0a5fa0d4f1ed1af1861e026969597e51260738e748355612f4a7b31004a698fcc1ca16e493336d2c5603390c67cae7beeb2002aafb05d

Download Submit
C:\Users\Admin\Downloads\Present\img\81ff559332cff4dd9f33fe2c12bff8f5.png

Filesize
474KB

MD5
81ff559332cff4dd9f33fe2c12bff8f5

SHA1
1fb68fad0e87e41d02605634bccae7c1b8328824

SHA256
9bac31510698da5ebceaa817feb2214b66538249d62551cef77d6ed14002e62d

SHA512
754a167d5700bc96818b449f8d203d3df6528ace3a8aaab03764686cb112c92cc27f642bfd6ddf64d6fa7f65a9919f60ef74a704d91fb6d49b2bdaa02f111996

Download Submit
C:\Users\Admin\Downloads\Present\img\83e58ceb541340959d904f67ef65cece.jpg

Filesize
222KB

MD5
83e58ceb541340959d904f67ef65cece

SHA1
5b0845c440ba568600585ca2928a7b11a91068cd

SHA256
d4c597609137dcfa746d4f2a543b9607d06fc6d98c46f40f4d8cde6fdf21a3a5

SHA512
6d4aa21b3a905b6cf200ee606b1efd2086e02d61b3b90caa858f6add674c247c8cb91242167f0a3cdb01a5f238e6c462e26cd20030e510ebb5690828b9580338

Download Submit
C:\Users\Admin\Downloads\Present\img\8dde89f6a5ee18e1d98374ec1ca3bbb6.jpg

Filesize
80KB

MD5
8dde89f6a5ee18e1d98374ec1ca3bbb6

SHA1
420e526a1eb5cad0c1292085ebc11de254007847

SHA256
ea78e1bf8aaf073a105610384f8fa15aa7e34f1519037602f6d65cd2a961a564

SHA512
15cd2c882c372b8ab8fece551e253985a2c37f65d77775f783d6b1fd49c7062cbd8c6ba293123fe6bdc1211472b698974aff6b71ce6f1eb8863b2df2152205f6

Download Submit
C:\Users\Admin\Downloads\Present\img\8eb1af7f9a67902d9cefe0e4e001cf83.png

Filesize
700KB

MD5
8eb1af7f9a67902d9cefe0e4e001cf83

SHA1
ce6b9e2e56baf7e48539d779e2a9c7d78e357c63

SHA256
fc38eda2a97e2d021ee9fd85e3228e10ad0c45299aa4dd1e40b3c7fe22e13e35

SHA512
ed629817619481017dcec6e4108247aab6be2f588883fe5893fdf39442f4637651cc7622031eab55b3a8f55a7ba35750750195bcddb7841a3753d23f3f6444c2

Download Submit
C:\Users\Admin\Downloads\Present\img\92279a736599b2b3cabd4ff4db6a4bea.jpg

Filesize
149KB

MD5
92279a736599b2b3cabd4ff4db6a4bea

SHA1
9a1597b057690ccdd8ffb6d12a7062f0ba797ec6

SHA256
ce41beda55a3fea4443715d957317a374a23db3a2812616905a2ec9c97e0ce0d

SHA512
8f51d786e1703c7e3a22043a4a5d654ed45de6aa45d769c922ef96379ba4257f2287f3fe69d8c522803719e5f50014187dce4c6afa3c420c5617c0aa14eee5d5

Download Submit
C:\Users\Admin\Downloads\Present\img\937cb3f0afb8cede20314a59e68142ac.jpg

Filesize
596KB

MD5
937cb3f0afb8cede20314a59e68142ac

SHA1
c46803edcd2b37be0848243d4b77bcfc899bbf68

SHA256
961d576b05c17ade614adfab5831e01a1b444cf5ffc849c08e286f59b873f2e2

SHA512
befa671ccb9ead2a7cd665352913628dc60e8f54c12a0cdf2e599331b4b85ae2a9735812cedf7aa979c13483a4471be075c9ed0dfdc818036a2f00c3ef92214e

Download Submit
C:\Users\Admin\Downloads\Present\img\b26caaf1c3134affe4b625b5fe354420.jpg

Filesize
163KB

MD5
b26caaf1c3134affe4b625b5fe354420

SHA1
383923d3326e530001bbabd2b2b8ab7829e906b0

SHA256
bffaf9d6338e719b87e63402dc8e8690a476cdde5e49d8fe9ad7f660a5bd3874

SHA512
33944c72901f9aeb974d53688d02d1204ea22e8e2d2a890ff71e08fb86573975d15de3016da448bfa05bdefbe69f499d86228aa235b926e7826748c40cd6ac36

Download Submit
C:\Users\Admin\Downloads\Present\img\d4033b822ac9e6a1c616875a65b1e8ea.jpg

Filesize
129KB

MD5
d4033b822ac9e6a1c616875a65b1e8ea

SHA1
2117a4a44fd1980bf7ebc3d2206e893c92002817

SHA256
7c2ab9df6120ed8fdd1962b8cba62fe6ac3ea1bc514c9b602d86f80e17ebde86

SHA512
662b0715ee877e5d2bf914d5607c5f731aa260c07c6241134da47d7d83fea605e9fcc24f44fa35d9e28e81bf939e869b9e40230ecab0d38de2b35e242b6eb596

Download Submit
C:\Users\Admin\Downloads\Present\img\e357d268d00bb433849b219670c4d5eb.png

Filesize
1.4MB

MD5
e357d268d00bb433849b219670c4d5eb

SHA1
5b4194943e6acdc1018e3aa5003b409cd807e344

SHA256
8723e533f4bd3f72301a59cbb328b682eddcfa5efae7572303d2d409467da9ca

SHA512
259413844220f854803cf44bc9d48db84f0d670fa6e98987fc59874d6c7c13c6f98d0810c7aad7541d50096835e3b9613f533233d5291e331fc340532d8c6f53

Download Submit
C:\Users\Admin\Downloads\Present\img\e9049899163ad81ef8361a89344071fb.jpg

Filesize
271KB

MD5
e9049899163ad81ef8361a89344071fb

SHA1
efa2b372c6d936ffb771926e15ef3b4a053f68a3

SHA256
3d391216110350f390717b98e2785c833ace62d0be777cbab2c5568594847457

SHA512
7691805ce78374c7e8b1ed0907b623f4444f27d2634b104812c406ccf7d43277558e1cf31775299e3f1a0fedcfe7f79f8a31517830e922536a78b0281c37d163

Download Submit
C:\Users\Admin\Downloads\Present\img\fe5bb5471c3edda19dfe52505925eb50.png

Filesize
377KB

MD5
fe5bb5471c3edda19dfe52505925eb50

SHA1
ded2dac0e2c6d20c3d391a5bdd8215c7fd6e9dc4

SHA256
c60a9917a5f882c156f89837e6c87df918bde2089a70ea604ae660259d8fbb90

SHA512
22f37b3bfd5201ca4a2f3dd84054f1e915031301b037c5b86d3247fc433273ca24404b68164c7602a23d62b5c2ceef175688565107f648e7e67d44ea2dcc0ad0

Download Submit
C:\Users\Admin\Downloads\Present\img\sample_0a4cd31cf7fcfb42168d0740b31e778b.jpg

Filesize
151KB

MD5
ba6f01d4d402d4cf059b197e20f85401

SHA1
f517eba7a9a2cae7b803f71bef6cd1a10f03646b

SHA256
823b48f4e9a2689b0577b0a7300b67d9680cdae8938c494234eda362a5ea989f

SHA512
3479c9aef641cccabb2c1f12a4429935ec36d5cd5b08a422149e398ed1b580bed487b51795d0be6d637cd5c5a1711761cf54fd8edc299468198ef3fe1b19dc39

Download Submit
C:\Users\Admin\Downloads\Present\img\sample_21519ce0765922523b04b3254cba611c.jpg

Filesize
58KB

MD5
fd3968cdad2b66e0af9e576c295591ea

SHA1
fafbe7f4a8463b0b937d242642c8bb7e1545ef79

SHA256
f19dbe802736c0972d89ea8d5de1328f257d48d119abf90dd687796be45c2da9

SHA512
721f33e84967d8025fd249485f73fa645d43e7c066dffee5a21f75abbea8c1cb436958031cd0269317b9e74283f187b3ed98ab9fb66ba2c12ed9f5aec3f6a9df

Download Submit
C:\Users\Admin\Downloads\Present\img\sample_27f0ceeb2750697ee4bc34d8f3ee24a5.jpg

Filesize
198KB

MD5
0ab6a52ab60566d57c95cbf9cfb43b98

SHA1
0af5d9b0a3795c8558ec5b569a4e9dc0b4e10ee8

SHA256
1708d95cf50e489ac01a034b09e06adb78f24254536b01013745bba2abedf9a7

SHA512
f00ea37660ba2077508d9998e1aba5e95b4c96277fe9cd97f5e13079fe383c6a9e6a9797363e6d030c3484ded0a16df1c60fb9c71665ce6231f63485c08a2715

Download Submit
C:\Users\Admin\Downloads\Present\img\sample_2edb25c64a49e32a453801276c7d21c8.jpg

Filesize
461KB

MD5
9779772ce12148ac284079713444f670

SHA1
db9e18c43dc445467302cc9dbc5f1009a621aed4

SHA256
2a96bdaf14c74e143c9da0b386a07b78b8dfff267e85519ff4719ac8a8553a5b

SHA512
4ad974041a608c496c7e565fda39291c561ce99c58c7d9eec838fbc70f76aee329f4a0db6835ccc08e02f9e3d4b0d9f47ed9688bf4ae08f93460c099d8846546

Download Submit
C:\Users\Admin\Downloads\Present\img\sample_3389396295b0fed6ad3f91e28dd9fd58.jpg

Filesize
178KB

MD5
cdabd41a7aabdbfc3f973a62e6ecd5c2

SHA1
f199442e81ed605ce723033161db9325709f06ea

SHA256
0bd98f17ea27cadcabb51f4b1a4e7202ebbeba08849a2b28ea00824cab34c4f6

SHA512
79f3194786732371621c70f9c87922af0e58f7182933dbf4066388cfa1aabf71589f3b9bb900fac7660cc7df88585699cb14f616ff29420683b28b587f53f92d

Download Submit
C:\Users\Admin\Downloads\Present\img\sample_3e601412aa3a641353e78b46c499d186.jpg

Filesize
1.0MB

MD5
b36dd501a8fe296c7d0ea57885d7ba15

SHA1
dded72195ac9625a96fc8b028a8890dff32b6013

SHA256
a526cb83118a2e45927d0b1b071f5f19c4f70408676a01bba1e2043ab033a4ff

SHA512
f8d0a88dedb1e3093dc8f26eab779d5c306e11afa5e8be71fb6ec6d84e3b187965e8cdcf016cc5d96437bed7a359905e0b3d950ccdbd4216c0f60ffb33d418cd

Download Submit
C:\Users\Admin\Downloads\Present\img\sample_53f4b10d765a8f9739fed73b64cd7226.jpg

Filesize
896KB

MD5
48e039dc7025e604229b01706cb6cd96

SHA1
b203aefaae534dad2396b087f57374d499565372

SHA256
ea81c322290bec3654b10befddfbe6b2b6e7913c070893e7535e948d7748775e

SHA512
78b4f93bebd9cba3433781fab320463e8bcef3e6d8a390c56a3fc3baf1ef84aaefbdb1099de33930f4cd2cecf9984e2f51793d1e49a2fe883a16c82a87b419cb

Download Submit
C:\Users\Admin\Downloads\Present\img\sample_551ec7d30b6b37aceb35a2849776e286.jpg

Filesize
433KB

MD5
5e47a0bdd284ad7ed64c315c366a24f9

SHA1
01d6d27e40cd89dd6714ae45fc852da8800ac384

SHA256
e5d25182772695e57a2b456eec9253dbe6b14d5a65c750e87ae26c92e0160115

SHA512
28c0aff8462047fa71d1f572a623de90d17604ba256bf7d5a3f93c8bd31527a2802c581120e13fae39deca2fdeda10c5fcf12c2656cb1b0870171614e4bd1fb3

Download Submit
C:\Users\Admin\Downloads\Present\img\sample_57153856c9fd3b633aaed295e12709f3.jpg

Filesize
289KB

MD5
ecb14c12c470faa5c12284f7cfc2d41c

SHA1
f4015636d9f349bb7317354474b74cb8389c5c52

SHA256
572306bf4f42585fe6697b8eef375480e95037f81785ac88e6539e9a18269fb1

SHA512
749f95a029ba81839b0bcfa272916e9c126c7d13b50d11354b2ab6be5c6b021465f77bd4e8e3a7acb654c3dae0f7f791b8c5614905d6828495a6ac30079e0e90

Download Submit
C:\Users\Admin\Downloads\Present\img\sample_5b7ef39c766fff624bbea11a05c11a41.jpg

Filesize
239KB

MD5
cc8aa2bcf05865c9a860d23f5c59c0d0

SHA1
d8fedf577796f190bfadd512dec9e1cbe503e3ef

SHA256
8b559aa44ba329bc2112c26cf36b2d168affbab16af631349d220699b68907dc

SHA512
00dfe1508784de478da5507f1b25c4785704c34e069803669fd22a12a9403892c62cb39047bad5788475f3a8945fb5f1d33c07928f6436b331651ecac4e76bb2

Download Submit
C:\Users\Admin\Downloads\Present\img\sample_5e67ddbbe476f23c698460f21d81ee6e.jpg

Filesize
164KB

MD5
4560fb41c28b95809af97d47a1ef769a

SHA1
05838df8cee78de8303adb016db9ada8b7033ba8

SHA256
4991cfa505ebc22ddd09bc2a16c4ef5394457247e6ff4f65ee760fa3f40f3696

SHA512
ba4521cbbede25d4cb9e16af1fc2f884c5e40137b3c11364dba0b69d8e8f0b46eeb2eff94ec411d58a2d9554bdff05921afe6925cd71e063a58336ddcbfec2e6

Download Submit
C:\Users\Admin\Downloads\Present\img\sample_60b729e3112ab68f9b1dc7d656df7a20.jpg

Filesize
584KB

MD5
947dc0b91169ac88c2171a6900d07382

SHA1
c69ad86821c7c4f1583081e2d2c66c79a21a3d8c

SHA256
8d51a4e476afae99945ce1eb23f9132000a7264872f3555baf766aed6670a964

SHA512
26ed3c9d34891516de5ba68627985a882833f17ffa1a49c8b38d9556aa44deadcb1ac7450f9a3d72cf817261e8af3a183658568e7b8c93ed839b4e9bde984184

Download Submit
C:\Users\Admin\Downloads\Present\img\sample_611d7de59705afddf55560ae478ef195.jpg

Filesize
267KB

MD5
f4ac935cdc60580f6602adb8a7ce5de4

SHA1
3b71745be9ccd985c38c7b0a325fc054482cc4fe

SHA256
d6fe234fea0d99a1a2c51669342f68b23dbcfbc5ef76acfb1b01c92c48a8fd6a

SHA512
73e71aecfe8562174bd5682998352ddcc36d8f986921d26cd19720dd160c12612708c72b45c3cda46af7a87745d2fe92744afa1424584450d54dcd70c86080d4

Download Submit
C:\Users\Admin\Downloads\Present\img\sample_648ced7882f2678f7538e79a73f5a18e.jpg

Filesize
1.0MB

MD5
1586518df8c9def8de9cf7cb2bb8191b

SHA1
891cd02f983653a06ad9f82703afadd0735499f0

SHA256
55ce13cd71dc422e6eee7ac54eaa69bd26e75df3daaf0447dd5a338a9f9e246e

SHA512
b26b190c12ac140f2030561fefe95e452f312a9215b29bedd1b028fe9cc41a83fba3c93ef062d857350dbde923c88d2561a0483424f466cad85549a79dc4f2a8

Download Submit
C:\Users\Admin\Downloads\Present\img\sample_69b0e25d415d2750b1efca04cdfcaf55.jpg

Filesize
1.6MB

MD5
c87eeac4dda2642f0d775e1a286e74e0

SHA1
a64d56629cd9900094540ad51cddea6096c80bcf

SHA256
691f139fe522ef7f76c239c2b3df7810056f3a2d280ed3e9d0d8af39c3e49f24

SHA512
8d3482f1127575a1fd7fd0efa66de01808982cf611272a1c8320ff8fe1405e9baa6cf58eb9bc487481a6ed61aa60cba83fb98aafeaa7ec1db6762856d8030296

Download Submit
C:\Users\Admin\Downloads\Present\img\sample_6c74a23c4338c328d1bed083587bb9fa.jpg

Filesize
156KB

MD5
3bb9a794aa735f8c45e545f4bcecc776

SHA1
2f5de87aed937c7da81bb1e96050b1ddcfe86af1

SHA256
d0f646215246d2f971bf622fc3394993d34b81edb53398ebc4f6a8c3b3af4855

SHA512
09e644cf75efb030f07d42a03bbc68bdbb0a6d279ef7d5743973738fa224367ea5d8975407c8da2b85d260ea3b429939db5e4e331a16080255a2b0a7bac9e027

Download Submit
C:\Users\Admin\Downloads\Present\img\sample_6fa2d531a92f4c23eaae4f7bc750d030.jpg

Filesize
190KB

MD5
d127204595fcf79c0375aaae45f8f6ec

SHA1
5abf92d15d48be53847c153bfad5944e77b8ceb2

SHA256
1f28e3d49ce263b835c8b4b93a58b900b0cba6aed6e5112a58c0f7d6d75dafc1

SHA512
4f52598e35d98f99121b4dc37e5cd84a285d21cba0eaa49bfcd4d8ccf0864ac5fd8e43e81f30df632348402272eaf02ad678793b2c026dea817db4d4709c18dd

Download Submit
C:\Users\Admin\Downloads\Present\img\sample_78a63d42feed5f6447ebd687e5d66b4b.jpg

Filesize
109KB

MD5
1f0313103af3b295e25288ebcc712ba4

SHA1
0ff1d717bf3d6145fa1feb3b48311e69bd27a40e

SHA256
47f5cf38a32f03e280e7d97cb0799745294ff72f5d951996b2982260a71b25ef

SHA512
d901ff3b7f6ee493f5d04ba7d3348df3167d9344164ec632122657b7957c5a4e909835ff4d261884d1e5e5f0211c14afe58fa9a28c18eeaf78b3c0bc8b528363

Download Submit
C:\Users\Admin\Downloads\Present\img\sample_7c8d510dc84474b393d674d4ae652086.jpg

Filesize
780KB

MD5
4db33a8033931dc3c9f7f60c28b2ae44

SHA1
7e35012aad14726f0be26c3fcb2b5fa139a7927f

SHA256
04b580f3eba47a9622fa48d951b778f3e055deda8e12eaeabbb340065da95847

SHA512
e62bafcb16f92474a1d4ce399a4c737f2d7d825aa71449b5f039b2bb9a2e5e5cba8ce39d48b0cd9faa7bb3525f62a5085ee7a18403f43527f76d3ebc2a2b17f9

Download Submit
C:\Users\Admin\Downloads\Present\img\sample_803fba333bbf32ecf86ad52fe37dc06d.jpg

Filesize
413KB

MD5
3f8c14635c9fd6427401a3fc1763396b

SHA1
2736567f8c68747a9352e3d728b966191cf1aec5

SHA256
fea1d4ec6e678fdc317cedf3ccb572606b76f21b1657664bf424a675aa90087c

SHA512
a4cdfec9cfb63c9c1eba1c87bf91013aa871205e65c17e320eb3f2d9b962e53249a10283bacb4e37b9be5abf8f4387a593f35e41d99fea6f65f0fb35b68e98cb

Download Submit
C:\Users\Admin\Downloads\Present\img\sample_87a11f1da6330cfe11240e7829ea2899.jpg

Filesize
123KB

MD5
0bdc596ea705ffda3320ae8da2bf88e2

SHA1
1907f64ee4028b479a763c639431a6ed1d6008ed

SHA256
9fb2f37a7319818489fd36cacbaff454c77644aa8a60c3b336e8368be7b7a949

SHA512
70c5bbbc13a370ef493427fd2b090ca218b45fcd8a1fd1a99d0c23dd01efdea05d65674493080e521bdf1add61d31425922500cfe4ccd170d4d5e1d9f9e8ddf0

Download Submit
C:\Users\Admin\Downloads\Present\img\sample_9a86961ab122ee6c1e59f8b2a5ddbbb6.jpg

Filesize
246KB

MD5
66f1635bd76709ed711ad48173e8d132

SHA1
43f87cdd3252e413069f90d8f17f0415d511e840

SHA256
9f36b1e5981d3aba390d997828a31e28de346e148a5725f9b95c78c8b3e9dc47

SHA512
81b68e69b70556304a09df9104f5529da71c1f78667aa9314ac1976c9b38800df2e05f1b6ee805f89f900dcd979bb265ff64c9fcd2e44b1fc9b951ef124ed4fc

Download Submit
C:\Users\Admin\Downloads\Present\img\sample_9ced089b3e6ee654f966c5cbe780ac72.jpg

Filesize
84KB

MD5
b107052d425eb26f8810005ff12c3ee0

SHA1
f7f2a218df27bb5870167571837fa236e3fc5f30

SHA256
e64fe977205bfd01f0c0099a6f422ff2c758a3851efd7ff26e2cf10d7ab756b8

SHA512
be7e089b233b49a054bd73167a863ff84f21ac9afaad7e2adaf80635817eafa53293e34bcce0578889ef277976748e3a95959f931507cec33d23ee5cb5f49f3e

Download Submit
C:\Users\Admin\Downloads\Present\img\sample_a2da62312145b2566d9ae625a3189505.jpg

Filesize
651KB

MD5
1df401f6243e4cd0316cdc9f845822a1

SHA1
116e61698b1ef357e17f738b34fe7f0658da0e94

SHA256
1b50220c66875aabd163b7446f500dc38ae7f8ff4e127ada6e93c6300f9179ce

SHA512
35675b4b751ebfd25c3fcdecc8f3e550c0af6be17dcdcabafcbb14dc2ed3d047eba59dea95a623ee28ecc0d7c69625fe5c795b547412dd4958ebb249228d87f9

Download Submit
C:\Users\Admin\Downloads\Present\img\sample_ab00e724c784f3be693bdd17a586165c.jpg

Filesize
439KB

MD5
5c941f220cca31d99476bf9ffcf356a6

SHA1
faec6d659ecb6a3b8462aa6b625d789890ff90ac

SHA256
ae96055e371c1431f782dc35c7d71a9a7d47c636b3626e2335710052c1427202

SHA512
e54f44a32fd507e587bdc1b9698c41cef7993650001005de517a2d800b35b5627967b9dc2e9f4ca2b9a548005be5de68cc628e898b86474d7be612ca81b37918

Download Submit
C:\Users\Admin\Downloads\Present\img\sample_ab407014bd52ca6886e66fbe632c2a25.jpg

Filesize
113KB

MD5
6aef3f625d4942fe2c7a25164423f0f8

SHA1
5251b9fcd16594ebbc30df80be1fbcdfe5ef948f

SHA256
2fbc7f4d7e05c7538ca04741458f206e792c74acc3016e5fac355f3a0fae9d34

SHA512
70d6a1c1aa03aa58c09a56c09d0e908d84e5131e3891b690ee539224c76548cb723e24d41f3c09b63949227115071b42bf83ed2079511a87545420b92b82a09a

Download Submit
C:\Users\Admin\Downloads\Present\img\sample_ac507e59993f372986f760c2dda8c7de.jpg

Filesize
254KB

MD5
092f59739456f7480b6c94592c477518

SHA1
c34e98dd9695f19c94bfafc0093eac943a698325

SHA256
f5734e809bac4a5d03ac0057854c2e94860b6a7695e77c7ecea24a4957f858ac

SHA512
52f8ffb3777c5f3e1fc59a56f622aa688500a9b7dadebea42bd0b215ab32b4d626e2efdf5bac87d69e9227eb6fbc12091f5512700e0dc9f2257fe542960c6488

Download Submit
C:\Users\Admin\Downloads\Present\img\sample_ae202d4c72499cd2c870df2265f596ab.jpg

Filesize
361KB

MD5
f5eb7d781cc4816632150cb567ee9d66

SHA1
cb44d60e99bbb9c22b3a445599e3dcd69034bc33

SHA256
5fbd088134ec990e5c7e143147e90ecd56f318aa8404ea58d50b9b08d7f3b007

SHA512
ca7c35d48841625002ac8db5d67229a0f6663c260ac86d3ab6d2e0bf1c881baf159a7431fad3f8d4cb1a75a25cad577291111e4cb6d4e5f35106e22e1906224c

Download Submit
C:\Users\Admin\Downloads\Present\img\sample_aecbab5d7420c23a218b6724ebae3276.jpg

Filesize
1.2MB

MD5
121dba285d36630db1cb90c11777c85f

SHA1
05990ca9d6e0e1002370fa37818f71f53e1576ab

SHA256
17f69cf328b066b71859d5e6a71043ab241a93d90efe8c32fa2eb0417679afd0

SHA512
ef9ab0bd3aaa6f40fbe89474231fd2ecdc5cdc6aae024cbe3eba1349d321561eecd0f7cb9054dfb26bf501eb695fa75e8d8be85d8261eabe77046c9d77cb4e23

Download Submit
C:\Users\Admin\Downloads\Present\img\sample_b05f03c815a6f7da4ec6319b15883812.jpg

Filesize
183KB

MD5
8e5789dbe2c3bd61f6044aa51447ef60

SHA1
80e4b705b9e7ed68701564c870cf3a745a49c717

SHA256
d87972ed4e904a2fd42de489544ae19bd66f345d9388bab8e42ad1c2bd417b35

SHA512
b1121d2d1c39bcb79be07ef7c16ce40556393fed3318a9fc61d80e36a957e0aee7e7a4c9f5c729b0e66ccf52a22514c77b6da58240735f7884859a7e5559bdea

Download Submit
C:\Users\Admin\Downloads\Present\img\sample_b27e3d8a2794f3d17db0fa33cc70d1d9.jpg

Filesize
148KB

MD5
af790bbc90f0a82874c8d1e3c4d4f21f

SHA1
924b54204a093fcdf0e26d2d7c66292a47590360

SHA256
f805ff68b4b3e42f5b28f0786f71d75188bb4180559cef54acf64343a97913eb

SHA512
97a44a7bd99f8c18adb2120f3880bd6c440b7acaf5c16bfc779b4b3842f365b26c6df4743b17fada9ecbda34b81ab93d4fc69d869cc0ebda8eab95f9325acd64

Download Submit
C:\Users\Admin\Downloads\Present\img\sample_b281ef901dcd027d83699fba82868be3.jpg

Filesize
82KB

MD5
ef2cd97d48866a1b289d7a9fee647af3

SHA1
7de9501b57b43b7c5fc35bd76772739b762c678e

SHA256
8de814c82989317fba7354fc3c6105e956647b28acf903d794fbff48fb442376

SHA512
dbaec63b6cbb8f4fd8e6fb823c3ff745bb78df672257eeb26f0caae69c41d300dfc0311d00985e4bbee7e595bb786433b326fbc5b0cff15ca527ba468f505b78

Download Submit
C:\Users\Admin\Downloads\Present\img\sample_b2c6806ca899c106fa3f1827ee94b426.jpg

Filesize
180KB

MD5
120ede64e820caddfaac453e8ba70264

SHA1
fb11fd2272eabf10ac7417744f7361eccaad9073

SHA256
d6da88d1906246eeb828bc0f8d391f894e7b772ff47d65dfaee8c40bc073fa44

SHA512
817d7e2b0d87e3134eb03a682c5d4e427653b41950c1c88ebec9fe2e24dbcb893f3cfe582b1d6b9ec98174e6305893e9e785efec5fe4e38a93bf0e9a682984d3

Download Submit
C:\Users\Admin\Downloads\Present\img\sample_b861616ef058cfc8ae2199cbc72e9771.jpg

Filesize
939KB

MD5
fd92588471164180c2d0d62a33b8b88c

SHA1
05dff2ecffa58b4b23501b1ffc478ce2c2a6c7a7

SHA256
a602933e1516608d2a235d20519491625298eb0e87b562b44c3e48ad8ab8dfb3

SHA512
fcade41f43b9688eb55a1be46cff3b3c3654aecb201ca087b0a15bb14450c6e524b50c8bc5679d0c2b83d54a0efcfc44113a8f045b0156eb54d0267d5aa5c7bd

Download Submit
C:\Users\Admin\Downloads\Present\img\sample_c02acc8fbd06363ca701df1c7103792f.jpg

Filesize
1.6MB

MD5
0b7fe90656811da94a96de0e4ea49ec3

SHA1
53134e12b00040dbb38923492aadf09fa2cc6d6b

SHA256
8ebaba069f09db129c70a4cb6feb1cffeb1182916950d53763d0b26275e76a1d

SHA512
90c024665510e5e972989ba986f7041aa96400b290edb573a47c904b83a7db32ec66b339dbe2565d500a66d5583432290a215c0e954d868d4e9b4af4b5dcde72

Download Submit
C:\Users\Admin\Downloads\Present\img\sample_c335ee961bcda0d2383a6ff6d60041d9.jpg

Filesize
177KB

MD5
d75ff32bc245857cf7a7da10c2e69c88

SHA1
00b2c00bed557f8dfd13390a74873bac7f0746d8

SHA256
33c1e3cc472c11a34b15ba81f3a7fec884b6582c939965d5f8d223c942f87e5d

SHA512
13bb478a6d670c46708b046e0e77b345b6bcf9dd21dc3cc19a49b2c981177b7fc3fb17668920931b3909a5ceae339f77fba9ae9f7bd0a36b988d4ee135d669c5

Download Submit
C:\Users\Admin\Downloads\Present\img\sample_c39f862b91b93d5ad97d746a5c6082b8.jpg

Filesize
167KB

MD5
d1ae7f5f948b9fbb6ec8a2d54d2762e9

SHA1
3b67682c4a26a59afdc07771bf0e89497837a6b7

SHA256
e2af48a2b78a1dc08795dc830d2b76288d547a74feb3bd6f2819f2a44f8b2ace

SHA512
feb98cfb343f486efbf74633e76623e29225391f67ce234942680f9f32ca318974650d79f8ef3e097ec723589ac507290a546b6a8a399c449fce825acb995046

Download Submit
C:\Users\Admin\Downloads\Present\img\sample_c7a966a42dd18ccd9218fd8d4c8cf1ed.jpg

Filesize
348KB

MD5
b5dd71d4ec76155931d024e52ea6d3d4

SHA1
b88f1475c1f04b522d3f4cbe19b2ecd2f9455b97

SHA256
ceba04445c84fa520749ff2bef0e1516e19a67f60d70d75be1a0098036658a5c

SHA512
2916b646b2f376410a728bb795b7e9335915bb45a57cfbe224ff7a22d8ffd1cf03f4041f7d9025bd95afab46fabe2ace29cb3d34232015e10564d305926ae2de

Download Submit
C:\Users\Admin\Downloads\Present\img\sample_c8b0cc3cb68a0f4458c01d8c89634560.jpg

Filesize
443KB

MD5
03396b27b252989e1edad58859d61c3d

SHA1
fbe36ea56c39f97701869fc7748a3df92adf9d17

SHA256
e3665d1ea99f35e7f477a418f87a246dd90c37623d18163059a5d081c1c23d1c

SHA512
6705216493a0cc8d998de81617d6ca849241a438f0dac6fbbd94fadbdead2c6cca2ecd327852504966725ee6c0df9277708d45952f9a2ccd46f9202f8e20e33d

Download Submit
C:\Users\Admin\Downloads\Present\img\sample_ca4632dfd050d7aa69e06dc60aa98bdf.jpg

Filesize
510KB

MD5
43e57d57bc75c9f1a1869b9898741d67

SHA1
0bf2da4cc960da1119c75c1156d8987ef0da7024

SHA256
0fe2c6ec9580fed4a3794a82a2fbc665088c5eabbe11f418a7f1fafb59b25ef8

SHA512
46b378b9d7962a286a0e1bfa53ce25d1754044d1387838e9cb8b3153c4677592f60f3d908ea6c8a16467d8349204edbe57f9b86df76c7d1b78bc78ef0dd97bf5

Download Submit
C:\Users\Admin\Downloads\Present\img\sample_cccc5226742ef6b43554b9869a8efdde.jpg

Filesize
287KB

MD5
95353d25184105890deb3d05d3abcd13

SHA1
fe887083643f06ee4b05e2efdda045b803362fd0

SHA256
d50c0e619238b90ac64f277cc9075da6b65785e119e04a8a281d910b19b9f2b2

SHA512
1143d60142788723671a1cda870a8ab8f20798c5628324c9e6f232bdbc3f0860c81e07aa399f357f755340fa60d54f9dfcd9dac6cf1abe0b94ba0b67afc78570

Download Submit
C:\Users\Admin\Downloads\Present\img\sample_d1bc2e247a91a8cb7f447a60d4af729e.jpg

Filesize
1.5MB

MD5
1462adc789990a225f7ce2a8630bdfbc

SHA1
4b836ca8ac8a090c7206e0a2b6ae70050b6966dd

SHA256
a22e6a14ec1669781e84845d822883197d1d54b07d5d1cc1e7f8307c72b6fc08

SHA512
24888e141c476035fec80b57a4256d94eeddf84c6284a1e6be5e7f8fcd68652c5cc0b023a1fd4b921c81d91c3cf27df4a2317ff189c535a0d4e24600b5090d7c

Download Submit
C:\Users\Admin\Downloads\Present\img\sample_d3f37e2c1718f908da6ced2443beef53.jpg

Filesize
172KB

MD5
9d3b1877198a55e7a63f552d1550c997

SHA1
c160d5d7f9c36a1b48d764cd862dc8fd2aec379a

SHA256
2b354890c9381ef197ef6c3afd6352e4643e572690c02e4f7ef251d905754ee3

SHA512
bb44ad1568b004bf2be8bc4492215215e2596b9eb24112dba9425fae4d934e629b3e0f88cbc094d7ecc86eb7c60cbad6fbce91a99a9be2d36d0e1631389ee08d

Download Submit
C:\Users\Admin\Downloads\Present\img\sample_d717e8f581db5035a4c6731865986dc3.jpg

Filesize
351KB

MD5
070b4d96700438c5448491606467f2a9

SHA1
23fa531b7d911d9d7a93d565a7fe7872ab5cfaba

SHA256
8b9bc38d06355e8faef69582bfe92adfaa5ec179c2ad65eeb5d9d78aa6f65671

SHA512
1792db2d9c33550af0733ef3c8540d13a6a33536b139e8be4425843324476855cf2f1c976d9c3255fcbe8d1a8ac5b3517bf90af161a55d6f92e5cdc26cbf3cdd

Download Submit
C:\Users\Admin\Downloads\Present\img\sample_e1a21d9c26be736794959e6d57afd766.jpg

Filesize
353KB

MD5
c0266b261607599deccffbacbecf34f6

SHA1
91b3a613c16f7a2cbbbdd499252a6d108fb03367

SHA256
9ac7739717ee1310977a545c7f389c76c9e160031ba98bf544fad745bcdedeb3

SHA512
398b3e8ccd48f5226d97cd816ae5f3ea08e2c82cb0293348125829b97e6a3293ee244d12900c1718d3cdd9b5e04a1c95d5499a94b689362f83162a101a3a2376

Download Submit
C:\Users\Admin\Downloads\Present\img\sample_e8fdf42898d195fc0de1bd1d93ce0551.jpg

Filesize
424KB

MD5
642a217b3e4127a40af9f4871d69f62b

SHA1
3966631b8a8956aa303758d0ca456d6abb1cdd59

SHA256
2154f3724707f78eb16aa365b9042dd6e0f6119884dd2acf6b13dd83b5eda2f4

SHA512
28628696543561b092d507124943e0671baa60e3e6f77206f70c2b2f5f6ede2d7427adb9cf5133944b57cda0eb194213401f305f834eabf2136668f2f3c5abdd

Download Submit
C:\Users\Admin\Downloads\Present\img\sample_e96dab0e84532223a4ecc7d121934241.jpg

Filesize
293KB

MD5
5be3d9eeff71f0b28b8b111a2a01a121

SHA1
78c6a6cce61cc0b6309b0941f94529f6a8025ca2

SHA256
858322c6dc5b0ddf1e9435e216098878dcd2b8a94d4a27cb74d3888a940a917e

SHA512
0512095243bea277cb57e3a41fe583644b879af0e41574e09204f26bddc855274ff0839e442938a34a106f48d02bdc32e84cb6906b54ca0044b81c7787fcda54

Download Submit
C:\Users\Admin\Downloads\Present\img\sample_f8287ad31a263959a36d2e13a0e12fa4.jpg

Filesize
243KB

MD5
796c61f09fd9e328adf7a48763cccda8

SHA1
24b2149f5f707195c7d68ec27fb6ed75e3c06cd1

SHA256
207bcd91111192c3be5a1c3a5c0d5aa0ed6dc7db4d209a3a156825635a160af0

SHA512
4aab88250959202bedb21b7e3fa6c3c6212df76bb24c67e2b0d25bfcd948b0e782c1c146a32c9806c5e1820e9fc422eb8c644bd250877519eea8d6ff4fa71165

Download Submit
C:\Users\Admin\Downloads\Present\img\sample_fe2f113f8fc67b18832470ac5079cc55.jpg

Filesize
627KB

MD5
8515ae63482ff79292ed6f48b68ae113

SHA1
ac6692501c2fd97463c8bbcdbbc0cdbbd409ef83

SHA256
5328f8f6c2467f71e7255dafbd7846532735944629457ec40592db8ef52ef71b

SHA512
0dd38e74be64d0578571ec34e6f19ee5c81e6596f50258bce7e43b48646e3ba2152dba6f6a2c1d46cadcab8a0f7127910bbaf7003e0be5b315506b276968c76c

Download Submit
C:\Users\Admin\Downloads\Present\img\sample_ffe475dcbcba1b3be9a8826dba6c7880.jpg

Filesize
392KB

MD5
0bfa27b7bdc74499d157265f2588385e

SHA1
c574f58ff582f1a87c195ebe1aa6812ef7e16793

SHA256
135c20b0d34977074b06e30771e4b2f2c885d44f62426484e3511420b42794e4

SHA512
3c9f5a3635a0c163db2ecc69b8448afac740d2b95f608e895b133ca0fde1a6bd37c1441487bf6d68005e13e0689d93fbf712107b762a406f94cae4e765cd94c9

Download Submit
C:\Users\Admin\Downloads\Present\settings.ini

Filesize
347B

MD5
61900cefc92dce8c60c9e8703b79c99d

SHA1
17d1d2def5c17bfe0cf59f27246f49e4b3612786

SHA256
2acebdc3bba1673412fce59e21d6e91f736c484ab90330cea1c88bd64c5bb4f4

SHA512
f2442aa11cad622965c05e75052bbef8bdbe9e06afe904f4b36c4134b3570faea9d857863dd405968e88857319dba50b96841361d260151e4861ae342144aa05

Download Submit