Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
960s -
max time network
870s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
14/05/2024, 11:25
Static task
static1
Behavioral task
behavioral1
Sample
download.jpg
Resource
win10-20240404-en
General
-
Target
download.jpg
-
Size
27KB
-
MD5
e38e55341a82a2216e404a0b2d46e095
-
SHA1
b4635288dd001c961b5bd05dbe1d1e85197796e4
-
SHA256
6b6e2c621db910ce42ad91837453d46b705e2d87ad23ca813087fd813e09c3e5
-
SHA512
921212400ff5b8e6fd564136335106bda6d259c140f431acfe7bf81f9b649a16f4d7e493b43d02a2d22f4d4c90a16e88a26f5baf8eedff98bc4028a36d11e804
-
SSDEEP
768:gCWWExTBQUAfgM+2PG8B2b3qP2nubM9DzXRnlWJJ5GNsr7w2hi0d7:y9FQjfo2P/4s2O+zEpPw2ht
Malware Config
Signatures
-
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\rescache\_merged\1601268389\715946058.pri SearchUI.exe File created C:\Windows\rescache\_merged\4183903823\2290032291.pri taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\715946058.pri taskmgr.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchUI.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchUI.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000\Software\Microsoft\Internet Explorer\GPU SearchUI.exe -
Modifies registry class 18 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "493" SearchUI.exe Set value (int) \REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana\Total = "364" SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana SearchUI.exe Set value (int) \REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "526" SearchUI.exe Set value (int) \REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana\Total = "397" SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.cortana SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.cortana SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchUI.exe Set value (str) \REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchUI.exe Set value (str) \REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchUI.exe Set value (str) \REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchUI.exe Set value (int) \REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana\ = "397" SearchUI.exe Set value (int) \REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana\ = "364" SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchUI.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1468 taskmgr.exe -
Suspicious behavior: LoadsDriver 64 IoCs
pid Process 4036 Process not Found 1704 Process not Found 424 Process not Found 3376 Process not Found 4548 Process not Found 1956 Process not Found 2432 Process not Found 3044 Process not Found 4828 Process not Found 4872 Process not Found 4164 Process not Found 2880 Process not Found 4648 Process not Found 2664 Process not Found 3304 Process not Found 2836 Process not Found 2196 Process not Found 3252 Process not Found 3900 Process not Found 2392 Process not Found 4044 Process not Found 2696 Process not Found 4728 Process not Found 3088 Process not Found 4488 Process not Found 3608 Process not Found 3152 Process not Found 1848 Process not Found 1712 Process not Found 2892 Process not Found 2416 Process not Found 4160 Process not Found 3040 Process not Found 4024 Process not Found 2440 Process not Found 712 Process not Found 1016 Process not Found 236 Process not Found 3760 Process not Found 4464 Process not Found 4332 Process not Found 5068 Process not Found 844 Process not Found 4500 Process not Found 1768 Process not Found 3888 Process not Found 1136 Process not Found 744 Process not Found 1032 Process not Found 372 Process not Found 4452 Process not Found 3120 Process not Found 256 Process not Found 1692 Process not Found 3128 Process not Found 940 Process not Found 4076 Process not Found 2152 Process not Found 2460 Process not Found 3620 Process not Found 4324 Process not Found 4860 Process not Found 3784 Process not Found 252 Process not Found -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1468 taskmgr.exe Token: SeSystemProfilePrivilege 1468 taskmgr.exe Token: SeCreateGlobalPrivilege 1468 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 4496 SearchUI.exe 4496 SearchUI.exe 4496 SearchUI.exe 4496 SearchUI.exe 4496 SearchUI.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4336 wrote to memory of 1048 4336 cmd.exe 94 PID 4336 wrote to memory of 1048 4336 cmd.exe 94
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\download.jpg1⤵PID:4532
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Windows\system32\sfc.exesfc /scannow2⤵PID:1048
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:468
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4496
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1468
-
\??\c:\windows\system32\sihost.exesihost.exe1⤵PID:1404
-
\??\c:\windows\system32\sihost.exesihost.exe1⤵PID:2208
-
\??\c:\windows\system32\sihost.exesihost.exe1⤵PID:4328
-
\??\c:\windows\system32\sihost.exesihost.exe1⤵PID:4440
-
\??\c:\windows\system32\sihost.exesihost.exe1⤵PID:5092
-
\??\c:\windows\system32\sihost.exesihost.exe1⤵PID:4576
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
491KB
MD55e98d5018c0b9c6fc64e5946d01e4f60
SHA1c83f3af0cfb290ef3c53f4fba3185552dd6f2ebf
SHA2567bc1f7e33778b22e4c6ff4437ea79382591e263ebc4119d739d16d3432c7898b
SHA512338bd3b72dcf598b35353271df50a6fc58a3d42042d5ede8598b9eb62b62d979dc6783a65d16ff11bf879c7ebd410186b2f388b7a1308092db145fe21cf912f6
-
Filesize
266KB
MD5e9c80479d4e7ac7feff0e7daea80ec8f
SHA1a2ba3e02a276c6c153592f692e052b4095a2cf0c
SHA2562c57de9a6084ce79448e4fc72cd0fbe76d56a602010cc7eb175b6a8bbd6c47d5
SHA5126ba9298ab59cb3ea4c501b67e9988bd0efc92a080f7958b899469f088b792e963bc0925dc21081333dcd98c20d2704f7af29b28469cd9cd36ef2f7b0489cf016
-
Filesize
573KB
MD536e5f76df83e5a59dda529c1858525ed
SHA1460f884b57ee9b22d477bc7a079d04dfbec7cf70
SHA2562522a845780213ae711eb67e85d572c4d395c81b90739cb18936b4dbd22b4590
SHA5120300186b3f18501b8986ede83984acc47ce79aabe74a7dfa3f470187351e8dc098608eb7826ebcf003f784a4dc1ff8362ba4d88c46c29b8cf99a257aade3be27
-
Filesize
368KB
MD50cd033dee7c2c495972fc9c2c95da50d
SHA171cec2bb184436d3910d83ca8c67bc67580fd867
SHA25606c6039b8305fc3bc92df86f5d10b4f6efd5ddb70f0f69d7b26b62fd9f3c58ac
SHA512b8af00de78c1adb392e48848d656888d35cab5f5a14a755acb8623ca8db41cfdecc895729cf23bceda4c11aa742bcfaac0545a948a08410361a191e6c1e9ed7d
-
Filesize
450KB
MD5304ee4d79fdef3d6e09dab95be51ff98
SHA1319a607956a122047515011c160cde7279042407
SHA25652a845ab55aa39c6d3ac4a4897a542ef0817cd74edf4d3973a9032f17c5f6a5f
SHA51244dd5e0ae43e660e94f0fb86d825800c2d2513455df485a86dbf26958218cf73015afb9c89669a012d39e5d51b5a91504e55726c79f399857d83cba5a2831c15
-
Filesize
225KB
MD5ff943417703c188839c2fe9a9e82c261
SHA1aeae1f9f0987a706f09ce896c3dda77ed8182941
SHA2566b221ae76d147ea80b69ab3d128f5647bd4763572c6e80024bd062a3678499c1
SHA512457b3feb50eeb7bdbdb40e5d9eb5d59421edc812bc04b9e7741a8f176b6a4e7145909361c4030b6cf44f16517d985d5d1c4e5c5a1b0de9c445576bff43f7ce24
-
Filesize
430KB
MD52e5c6e22440ccc14dfa0890a1299722e
SHA1aa8b6170b6b8d4d0b73653ecf7a7c60e56296986
SHA256cfb27daed5faa12e631d17236d672f011f5483947e65f88fd79838e355ab33dd
SHA51261f49428ffae1cd062048170d359ec7091350ecf5c38b2e7d7e631411013294bd914c067f7e86dce3d8cf452a17d1a5ef7208064200c573cb597a8b8a8a17d83
-
Filesize
798KB
MD5d2330ccbd1b76fe322270d090f3cfbd8
SHA17a1b1424731e434bee9d165bab0af25a468ebc01
SHA2561b08cc16242e5731b125579af3f93863d22c3ab678aef6f1cfaa9d70488729a8
SHA51259b4cf642d10d9097d5dedd8fe095f4511c851303123faa3d41edb1ce291e4cfdf367231d0f15e5ea9849168ec9cad97de4cc7475bc6386ac027c3540b53a047
-
Filesize
552KB
MD5817a5a7ce7a3f12fbaf37a8e6a906bfa
SHA1d168c877ae681af4016b18accd4a4513ac3960da
SHA2567d150ea57b888e0c1cdaef7451fb7a80f9929125913513526c7349ac9d1a4ff5
SHA512dbaaae16b757c0c1328fb7f5a628a64f22a07a55a0761eb58f46918b4fb0eba00332e446036b7fe7984ff0d2c7b65091b7100586d36c9d4aff483f4c89935f93
-
Filesize
307KB
MD57489ab1539694bec5e6e1d87c0f5281a
SHA1a58fe0eb0892b9a9ee6b184f51057a97c736805e
SHA256ec56a4ec3f084ab5df4d1cbf8eae18e655311e5cff99cb567e8ccf7fda9dafd1
SHA512aed6bead345f9ce2f9c71b9679f9d846983086ebfe966668d4d4d6a5a7bc21901e809deeeb367a5a085d64658bfc18a51a5f57d5391bcf84a7feca9016bcd326
-
Filesize
389KB
MD515c529cf21d9f647465b829db73c053d
SHA140cf3e26638a5a1c9cd3aff5207e39eda77e9437
SHA25624cbd0d0bbbfed96e438f57740168a37ae9ae67444c98f9f21504e66dac320fb
SHA512a55fcdf52ec8f834f8258d00c01dfd71807a0a060a3ec52794b9680bafab0ca95959b951b7a75f3d446c6dffe3eafe0e6163fbe15779e881f8ea3e559f6e5251
-
Filesize
532KB
MD553ee3c879745e31f3a265abc821b2ac5
SHA18ab1935f96dd0d5fdee0f5269fcc85510685e056
SHA2568776de71fc33a9290bb34b254057daf9c38ad041a4b0340602a870345155b927
SHA512c9d361412386663672c00f1d99a92e6f331ccdc3854ef9cf45d5f558c08f4de5b394b1490d5851e12ede1ef88376d7fb19abc98feb309626e457feb277e0b92e
-
Filesize
286KB
MD5a9d07009efb629f8fd489cc6bb59c612
SHA1ddff838243b911b9118ef50af32defa54a4626bf
SHA256d5dc4ac4aeda0cfc0acecb4a8187fad8b92221e5d093f674d9dd6aff5e043c18
SHA51265f680871e4b004846efbef554319b0616d8cf857760f9e8e5cb247f5393420c63444a490def8b28ead55d81df079496f6e7187066505dcfa5008edff1f6b6ed
-
Filesize
471KB
MD5b24ae9da5a73c08bc20548ac39807098
SHA1e5f04fde66e5cd1fceacf3de18423b78e025040c
SHA2567c822d82cf2109ad52bfc6a284aeb9a204f0080e92ed827842ba4d69a240c749
SHA51241c3f4df96615fb9241df3be9b7be9e02c3a7b75a26a4d42d6527aeb360a420d83598f8350cef4d3a423a08f8f8c8c3d37770b66776ebc1a68023e9a3ab3f85b
-
Filesize
204KB
MD5c19b184798ce8d0094ba45324a728120
SHA103f27a0af83a2f175c553bf20613822db0dd0dde
SHA256c359227ff8f14da938e05dad366038d4d27b76f54118af847a92048416bea43b
SHA512021873c0016f3a4ad6557b58a1121e3a95a02fd68d5a090ada0f2799aab71ee612710d8c280f20a415712f0e94401ff7ee00a1c71dc5e20de6a2ab5a76816dd8
-
Filesize
512KB
MD5e2b156ce090edd684a28a17cd7d0a266
SHA1cb73bfda5152f5dbed673416da351c52c41a23d6
SHA256e667365ed86542f574deecc477bcce469c627c7a6afb9a7825379984903d137d
SHA51270010772740633c727c92bf74ec4813aeb72b3a3c8ce7cd7670c8d8a812daa465c45f9b5cc36abf1386a8de78f048394367c95d848d77a0e21657ba8fd6e1591
-
Filesize
348KB
MD539d8a97358e195fe85a1aeaff9255c2a
SHA1cd069da22c396dc3c6ce8538ade5d9e05ebf1b64
SHA25613ebeaac359012ef8ff5deedd441490de51584b13566b1d51f19b7700580da26
SHA512d163fd897a88ccb3a6e2e611263eef4151a3a6216476612eec5e2283daa9c12448e60e7195f034338b6575c045bbf26e4968c2c57f42d495883e14563445ca15
-
Filesize
327KB
MD572f51fbedb31a81186164de5e00265f3
SHA16cd8dc0ba48fb0e0ba0c7d22dfe3d80858256c68
SHA256d0655ad3c7ad6e8547cd2ab748009115d22d2716bc59b119584ec1fb4555ae59
SHA51299047cb9c9588e333e14c8303709846d2a8e4d4b6e977aa132540dc17e618f52923d9ff976c6c622af9afa1fa1d28c50936df78652081a63c8994927bd6ac807
-
Filesize
245KB
MD5d4b460f7c11cd5d60aa3bf271e5c3701
SHA1e80a8dedfbf5f62d092c5de4e8219ca797e0ad2f
SHA2569d0038a781351a5c8f1f8423c523aabcbf8edb0c6d20c287328f64893a3ff3ea
SHA51210fcee5b7ed5ca1a5937217cbfc61173241a62c71aa42f02bd4d6326a94d267c4011c30997738439dc8ccfa46ab67fff1668cfc6a787b3a820790a9255ee5c8f
-
Filesize
409KB
MD5acd0517f82183ef958a5e0b42b1b074f
SHA1b5d49f77fc123c5c0b7d24df0a468b1314988233
SHA25681781e59fa8148f366ba32363ff29c648c9daeb5b9a824c4cc9d30c34961aaea
SHA5124e037ea04e85c73bed0b1555919ba87323bf6fd07173bdd664d083552e71ce5e88c54f6dc4a73897a6877a6c417f730df0cbf7651ab48b6f9de498cfc5552b74
-
Filesize
552KB
MD557c930365e4df5d3c7110b689382f305
SHA1a58de4ff28e4aa19c82882e8d447d57ed36c5411
SHA2565c1c7b2da0e88427ebc027c375e02a6ac264982a96dcac615b7bc2ac3b8a00a5
SHA5129864a58544c427e27692ff31513a2466dd5c7aa9ccea25f6d6e31b3b2beabfb15480b137350f532e5300de6b36b486e1880a97a0c0612f0cf1a10266a14e7292
-
Filesize
806KB
MD55c3723c22457fd99e4a7d9f2bf6ec989
SHA1862cdb4d2fe44a48a16772f722049671b7293e09
SHA256031b2a7008e57f96943d29090b7b817dd15c9c85b6fa778a01679174ca750e50
SHA5125bb9cc1c7e7174e2daf7d22f43ea742a37fe3adda389bf10b98da85473dc806b0c20f720ee107aafe2b05d7cbb31eea041cac68e3f8bdb79af1731fbaf2e2bb4
-
Filesize
1013KB
MD5f6f53eb4db5d8a69c155a0d9aff962c9
SHA1697ed3cab2d07299223ee73f1bc4d274fe45be3a
SHA256bac646a7b823929e5fd46de0f11e88a2dc96a990dbd0dbe980286cfceb5885f7
SHA51243307dce1dc30886e805777fb217fd03812611d1f7f3f22e8611de8aad99ee4380ac7afefc91d08e557ceb14e86573c72c72cd08e5ab0f375027def563a2ef0f
-
Filesize
829KB
MD5e13bbafb22cc30823d92f6a28d9561bf
SHA1af6dff59a160978f42491b8b716fc69116ed244a
SHA256b2e7eb4b3f587aca440127b1d912bf02ec5eb04c013d41a7d3d7e29312b5eba0
SHA512b34213441efeb810f56d94fb61b09d552861adde8cc4a5ea9b9d98071c4b1df0cf50cb59b2c69503e632cc3ad2122e708739ac0027dc789dc73631c4a1fba1d6
-
Filesize
1.0MB
MD526d69ac09747e18a8ae2c2adc83416ea
SHA19ff1abccb364013c4ce695bcd0cec0bfa9c58b68
SHA256ab51afc21029d5f9829d03b2d777a9ee9412b063ce6e37c4c11506600b7b0064
SHA5123726fcf012d2b38b8a462dbd3716735a113581b8fb5fbc49923f1078342aa6dd71d91446d82327291d5517d36a80fc85c218aa03b2e69b3eb8786517083b1d6b
-
Filesize
1.0MB
MD51698b094810465522d6c8e1e1f0c74fa
SHA14beac0f0bf12a6a3e28fe14d9bdd49bac7171c73
SHA2569ffc39be7b9d5aa7546d0fb4935c29fa0c9afc81209d39fbc69b9ac168654df3
SHA5124b50672a894f9be86c2303b5792e28b1fcc94364bdaf1fc7324ab4d7770e8313e9d1155c1de92749858d64e585d6b8f065e3ccc14340ca351be969c2565b2f98
-
Filesize
506KB
MD5640715191affeb29b41e8a3510f3db93
SHA16a3bcf333888be61ffba1297dea7b1c2392f378c
SHA256ef7dc7eccf809e4e2e603b4614b2085bdbc3cb38fc5bf9b9e9008383fb7eecc1
SHA5122616e7d72d4673de74a630e25d3a60493d5cc01cfb7baba8239f88e47c0e666ab4ea3ef8bc377bc99082df40add99f3c0d33d3cf7c22fa1537acef887e998713
-
Filesize
1.1MB
MD58229518da1bb3054285a6f60d080bf3f
SHA1a004023fbc253a973029ca2e6f6e903a78d88487
SHA256a9f9fe9e70693390418781fe96f2b14b0ee581227f4c7da66e518533f4ada93d
SHA51247a1d125ef3443b8900eb33a7987b613d4ff900aaff932fd2b835625ab5a3a088e34ae9041ab8355a534a6f4fd38112ce45ec33ca1503c1759d96ede87368a49
-
Filesize
783KB
MD57ddc0b80e50a900610a057017dd1e6fa
SHA10c0a74b4b4c2b6ca598255a17632982d72c20c33
SHA256c991c109edd3c4bb6925f3925e07864b1c99aa4459fb7a8babe2f3cbd9132887
SHA51263479ad8f8fdc83df0ffb013bad45f729d51d542969bfccdb07eed5643ad36f63d6fa1205bca0b2134b5016255aaf2cf1ce02f5737f542cfd292d790f3ab251f
-
Filesize
529KB
MD52218f60ebfe4afe2f01f490288934074
SHA1e02c5ca7ae3d9e9034e260086c73e6338048e85f
SHA256e96df28098421544e1da93326482285aec078c6ae96e0bca056bb8465a31e2b9
SHA512fdb1c7b7e6ab693b28ccaca533d610b372d575caee291fdaed7454813bcb902d158bb27c4e0c74e09f3c1de9958a2574b1803a70bb5e79babe2e77c15d10a0a8
-
Filesize
621KB
MD53d4a84527768c51abe97009714ccda01
SHA17352edcc1ef63e75fd607062f3fbb22dbd982217
SHA256b36f9b4b4f4043508df4295d1edf0d544bc412832a4e56f38c3aa62f3c6ec5be
SHA5123b981d47c09a1bf31b6786ece4c4c9533b7bf51d0a59086f3320a9cf1427ea788abf7fcf8b6ff4a6773c58f58d643e82cbc7330e00139c112e78c6c89b288a15
-
Filesize
967KB
MD5744b55d2f95970aa25dd26b695faa59f
SHA11f8ee33aee89084039388ebf7d04b2de6fb03304
SHA256383f1f985d48dba54933d83ec35bdfd4e2e9db7826ecbfab0520b547d40c27dd
SHA5124dafef280f5b571134b3d38fd143052cb98454f4fcfe84ac69898f15353252326ce7183879cc2b90d77a501ec6106b117e0e50b2d8416c65bbfdd52842c5c475
-
Filesize
921KB
MD5c0089df04cce7c0650c4726dc1c07fa4
SHA153b1875b3f3cfb5d576f0011b4d9bf3781c10b55
SHA256c3178041f307a192bd21ca66dab23b35b02ba82de9cd327b500745cb4159b614
SHA5120e33117d77331c8825a4a2a56aefeb410fbc3fbaaa5adf55ce58cec43225d5db6096c527ef3314ad0cacf3e580bbfb6d8823329b8b88eaa7d7616cd50828d867
-
Filesize
875KB
MD5f51ffaf31bec53c1143cd91d1040c4ad
SHA17bc3778b948364508e51ac41fcbf72ae0cb8b500
SHA25639cac4efd1d631b2bf09b4b92623f387ac4b1a10468ccad1c47f094ffdc5d0bd
SHA512c471b47a8e34929361e734db297371e4b55d70f117fb8f5b5821caddb6e4030dcdd9a5cd9e18f405c71958b5905fa37a6584401254806427a76e557154d0b585
-
Filesize
898KB
MD500c590c3f36972ea610650a5958aa760
SHA106a5109f1a878fd65af44d58acfa944be4bd5991
SHA256e91e79bf629558e3a2a8475e190b2bf26fbc4afb409c0f3784eb599fd69618e2
SHA5129a53b3763ae978a82a21160c01f7fb3040a940ad1c982389258b28ea7da3cb6c0ad781d2d6432d829d0d81b7812f5b39bc6914403ae41b4d4c2e0625507cb6b5
-
Filesize
598KB
MD5ae03fc302b169f8ce877b7f921bb2b16
SHA12de3a401aa686d852fd603687b549abf6dffd440
SHA256870a554e023bbad1a2aa5dc238e2860461a77b316e6d9c3a308a4e31115f7b5f
SHA51287fa984b4de4ecce46175e63acacb7af7501ca93ea7c0e6dadcdffa561a8e2e93e7716e72787c870e68df9f4a85c10df8cc4de35dbaf0bb1c4b0fb29ee0b5f40
-
Filesize
944KB
MD5dd781c1fdd465529878a72423fcf410a
SHA18317d7e6f4cff0bad5f305b4acebf927df7a62ba
SHA256d2ca772fc59f44f37198cf69bf23c03cfeef9015ade1dd8bc98df5f5a5d9b266
SHA512f77498bab140cfaabec060ebc073eac6ab257a263ccbfbfc5c2a244ff30f229124f31a543bc5d2ba16fb9559df28ccce6bf61188a7977f5c095d2b0ee860b991
-
Filesize
690KB
MD5c3308693540810d0479893c21cea5789
SHA16b8a7d94b9801814ac7459ef6281bf76a03e3fbd
SHA256c103ce0d95fd835bb11b20ba4f3f14616d953a47fd3e2c9262dbe15a03d8c67e
SHA51224dc7d3cca5a46623d898715ce268cc146cb5a2d7979367de8d04b5c6a1c9a278b0930868015bdc745abeec790569bea3a211210f8b23c949033b2a7c9f0f52a
-
Filesize
391KB
MD5bd67133f1c88c6e6627c6fd939641514
SHA1c81d39984d653977b8e4c939a828c454b4d1417c
SHA25683eb6b3032c310bd5c5f4dff143d65985a638ab58b5ef15da9ba0b503790454e
SHA5126247ec36860c2deba7f8e00b99dbbf3d5f6b7dabfd57b7650659f0d20cbaaccfb15b08b310a5a1dff6d662391519444f9f161622a3ba992f5fe05b1ddcff6dd0
-
Filesize
483KB
MD5dcab5424af50ccc93f6a7de932d6203a
SHA15b6d7c9b40e035799bf63f09f3140bcf4b1e3180
SHA25674a977297e65eeee61dce19ff5c34770a087c3d0ebbc7aa0f428785e8898e442
SHA512afc3c176223971e483ccf04d824d7dd086eb4e59de72f70a95a6a74091982005ecd5ec401bfabf7b8e00e63b8f52092bc72deb320890aa5ed5b9d5704ba3c0a0
-
Filesize
737KB
MD50d2203b153c03ed4f2ae592d0ab0a3f5
SHA1323cb4c20b73fb2cd791c7b7ddbe4345e1fce683
SHA25617ec5703abdd414c6f32e52cacf3f1a3e048fa5ccbe967e6479fa6ccd9b6e6cf
SHA512d348033d9c14bf41ea44ab230d9ce114ee8994ea933e56c85d55b8aafb99eea0588dddf58a2edae8d82f1a93353f105a136ba53582ee2c2d4a0b110384102f86
-
Filesize
644KB
MD5a22d0a9dfcbad2c1da4e3ebd27a5944f
SHA153e5ec1a917f2ec17f464658f7b85f67b46e2bf3
SHA256aafc34a9acd29a867f60595b721772b0b9a893779be7b65388ab3ee238e946ab
SHA51234015b9a79c546f8050500ed918edfddba716238bdbf32fd76df1518820500816027a86b1d72d1372abb5ebf05196c4ff8c6d5f0fd0a541f45bf7c563778af2a
-
Filesize
1.1MB
MD5a5dc2facfa455e7ca4c998e74b417a8b
SHA19d1b149b11ccb7233a870d6a46bffcc68480daa4
SHA256c86b2eeecb4987da1ea4e4ff737dd38306c5e08c6a7624ef2b8abce4a40ab382
SHA51266c54c1ee80d603fcdb5bbd4d18f6a0aebe421bd928d13dd059a815bb41734357504f4fe550099cc4a51be0617b87bff72b4de906e81f2e77890aeb70f127308
-
Filesize
760KB
MD54171ddb7e508df1e4b65879a41068e8c
SHA1d86073698d7848a8581b46fa5abf354f2535c220
SHA25659a5ace35974ab37f740005a3d7176c93f98ae8cca49c979969d741b0d9c478c
SHA512d2de8e226e6cce20bca20ae85f31b34bb52b08297cb7325563f1af805a251b4974b1383679c87b94715c0b3399544064c6828c26dffb0b751455ce1f4e5efa0c
-
Filesize
667KB
MD5d7deeb5438272a526478daa22135ecc6
SHA1fb3f35135978e2dd5961d954ac626ab140a72191
SHA256b7fc67e1995191d39f65a2e62ae0d36384119ae80ad2067f2779fe2a9225a8ad
SHA512befb959f82a5ed3cd53391b36fe4c11d5476cede3829067395c8c1142428b6d8eaa37428da259857a3905dd1af8f4456a96f2556abbaf4770691b8d65681a943
-
Filesize
852KB
MD5cfa5d527730ee4d8b1b669b23666228a
SHA1e422482a3c356052724ca8915f7d93336cad5acc
SHA256e37e66e3dae25acd5420422ab3769c4aeb31e376580c06d0abc1fd9ef5986427
SHA512456e8da8177c52a270690803f8c3104c027ebc0ea943261e8055e4edfc2da03b9994eb6ae9dac2e8018f270cd09a624b51320f94e79e1689dffdab8650d9ca5c
-
Filesize
1.1MB
MD523a21dde2751905f3f8626509fe74b59
SHA1407046aef6302e9cb04d480494efc33209035a2f
SHA256a66b7cba98e8cf869ea96bcb80ae26aede155681ddaa8a5ad108db9097fa521e
SHA512be1625898a4ac827d9b1f5ffa1caa81fb9790295cf6c442d890558a04f5c41c9eeaed4487ecf61cd5d2c64d557d688770b2bf2cf6aff8ccda180b4af5962aeba
-
Filesize
990KB
MD5ab2fe04d17d2181464db741be63af48a
SHA152f04d3b4b0ecc8435155b46b58b835e96f9a977
SHA2567d4d9d990e6de2cbfa1c0c629c320b721c6bb52ec7150d3d9332f6c01517ce50
SHA512af7d89fb30f3f3d608907a539fe2b5946002a5b67a8108c0fd8a25fbb079c2fcae22d443b2527b03190ca08691e6b8a8e6fb0e3555724da1e8ea19f685ffb1eb
-
Filesize
460KB
MD55685c8acaf3e6e2bd06cd2e933afc5b7
SHA1c935585e868f6196b0c4501f1091910a7d331c1d
SHA2563b466822117e85e2b3701b45c500447754c298b11234230688ad6ae9e87e7377
SHA512b3255ca9971c3b630130ef40460d48c0078e0ffef42f55d7354997183cb1dd2be751fe830f073bcf8dd3603fab736ffdc5a3642368d3d6a56d2d71093e82150b
-
Filesize
713KB
MD5687766605caf1a3ef037a091e312484e
SHA1e6ec258329c7f28606b8861554aba32eedc159c3
SHA256fad80ba6330f25cceafd0c3aa761aeba653dda35c077b28aa4d446f8efb0cfd2
SHA512f85c7a8dd88c6a88fa5f19a541292c128f4cfb5698a00cdd6faf89a5c803a9a00718d960e83917fa5e06551c483c24e30d0e97f431f80afe382d8a1f8ed27e40
-
Filesize
437KB
MD5e6b0da2f2c5e1a9dcf08c7ec199092a1
SHA1e2362b5f1bccd1cec7124d9175165ebe2d029542
SHA2560ba323e30e35880188f13b7e748d748b10eb2dc9eaa1bf74cc44d49bf201738b
SHA512cc523899cfbb94d2ea214467ff349c5005eb04cfc91f1c996c00a313f3c1c68f70cb5bd85cef0fae3564aedff2fafdaa7882f29431d3569d8b4343f77e9546a4
-
Filesize
2KB
MD54976656c16006813871ecbdba12abbae
SHA16211e11fcb29a2f2828bf4f5f7138db8c9862042
SHA2565056cced2460b6ce4939b26955bc8a61b47e6d86b1a0de5bb2ac29d5633d99a5
SHA512cb7855f68c52d9ada8bb7f84214b86e649538bccf5a1dc7146f8b9f7b4bf95de3e77363dfb89e8dba877f64bed9d9769692ea1211f967a1691eff3760a9cf5a2
-
Filesize
1000B
MD526c592d15a8a5a59ee44865f8e8ca71e
SHA156aac192d22aabccfb98c6ad48a1c9df2dcaebb4
SHA256a20edcfbae29d597ff9cc614c1bd7b7ac50643fe3617bb5b8bf18fac6bfb0da7
SHA5126f0dc69232e605737f8c6d9018b493648f6c31329167461ae43196e58f8841333aa0078f9720df8c66c6f360ff88413f538d1824520db2db5f58008238411fb5
-
Filesize
2KB
MD59197e3c727eea8538be7f3490eea2430
SHA1764fd15c20bad754189692505fd176949b2dde17
SHA2562e0d78bf6f02f2bf1ffef3cc8b6046686d19ecb57c639a6d17b3b20305bf95c5
SHA5120a998d2da6587e8165867f77b6c02b3db53c5345d087ff740ac665146b7b5e8855046ffc1103abb7cb8ff95cd40608c20d9e1fff4b4059d66511f1bde8d44bf6
-
Filesize
923B
MD537d9df5546b45b669b2cb198edc66537
SHA103bb32220c7dec89f483ca45bb708461c3e251fa
SHA256296f63a8c85b21236b5d9bab59c1b35dbf1ffd8648aa159b8824c27d0fe8e1f7
SHA5125b24d8b53ac5d1f400027b157048d2e2eb63629c7c4e711c8547e036e152e7a17728d0e7bdee495b398ea9d89ca8130e11742961509a4e8b189b8f703cd04f0f