Analysis
-
max time kernel
111s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19/01/2025, 12:12
Static task
static1
Behavioral task
behavioral1
Sample
69762c19cdebb7eb22216917ecfde58141a9accdcf95f5a598d30b8a1225a549.exe
Resource
win7-20240903-en
General
-
Target
69762c19cdebb7eb22216917ecfde58141a9accdcf95f5a598d30b8a1225a549.exe
-
Size
858KB
-
MD5
af1ca52a09c51d7941b3f3a7a92672e9
-
SHA1
a228ba86a3cc979c271285a8767cd2ce947c936b
-
SHA256
69762c19cdebb7eb22216917ecfde58141a9accdcf95f5a598d30b8a1225a549
-
SHA512
423c3f5f7bb7caeb7501d56d30eb43638474d34322102bb55c0b6c381a5c1500aa2c01114abe8cefde895725eec60280ab76fae438b445969fc7fc9a1b1fb989
-
SSDEEP
12288:mWvMMP4oXJRfDtCxOvU7Gt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPD:IpoXTBCRqt/sBlDqgZQd6XKtiMJYiPUB
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 1712 alg.exe 4228 DiagnosticsHub.StandardCollector.Service.exe 5040 fxssvc.exe 2292 elevation_service.exe 4056 elevation_service.exe 1000 maintenanceservice.exe 1716 OSE.EXE -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 11 IoCs
description ioc Process File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 69762c19cdebb7eb22216917ecfde58141a9accdcf95f5a598d30b8a1225a549.exe File opened for modification C:\Windows\system32\AppVClient.exe 69762c19cdebb7eb22216917ecfde58141a9accdcf95f5a598d30b8a1225a549.exe File opened for modification C:\Windows\system32\dllhost.exe 69762c19cdebb7eb22216917ecfde58141a9accdcf95f5a598d30b8a1225a549.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 69762c19cdebb7eb22216917ecfde58141a9accdcf95f5a598d30b8a1225a549.exe File opened for modification C:\Windows\system32\fxssvc.exe 69762c19cdebb7eb22216917ecfde58141a9accdcf95f5a598d30b8a1225a549.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\c74b5c3adb05c3ba.bin alg.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\123.0.6312.123\chrome_installer.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files\7-Zip\7z.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files\7-Zip\7zG.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe alg.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4228 DiagnosticsHub.StandardCollector.Service.exe 4228 DiagnosticsHub.StandardCollector.Service.exe 4228 DiagnosticsHub.StandardCollector.Service.exe 4228 DiagnosticsHub.StandardCollector.Service.exe 4228 DiagnosticsHub.StandardCollector.Service.exe 4228 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 652 Process not Found 652 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 872 69762c19cdebb7eb22216917ecfde58141a9accdcf95f5a598d30b8a1225a549.exe Token: SeAuditPrivilege 5040 fxssvc.exe Token: SeDebugPrivilege 1712 alg.exe Token: SeDebugPrivilege 1712 alg.exe Token: SeDebugPrivilege 1712 alg.exe Token: SeDebugPrivilege 4228 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\69762c19cdebb7eb22216917ecfde58141a9accdcf95f5a598d30b8a1225a549.exe"C:\Users\Admin\AppData\Local\Temp\69762c19cdebb7eb22216917ecfde58141a9accdcf95f5a598d30b8a1225a549.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:872
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1712
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4228
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:3196
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5040
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2292
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4056
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:1000
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:1716
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD525ff2c98d9ec12438ab51d6a0e6f69e6
SHA197c3efc9f11e7df4376e8ea06434852c3f3f66ad
SHA256bd80b0b6ae97d357a9965742d140bd38e503b6dbda68a9687e7b997544b24018
SHA512c577d928b3d30ffdbb28fba18412595fae728cd350bc363d1881c7357a425c8e08ea5146127ee3aea3c05bd342eead3599cf7dd931765857b768a31725834ffe
-
Filesize
789KB
MD5bdc4e2336c3126b6cbb6730dc062bbd4
SHA16256d67ce445b72cc5d7cb2d955996d8a8e05f9b
SHA256cbb255809787236cf2921d655cb84bcc3a21ad6cb61be4c2a60a4126c20742b7
SHA512e66165deda1ee2493d33771ffc202efd58289184bcfe280aaeef5ba6b1b588bda479fd0ad97f1b9e0d74b13d4523fc1079acea90b2b04413dfe151b1e6ea8548
-
Filesize
1.1MB
MD5c6cce2a18527bf48aaecfe45ece5c8b6
SHA134dffe2ed3116c2ff5e8cf56b2997293f4ea7a2f
SHA256d2d75c7755e6b3a0353205f09e10559118cd0bf3d26316118a5bb25e0f34d603
SHA51281c3558fc9b71da56de4fbaccf9758472c43cf6be77f8cdc008dbfa9c187fa36e61cd1d41d29dbc0a443557e3f33c3678621745362a4aa6b32e9cc5fbc8b4a3a
-
Filesize
1.5MB
MD529d5119d6206c9e3592df67b3f38fbeb
SHA17b1e902bd98c8d98a11f966f2926291684734689
SHA256d2db94ce392c486717635dbd26842ad1fa78c9f1f41f281784469b12abcc5043
SHA512febb4f926f3ab86c855b4b83ad49e21e99c9d477deb4c30edd00adb969ba8162368e3f370d6ec34f0c5f025395ed1a11f0f9c5a4009a6d8530985870c9bb312c
-
Filesize
1.2MB
MD568af0ed53558d94a58fc32067169d579
SHA12181dac10e907a7d30f9dfb293831558fc4cdecc
SHA256be0210849bb99758c87f4b6ac289a95c90c13288dd6ef8169c50a1df018308ed
SHA5128ac57f8c79c615b6d541571bfe895209a72aef49f02a8efd4274898c97acbe171bbcb56683211d1a11421ec0834816e16d1d36558461eb64aa625fd59cda3460
-
Filesize
582KB
MD5860fb2d93e2b1f58184bfa5d509a050b
SHA14e2ee941b21ba94035c97fa6e76a6ab8b97ffd23
SHA2564edc6b65d3810691f8c06fed3da57f4209690e38e4ff0075c3093dbc8d390948
SHA5122f56d2bab90aef1aea1a56c980714d68b44219599d009762709e741a2db58de1af8be798cb10c50874e8aa0518a20df107e2a4f846ed3fb95e3ec7d5e1ee2d0e
-
Filesize
840KB
MD51b68d75d37ac2977cb70b5887039895b
SHA17fbc35896202665d5fee8df3db53a4d775dc32b1
SHA256d3b58a364c41e1fb39fcabb9f81f9cd3aeb04ee5dfe281300220a6ea0c72153a
SHA51289119b0fa839a4860cb4214e757c040a73994f2d840dd0ba90fa54c9570ea5b3fd427402f93750c21c0bdb44005ce1a3b02fb59a05f456ccf3164e39d992031a
-
Filesize
4.6MB
MD537de1dd7923fee52ecbf888a79280ab4
SHA126f2442ad1859b465320df80aa57f25cc61f0082
SHA25626033251ae7b9fedb31a0a221d1fbe9356cb7d70c09b722dc0e644360ea7bbe3
SHA51236827306d3c594e6a9e671aa5d2c1afa29f8f6d75d84894689a24e71e810e245fbac3755bd158b4d9a9272c05ca0558565bef6a17eca2ad13fa5f6996d111ce9
-
Filesize
910KB
MD526b655fc27bcc592c5f21fd8bbb197e0
SHA1bb0c35c5e7499efe56a073a67b30f0c691a1427b
SHA256c617e4689928394cf5785eda5687e55d6647732b57205b03b4a5f43780ab4689
SHA5124cd28461a340fdbd88140cfeaad838c737810af91dd25c44b18d82a506ccdd46a67959d8fd62605092d0a737abd1cb6622059651305b5d9337a8d6c6865d4ec3
-
Filesize
24.0MB
MD5ded7c808e48e0c36a7136a13b6b9bb87
SHA10e3424e21572977b219d850e845a8e3ac6884f75
SHA25611cbc07e9752d5c180294ff2659fe908a7280aac92af1a0828885f020b0ae2dc
SHA512ddd83b9de9fbc59c299289f50a681657537e6e16fe11ede777af7a4a2c3ed5cf2ce2ac2715bb1ebf51306297d6a01fd6103f2bb8340912ea0d0de69eae511395
-
Filesize
2.7MB
MD5a752a1c6ee0d1e2a1d61f25efef9a838
SHA1d006f03f91ae4f1cf4c471b5c4bf94fe814e8b1a
SHA2563e1d5d125f807a36a23ec7f44d98d049676dfb03f0a8c5a65a9cec4910942ccc
SHA512c1e5d747f67aad22c91bfc84f442ea45fb1c0f7f2f58af1003f0bef6bcd220522c51e9e58a03fd246379c7c68d6fda99c75f419129a052e09acf8de8fd48bf1f
-
Filesize
1.1MB
MD5f007055721a6ebbc36b521e92b7d95aa
SHA115b471b82aa4684d4a3520c1880fe936dd2fb240
SHA256739ab6db5fe1100aec2ab5da4fc6f7dfca6084912c84478883cc5615c206037b
SHA512949d711f23835e1ac8d95fde031b0cf6009b540e691d2ab9c5b015b641c4211de9920fb1c0404707aec8ecfa4a56d4a148bee7859f59506dfe72df3aee209774
-
Filesize
805KB
MD5a3257659da82de8837f1bf3d74053ef6
SHA136682ade267173d7d454e29cf4bf3c1bfb976633
SHA2568ca005901d82f9b8e22581c7c9c7d3b3847b24162c8c600f33aaf1e6f80121c9
SHA5120ad6f40a70a241f643a57f8d095dab5e5d2489c0daf8be8cb2bbbc1ef587ae9c63c94b68508797994de8ea2e206d936515845234a408abcf9a7e74d9ca747841
-
Filesize
656KB
MD56de175991bd65324748f496db80c331d
SHA182ca74ec78870d77eaf8564f7e406a6d7acac426
SHA256d60e444cbcfbbc6d99fbed4cd551dfe5b0047fe18d568090e71e85d72c29cb70
SHA51236a55ddc05524e782a03c64a4bfb3a9ebd3d2a6f040122d167e2bb0033936ee36756f7c6e08fb4ea0c32139efcd4c15b81b9f0d6544088ecb4a48b8702c6c1a0
-
Filesize
4.6MB
MD5692c931d44e9111d002fb8a33625832c
SHA119fdd8e1dc7a0517805824be41b07ae584dd1b3c
SHA256733f8cd02bcc45f6bdd9e9948add163b7723cc0ca227416533160ec2ca838d75
SHA5123455c88f90c9d272e77d63654e7decbaa6f061b34b47997b9d84d12d6c84c6fdd23afa6fdf20b8f826328232f6374eab9897caffb51c48eb4d825555b58c196e
-
Filesize
4.6MB
MD556f2ba9091b87462086127d54e85c672
SHA1906b6032e3d5a00a04116ba5c0556d86f87d195d
SHA2560f861098b18da860e5e909844549fa372f83d5c02dc28cec004ee2d2ecf2724f
SHA512cafefaf5bdcca3d65671158716a81755b3e070c3d7821724d75cf378f6305825b11ae3627fb134923bca18cfb0fc952ec037d1b4ee5df7e8111816e4b48cd2fb
-
Filesize
1.9MB
MD54e7e7f0c5a99292aef4f994456f05fd1
SHA107bbb1feb135138544b1cbc76a34a142ff4d97d0
SHA2567a7a7b1168f478bdbec6aa76ce40786f5de95015dd5744bb322053318ea5cfc2
SHA512f77e80c5f31b4ebcd19b524d0ace83a94b9424ea75205540bd64f9e8c09581c1a87ae4234dab1df8f402cb7be41de704f1fd88b83d3bbc288b23739fcd8a748a
-
Filesize
2.1MB
MD5eac387fb16dc1bdf5202d649fa95761c
SHA13acc711320f4202cf22e09c5c39ff11122f3091d
SHA256c2c54658dfa890e839465ba21ebf82e3132a5dea6bd592e70b7f3971bd5047c4
SHA512d8fe06a30cf8911120f7bf86844c7b2945a3602ee115f369d263b3f4d780577191ae7978912e7ab1d3a5e20e7edc15640c00046b8af8dcf478f107d2633a6f3b
-
Filesize
1.8MB
MD513e74fcf996ec02cb797a220ccdff844
SHA170e895ae3dc056556d43748092505512d9eaec9d
SHA2567347a705fb9b8fce0aca5d127bbd38edf454159b24e14afa3eb62bdce4872cdf
SHA512ff328601760da57eb1f08f0ce1f24a9714a7cc5f89b303f727fe32878b40022d7d01937609a69ba544ce0d374861d9b784db9af30c23c1d3a2aa9f2881a69adf
-
Filesize
1.6MB
MD574b586a7a8d16782f31940d7545d578a
SHA1dba81dc13c7158515201ec99cecf31a06aa8993a
SHA2561cb3b2dfdbd8ff7a30548dcac924c0790a687c5625f7a30d9d1021479cae9f17
SHA51263ac0d96e87290c41f55615f58bd96e42574c5a21108769ea412f2bf8ebd1640ac25816b080c1890fb20c23f4cc88f7ec57db53a069eabb89764d6e9f609c696
-
Filesize
581KB
MD5e1ba33e85a7115308d53e8d95a7c2940
SHA1dc4c40221b1c9a00ea79c6382f6e2c2de1906118
SHA256b3895d8061e255232a7c61aad6f4918fb7acfd5c185a7c31e8da6c32345b5959
SHA5127db49889dc7b41fdca4effb7c65b7cfc05b7b9434e1bac3aa602404859844aa68024102ec5667c6e8a8ef7a67525bf934514a1698b85a374ed0ae4fe3170de48
-
Filesize
581KB
MD54b4e2204d5bbf994765e947cf0d1d215
SHA136a8e7a40780b1e5b8a1f9780a43ebaa777fb7cf
SHA256bafea919a45b494fe7afb4bd3003e7ed2439d8a98822654f4fece706b76a9002
SHA512b77400dc75071704aae65f9ef835e75bedce16d14a972c0b23828e7d3fdc96de631938e876702c0e3abd11c0822f10c214af1516852fd570aeef6eeaa3138691
-
Filesize
581KB
MD542484b438e9b2daa0723123f408d3a3a
SHA10e984470436cc4fa6f0cd6360ee8109a515c699c
SHA2560f19d0f83b92e296f55cd07d4ab74b529aeef6a097b43d1f6d7a3625589a05d1
SHA51270a130f3f5e05777412bac403e1c7eb5d0327231c5ca6f3e80b4c5ca4b16e640a6aeeb84d94f32f435b4c448240366803904cecd27fefc4e9839ce60030da46e
-
Filesize
601KB
MD5b1d5b9b28b7c31305a056df7cf536558
SHA1f4e9439ce1d0ad3e7c23d81306d1461a2fd04b16
SHA256cea09e2d530ad1ecdb751bc99754d002d9e58ceb2a3ac5aea1c16c9980f4e445
SHA5126d7f6e78c7690ce39efa970f606d697c64fc16dbefb8b6749ee05ac6318b224bdc896fd95ee73e89bff9fcab343fc41fa90e1cd762aabad83fde286b40146f7b
-
Filesize
581KB
MD5a82b682dd87cf614df81d3311f1df299
SHA17699e3dc7f46d1b9e73ee3845b0c77d8451e5176
SHA2567f80aa6e60b3cf654f8ff1ca8e8a4fb91633a6bb514f7cfa38cce72387649eec
SHA5126cadbc39bfed306819cbe163244696f647050cbc4a79f695f9cbb9baa3bb4ef9903ec76d53abc90665007fe050ee7d2ae80f36d14f8ebd345523b2f697d62968
-
Filesize
581KB
MD517269a07856d36004c559bbd39f0c410
SHA13945de851b757136920224ea1589c0d9e1ae3e4f
SHA25661e2d705d8c83003e9c6753c0f6cf973131aadabf0f6e740d4e23f5fe1a8a661
SHA512f5fee59bcacf22f7db5fef74e9f18e0fd79087ab7c8132c56f4707ed4f32f331ce911fb20eb50d109b8bd1604446c534672b01826560b1855240ad5c7373868f
-
Filesize
581KB
MD59e5e7c4534661d7efaee2794f444a14d
SHA184c45ea6cb96077d85a1d58186bb26b2b9c464d2
SHA25656e81aecd324eda7f529155d84c6a60863d1504681e157227744fe12aa39f7d2
SHA512bc26a766e74df0af683a0690cfed6358d1c337624d8f94e370f3ed4c3ef6a92a1259628e9dfd857bf9f580cd317a3eed481bd4e6a88fb38ad97b4dd6827f9a71
-
Filesize
841KB
MD535e421d1ec6f47bd09da13f9695a79d4
SHA119e4d5e5b46cee2d488a6dd5a9cf85d153f0ee52
SHA25689b38741962612808cb404ec8b20b1ce162f06ebf1f2b0636268a8d322f87a7a
SHA51269dc4b1f9b4dd6c2ba3cf8df7aacb8fb07374c6cdfde793d68fa7d0b5e1de98e9c4d0f62d2030c72e23be8212918107d9f35bb8902d139b44962572f5f1727f1
-
Filesize
581KB
MD5dff8e5340552c91e63a71e8ca0e4be10
SHA194833b30a62581f67d51882010cfd510deb18ae2
SHA2565633db1f21a8987ad47e603345e9872543805ae3c77f3aba439d63791d372169
SHA5129d5a258cba0c2dd70d9e36fcf1dd14081773a3db8340f7d1ae9f217d4bb663ba397e57f6a90761216098131cce98b3cf5f9a8c19a8921e750a3cf0afb5e55d2d
-
Filesize
581KB
MD59059db08beb658c65dc6e4f914185702
SHA1b6fc0ba379af5d656c735218756dcfbcfdac9bab
SHA256e402e2f4c2c6bc91c98199a05f950aa782243575305bfd422ac1f86a6088a1c5
SHA512ffbec6e6eddea2a52d790265b30458308dcb6dd73f7a96354c6471ced24919dd2db64712a998663929a0ff550e97f53a03d1d650b77d177568d952b17551b699
-
Filesize
717KB
MD5791ecd876ff7672294316bafb2b4a056
SHA11529cf2e00ebe49d343d26638f6848226b4d4bb6
SHA256a59c33ad758fa6979f2d3b6ad09b013e0681e1ed188ecc1a00104c3883d6dc89
SHA5122a585543c61a30b51c60e80293300b084a3bfdcbcad4a74d43e9869b2cf6785032d9270792378e05fd135b2aa3ab228039748a7539875f11a82e866336e134ce
-
Filesize
581KB
MD556d1810b5b8bc736dc7c7844c184dd2f
SHA1e2202745cffbc02291f9f5284895e7c0d5600b37
SHA2563f58774875fbd993050c63cf89b684f095b4a38d0a2b9b6cc101668025304cb0
SHA5123b4f63300226c15422f7ca5da074cfc86c2443e7ec128b7802df7eef5c3251845f62467d74caa7ede344e61038a2f13f5e1c533a0adee6c92d51745f24be160f
-
Filesize
581KB
MD57f6c1bf3aa87d58000cc0e0ff1a2d014
SHA19d4b3881b9a5b71b3879b52e463a7fcfa37f2c56
SHA256bf47653cd68e905ca3dc325d16c3d22c2cae8c9c783c8cc88a0bea10ea370235
SHA512ced041efb3efdcb4d399e530a5ec7ca949d0ed0ccdbed36c270811676874249bcaaf5ffd33f3ac77bb6790461f996b253349bbdfe9371180416dc0c3b67bd3c7
-
Filesize
717KB
MD5b50571c56bd9322b3b5ee4c9b4b99087
SHA1c8f8e7f84ffc16ebdf6e29181cc121ff8a34ecca
SHA256ea6f0d1f9bb2bbcbd5b37dc086020e9918933304ea5fec3605b0c0b3fc029cfb
SHA512b79eb0b71cd488d947d3cc94910f52c0baa3be1e2160d136fb7b175d0d7e945004ab4b6f0142e561d886911f074d3a5e5dfa8af1320980a7e0ec80b5cb039cf4
-
Filesize
841KB
MD5ba592c7b529027ae4e4959b617bef01c
SHA14254e77af4aaf06d3dfd18fd3c8f3871bf4a6e75
SHA2564158175cfb6714822415f90bf44cf8bc329071f51de34478d64c69b3080cb260
SHA512eea69eb8b688409a8f17ff5d12bf19d9202ea8f08590f0cabb5029e2db2f73cc899e2b02733e40511ec6a1a6f4e606aa9981d6489243bddf6a3c016fd18de4c0
-
Filesize
1020KB
MD5d2ddac7197def9e2f44789fa4381b296
SHA1fd9c9250a83dd13b36b7fdbd61ccea519d250d63
SHA25636825dbdcfcd31a4b76f3fb8b511fb882ec539bd502f681424249a2368b4129f
SHA512a64b63e7bc990e6930b473b58d55c2ff7130f65ec8f04dc6547aab5f7d0ee1d9fe38e15860a68e76b8fba0393ea13dea9be67c673a5694cc3590376d2fdcf7b7
-
Filesize
581KB
MD57e26d52f9c4683df2b7296d871da539d
SHA12d987d7aaf8f7015c6f8f570ffd882f7100cb711
SHA25687ba4f8d887d0232c4015599013aa8a15efea7b57294d5077f51a77208f9585c
SHA51275b22e7e248be36316a6d0782922e1408c1e93f98acbd41bea4ef64d5ef8aaecdd920c4778492646cf05c7f98881ff6f2aa2558702fa415a80875cddeb1dd96f
-
Filesize
581KB
MD5d94bdc9f5af06be851ef20fc90738865
SHA1535a31abcd6d081ae4b6a37eefb47dd20a4384e6
SHA256915fa221a4a1c90b6f35f4c25c65c3a78606f44a7d7c6b32084535e1feb7f4cc
SHA512940e219e640cf55b202f40529b4f1443f86e23689d2dd27f659f9e3eb9003bd0c774d07d45fde6e228f495e48b02d723efe697d65d2d410db2077c10858954ac
-
Filesize
581KB
MD5f25a5974453c29fd9bb6b2afa611ac8d
SHA1535375615203cc760023a7d5991e9339c30913d6
SHA256edbf52d0cf75dd69cd64aa2e846efd13c7800dfc9977c60a63018d31156f2854
SHA512b44aef58bcc8e6ef44ef2397dbe993793a445dc7220fbad30960f945d1551994161e67eea6359e7c403b89c1c4a59b88ffcc55f16df046b7abb0ffe247464369
-
Filesize
581KB
MD5d872bdb41e179dabdf6b22bd29dba087
SHA16fda763233c4acbb7c3bb6c4bd41956b5d6b0f3d
SHA2569d106712047e30666f80fd12514e6ac1806c1ec36049d670de824b4e29203184
SHA5124bbcbb242440d6815c560c460f5ddc51fbdabb38aa0f661226009253eb6bb077450ae62fc7dd135cedc1c529854885394317ea4b7f88a6c183be5f3986cabca8
-
Filesize
581KB
MD516b7d60e5c77bc2e28b94051a4bed949
SHA13b2d4c602770b2552ef18e5170f05211f028285e
SHA2566b4fb239acb3d680d36e41d6cb45063fcf7c9320a96fafc7fe5f2655b7ae8068
SHA512bbb5fc36da0969ed2e7dee5cf027ea4a96289dd392a6609318e488e8d16ea65fb0dacaa1eab86c92f4ec6ea7fe8df5076a9725e49327bc9e783182f14dbe075f
-
Filesize
581KB
MD5c9f693a8bb9818cdda8789780563b61e
SHA1513aa660d5b8b63cfe12e983d6fab9664d22fd19
SHA25633c170c5fc8aa3e8d953328c599d383fc2b2eeb13632f937f571843c910d539f
SHA51262ccf023e9813683bd639288a1d58fd2e7097e6b7d615eab9d788a5f37dcf95c1b666b1a43423f7e62a1074fa25a70afd7609a88676d00b9f5dede9726dae122
-
Filesize
581KB
MD553b30cd2b519748493607fee84c642c0
SHA1a4a5f5481cf2b5dc188b52349f23d88eba8e7683
SHA256418a56f6b02516aa00cc9c89f65940ed77e662bbdd66b77b3e0e845d36dfca86
SHA512b772a19d9af6735ed3d04b0fd98dc11521dc22faddcb8cb5c02169a11558bb5f18c8ab85f5c64b16130bfdee5225c027dd831f55c7a7374a57718a44281199bf
-
Filesize
581KB
MD541ea7113eaeed4fb280e866358378aab
SHA1ee4c415bcfe3029b5afc1bc5afbfe199fa423f1a
SHA256e4cbbf94eafd2671519eb432149429cad02dd6c02688f3fecd905cf8ec7179b7
SHA5125a5a943ed894a8737e52a3df0eeb40d5144e431dad81163c3e76d502f47b16cefa2a661b875236f1925046f7babb79ffc38fd5c670390413854faa8f68dcc7c9
-
Filesize
581KB
MD5e7b0c3514e56bbe309f37e8b623f9241
SHA1faf166253a7d8a17d3434355217882eb3d762153
SHA2566170a759fe3dffaed8a9bf8908bf144da6d922d584d11d348f38b9efa57c6a3f
SHA5127406c360cb603999cca4e4a98e67445c24f116ed6a6634f52d275bc45f7fa97a0e6324930e7f9d451a2cc525bf0b9556dd793ba359cfda07ed05189d2738b83d
-
Filesize
581KB
MD55b31a8b7c5347230f244e9c67221f1ec
SHA1e36b771fc1655f9c9fe96fb88930cb5c95dd01f3
SHA25688c723242a1e60aa15911a210593db311fff2abe020d7fa24c04fabb34de1a82
SHA5122510b6c8401193b64f3a6d0b32d89d3b7087ed3a6a034fea0a030abb6f1d513404affe7abf0a897c2490db50b0858092d88f49cb45cbd2a39c6d57f335f88d68
-
Filesize
581KB
MD5a436321ba7c1d653078d356d0fe42704
SHA149c9fa9b8935d4cf788d4686ef9492f3dd1be102
SHA2564d06bbc182b3ae0284603cc8b141bbad3f68ce06cf4d872c7895ce4ef9d56958
SHA512fc8c5b4e18aea9c5bca7c5c35a5c28062c43e7a063062228443adde3ed7a3f2e2fe632890585a0b52ebdce2ae6a3128fe178687d9c0b8d33ec795cc49d7d83ae
-
Filesize
581KB
MD517a7a792ef7fbd11e5f2513827270c80
SHA186fa4575a4e817b274d1da39455a579be45fadc4
SHA25680caff3790abcd8bbf55c1ead78a1d6a60c91428514c9367926329410f5cf375
SHA512f6b8bc43a20938c523ce9dda6b07439aef56315a6f638e554dd3e7100ffed894fdf57a2ead9c28f69820f60e5af292fe2a7acc07a484aa8bac86de95512729e5
-
Filesize
581KB
MD5e67f9af2353069a4f4d1b5df43d6c5da
SHA12517a54bc208f91b2f1fdbedd7b61c26aba0ea92
SHA2562b6c533f501e85756108e6875d45c1693ec929f9fc2ece6dc2e1ccfc1f61557d
SHA512ef4e52661ebecd5e1e1628b75acc7336d60d136da337b08f788493502978e50ed16f7d7d54ac28f14c821d56e78f545b34d1c813ba57673d123ef61014a5e173
-
Filesize
581KB
MD5b9a3fd2525aa171ec32118472e9cb5be
SHA137fd5e9ade565017c3f7caeaa4e9c4577884b787
SHA25661431d5cb53727ec1823f166268e05b93105ebed0a772d7aa3a08659a246b1d8
SHA512dfbf0bc7155027c6fa927356b93424b2230794f2c5f383a2103854817bec8589d3681a318f892601ade01fdc4b423ef6eefbdc7faafbe24a54714596ee31551e
-
Filesize
581KB
MD5f36515dfae75ee98465c4f6bb9dd51b5
SHA1c1629b1777641a55fc8773b335a34fb6040b8772
SHA2562d31b7b32d7c537a27f806442b34ef1c26cb69130f92eabad3ddda6b4112169c
SHA5123bdfb35ede8e583e8ad987df62a7cb72aebe0ece33367ca9b05791ad260c766cf8f11eb2576ca195d4ecc834a937312ce2cf020cdc5d982a9af2d169092516a2
-
Filesize
581KB
MD5b590824c4d5400e238a37f75ad5de7d2
SHA1e343e78f92e49d744ec4c6b14dc921a931634e79
SHA256ac3fdee11877ee6675fa2f50113b654208f04e7dbfe96ab35d5b6b2a2954d63a
SHA51273c850db617dc5ffb0a3aa215e36836952acb1a0f5f6e2db37e602d2def9d5f1bc4c0ec6c76ad3074c46dccf458445955603cdabc0a2bae6d2afb9dc329138bd
-
Filesize
581KB
MD5e58c239faa883f37b43e0e47b997985d
SHA1774bc48f8929aa6e28e3df83919f711e61d6568d
SHA25695112638f5496e82f288831cb5f6b659c8f2400bc89029378b70fe26158917ac
SHA5129409d4f3f93600c32bcd53a4d33aa08721b3e4738f68cc6ebc15ab4c25d33659cb4822b499797558234940fba1593b2cf5f63d22b54d684edbe3b1d9cad97a57
-
Filesize
581KB
MD519d72411627e87cf1cb0fbe4b9ffef57
SHA129da80a4b635a7725a7a9b1c5de944db425548e5
SHA256c33d82c50be93bca4a82de5a3693e8a9c7f52d3e13aee4455c7a1ffd7eb720d4
SHA512b91ef2683b6d3559e7c48f59f68dc7f652faf2ca2c07388ea78d133ee270558c4af4b8f60367b522b49e9276f68f50226e85e824d8cb0d7e6f02216839c1da56
-
Filesize
581KB
MD531d147c50595798bd358c7220c121d08
SHA1aed3f89072b282bb197b1b95fe27e4f0e26d053c
SHA25616035dfd7e0fbd1be7026078d952add833767765ab93fc99a68d665921f1408e
SHA51298ebcdee2b46c0c468fbb1680e55d095ba5d4bffaa8f1635157f9a0da463759a744057ef29d7132c0dac00d469e7e5ed346b0f1f14673725b0b6ea6bc623ed3a
-
Filesize
581KB
MD51e157039790cda38c63d41b4e9f32264
SHA1a51ba4483d0ee2f2a8eae0160781f957c6f8cd62
SHA256e60623037c472c745adb70188f37438bacb25148179c2d6c4539c77a8bfae130
SHA5127578943f8e77e9bd49a308187be6da96a577378546eaeee94d0776079ddd763529fe0a850cb2d3216d11d1f35d42e50d770a0eb65b76937d7630c27b41277455
-
Filesize
581KB
MD5068f5f5210f880f36d475afa79465a3f
SHA1b8f6d85ed43c166a6ddfa5150458089c51ef454c
SHA256b84bc7408ce0ce8f18d748b20aae17f038ed1b5b48f21197b3e507006b00274d
SHA512b1077a9423fd4ab58d06dff0117f1f5aba7d1a94fa314acb1e71ad5eb83365006ce1ead9fa40aa4fd7f997acaf3484ff7f632d259614ac494ab0569d4a0cfae6
-
Filesize
701KB
MD512b15826157b383b0459821cde362f0a
SHA12700dda4d81741b2107d0022cd584567f3d0af21
SHA25628ee307c03cd49502b74e0d7f2509845aaf30303e463ef063f327d1b400629a2
SHA51251fe9688b316820123eebc0537148c07daf962234c70316a46b3d777af1a6af19d63128b6d56b2f95c943f234a0f2954c6c224dd122b410410470dce7d89ae3b
-
Filesize
659KB
MD58de288349f2d9a3b3b9e02ba7cbcc897
SHA10d7aea05ef9073e4eb5edda5b3fb631d9693bc62
SHA2562ecd70101d324f7e2fded49edc2ed60fef1a713ddce62d45b92c49cdd55c0970
SHA512dbdb1de58c8908824935bf192e7ed942d260222a7830535ff99330ec867798fb92543c8f5917a7b52f0b45603761898d7c265541aa7616f6e5b8b57e2fbe0a65
-
Filesize
1.2MB
MD5dca9f27a4a870051d5fa89e63739365d
SHA1c9e263a253f1cdcb8628699b142f145acb61fe61
SHA25611123edfd6a05784030267e585027bc5a50b5ffb2b21acdc63527bf1f496c88f
SHA5124b53301e2d4a6831cd17f51e8306cc9bf027b219a7c39da3c5dd551cd817182165a8ef0a3ca3657f93dffbbfae6e73b53c80566a9e39bb7293ea2508a16106c0
-
Filesize
661KB
MD5e2bcd1079ebffdc53bcfc0df6c7f1f1b
SHA16c3b923d44e01ed4cb683be200d6ba7b10950093
SHA256fe29afb71fabb5de1b78f736bc1209e09643b1139a5ff9ca2816071296d6dd2e
SHA512d01765a7cf4e1fecdd3fe684280a2d93103e989a3b92b965855c393d4404d63d04c140c928d13bf28ba16f417fd6b7b03d5529f4d8f14cecdc37b01c1642934d
-
Filesize
1.3MB
MD51cfe2a08bb75c967ae46deb8af6929e6
SHA1fc76c493e1185e294ba8907f82f57dce55d89aea
SHA2569920f77854a848d11e454b73eb4efc73754a6d4363babc55f2c50858b68c7ab7
SHA51203f09affece3023d022f150ebd3798bd6d0667fbb234a1135bb04d108fb8a39f006475e75a38ed74a527ab1265438e6ce1ad21d40a73141eb770a0367942b6b6