Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
17/12/2024, 18:17
General
-
Target
XtasyExecutor.exe
-
Size
202KB
-
MD5
20bd0480bb862bd1d073477a87aede81
-
SHA1
3c7c72fc3c1bec023386ac6ed14ad5cb785fe4ce
-
SHA256
548529c38438f4a9aea915448e183f24d4ddbe793a86090075775a154d59f067
-
SHA512
6b4817a7921bb62bbaf6835a3948a1811914f652f5f6ad86fe0b52376b6347d180488c3de4f02ba8ec962c45c5b4d6ad91eba11441989bbb42dab2863dfaa766
-
SSDEEP
6144:gLV6Bta6dtJmakIM5E/hBp4OnvF3ZO2hdi:gLV6BtpmkJBprnvF3AWi
Malware Config
Signatures
-
Nanocore family
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\IMAP Manager = "C:\\Program Files (x86)\\IMAP Manager\\imapmgr.exe" XtasyExecutor.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA XtasyExecutor.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\IMAP Manager\imapmgr.exe XtasyExecutor.exe File opened for modification C:\Program Files (x86)\IMAP Manager\imapmgr.exe XtasyExecutor.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XtasyExecutor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe -
Modifies registry class 39 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\HotKey = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\FFlags = "1092616193" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags explorer.exe Key created \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupByDirection = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f80cb859f6720028040b29b5540cc05aab60000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\Mode = "6" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\FFlags = "1092616209" explorer.exe Key created \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WFlags = "0" explorer.exe Key created \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668} explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\LogicalViewMode = "2" explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2499603254-3415597248-1508446358-1000\{1C34E2DC-6180-4682-8D6F-DA06B944AF7D} explorer.exe Key created \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupByKey:FMTID = "{30C8EEF4-A832-41E2-AB32-E3C3CA28FD29}" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupByKey:PID = "2" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupView = "4294967295" explorer.exe Key created \Registry\User\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\NotificationData explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\Vid = "{65F125E5-7BE1-4810-BA9D-D271C8432CE3}" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\IconSize = "48" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\NodeSlot = "1" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\Rev = "0" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\Sort = 0000000000000000000000000000000002000000f4eec83032a8e241ab32e3c3ca28fd29030000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\ShowCmd = "1" explorer.exe -
Modifies registry key 1 TTPs 1 IoCs
pid Process 808 reg.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 1176 explorer.exe 1176 explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1028 XtasyExecutor.exe 1028 XtasyExecutor.exe 1028 XtasyExecutor.exe 1028 XtasyExecutor.exe 1028 XtasyExecutor.exe 1028 XtasyExecutor.exe 1028 XtasyExecutor.exe 1028 XtasyExecutor.exe 1028 XtasyExecutor.exe 1028 XtasyExecutor.exe 1028 XtasyExecutor.exe 1028 XtasyExecutor.exe 1028 XtasyExecutor.exe 1028 XtasyExecutor.exe 1028 XtasyExecutor.exe 1028 XtasyExecutor.exe 1028 XtasyExecutor.exe 1028 XtasyExecutor.exe 1028 XtasyExecutor.exe 1028 XtasyExecutor.exe 1028 XtasyExecutor.exe 1028 XtasyExecutor.exe 1028 XtasyExecutor.exe 1028 XtasyExecutor.exe 1028 XtasyExecutor.exe 1028 XtasyExecutor.exe 1028 XtasyExecutor.exe 1028 XtasyExecutor.exe 1028 XtasyExecutor.exe 1028 XtasyExecutor.exe 1028 XtasyExecutor.exe 1028 XtasyExecutor.exe 1028 XtasyExecutor.exe 1028 XtasyExecutor.exe 1028 XtasyExecutor.exe 1028 XtasyExecutor.exe 1028 XtasyExecutor.exe 1028 XtasyExecutor.exe 1028 XtasyExecutor.exe 1028 XtasyExecutor.exe 1028 XtasyExecutor.exe 1028 XtasyExecutor.exe 1028 XtasyExecutor.exe 1028 XtasyExecutor.exe 1028 XtasyExecutor.exe 1028 XtasyExecutor.exe 1028 XtasyExecutor.exe 1028 XtasyExecutor.exe 1028 XtasyExecutor.exe 1028 XtasyExecutor.exe 1028 XtasyExecutor.exe 1028 XtasyExecutor.exe 1028 XtasyExecutor.exe 1028 XtasyExecutor.exe 1028 XtasyExecutor.exe 1028 XtasyExecutor.exe 1028 XtasyExecutor.exe 1028 XtasyExecutor.exe 1028 XtasyExecutor.exe 1028 XtasyExecutor.exe 1028 XtasyExecutor.exe 1028 XtasyExecutor.exe 1028 XtasyExecutor.exe 1028 XtasyExecutor.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1028 XtasyExecutor.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1028 XtasyExecutor.exe Token: SeShutdownPrivilege 1576 explorer.exe Token: SeCreatePagefilePrivilege 1576 explorer.exe Token: SeShutdownPrivilege 1576 explorer.exe Token: SeCreatePagefilePrivilege 1576 explorer.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1576 explorer.exe 1576 explorer.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 1576 explorer.exe 1576 explorer.exe 1576 explorer.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 1028 XtasyExecutor.exe 1028 XtasyExecutor.exe 1176 explorer.exe 1176 explorer.exe 1176 explorer.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1028 wrote to memory of 3872 1028 XtasyExecutor.exe 79 PID 1028 wrote to memory of 3872 1028 XtasyExecutor.exe 79 PID 1028 wrote to memory of 3872 1028 XtasyExecutor.exe 79 PID 3872 wrote to memory of 808 3872 cmd.exe 81 PID 3872 wrote to memory of 808 3872 cmd.exe 81 PID 3872 wrote to memory of 808 3872 cmd.exe 81 PID 1028 wrote to memory of 3600 1028 XtasyExecutor.exe 84 PID 1028 wrote to memory of 3600 1028 XtasyExecutor.exe 84 PID 1028 wrote to memory of 3600 1028 XtasyExecutor.exe 84 PID 1028 wrote to memory of 568 1028 XtasyExecutor.exe 85 PID 1028 wrote to memory of 568 1028 XtasyExecutor.exe 85 PID 1028 wrote to memory of 568 1028 XtasyExecutor.exe 85 PID 1028 wrote to memory of 2224 1028 XtasyExecutor.exe 90 PID 1028 wrote to memory of 2224 1028 XtasyExecutor.exe 90 PID 1028 wrote to memory of 2224 1028 XtasyExecutor.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\XtasyExecutor.exe"C:\Users\Admin\AppData\Local\Temp\XtasyExecutor.exe"1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Windows\SysWOW64\reg.exereg add hkcu\software\policies\microsoft\windows\currentversion\explorereaux3⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:808
-
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe"2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3600
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe"2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:568
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe"2⤵
- System Location Discovery: System Language Discovery
PID:2224
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1576
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{682159d9-c321-47ca-b3f1-30e36b2ec8b9} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1176
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding1⤵PID:2788
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {3eef301f-b596-4c0b-bd92-013beafce793} -Embedding1⤵PID:4360
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192B
MD5a78d1e7d52a6b603965039be25c6b405
SHA1b68d0d852c150df3d83d93a630c47de9f8c9cf67
SHA25681070efe4c3537abec99f5570c2725c3c7118a4c5160677a66b400699eef671d
SHA512d9ecd3afc3e9885a397988ce7fda4475d8f3d8b7494899b1114b25471f448457fe2945fd23bc645f52d6f50ce3c2744aea08d1673fcd7c387d02ae70e628f278
-
Filesize
669KB
MD5f6608982f4bcea26def4889c97a9f282
SHA1180890b4672a07241fd0712ee41c6438f4652b17
SHA25633c630a6a139208bae2093f326b4df3b13118322e784ef79442c45fb220d2c18
SHA512a85b3858ab602d4b2f97bc9a071f39c10c32014e91f331e8177dd5f33b75c0e5874906973cd4a9d8bd7d23af73843f81e694e7a55c28b315a3d7f84213b9f304
-
Filesize
452KB
MD5ad113e1919027132eadf8fcf4f569318
SHA1d32c9e38d671812de59c55deaa5140ffb916c4c4
SHA256f20690657517ead395aae4ff356a39abff6db3d3195b615cd3cd549995bf1408
SHA5129050552b9ddedcd76bbe551d6c0ffb6b4d680b544a34d16aad362760f9c0ee5ba6b17a296c1283e3b6ab9d4a99c004211c5d8430e16b437d6712807cbf8acaf0
-
Filesize
256KB
MD5f030030dccc59e3cae4020db43639638
SHA1d68aa583fdbfca70468593c15afff6b82b6bdbbd
SHA256e1d357fc8f9c5ab49774de44a8b19097dcaecf77c5615c3d970850fe6429172e
SHA512ef4f0bb1678e6c7e2aaf6b172fa0146060eee817fa723eb8d63725d61df96c38b17253a279d5d888d335c5192878c61e3a6fd3f13b583f4e30fc160f61e59161
-
Filesize
512KB
MD579a2b25dcbcb2c8a1a9358d66c3c0077
SHA143c7fc078de1f12b9054fc5050b98fc551a4f285
SHA2563e21eb5186251f170cb990672cc8ebff6016aac69c56ab40da1be389f4dcc646
SHA512dfb0ae7c634c2f4c0f3f85894d84c54cfa4e79be159b399197b170d4ecfea5c8f0cc55ac12fc42b5eb38d9b29762d3079b8352da0bf03c60769dfc3806302778
-
Filesize
393KB
MD5ce4c30ce464f68fbd151407c4046fd3f
SHA13a7ed11f52e8e29dbad0b9c6778d250dc5588674
SHA256b8f7ab73a706ac220849b33d87463a042b3fbc7c038fb5553fd98043c02780a8
SHA5129f9fcbebe0125744b84961167ea5723b597d201457b5a58ec4c223dba52158662dd9d283ecbd71c4e0ad392477ee4366b1847cf4dd3292b4cb0a2c944f8b1eb1
-
Filesize
354KB
MD5db96881ad7e94da58b87478000b8f233
SHA10e27a81ba95cf7f004e1f8d42371a800c527a251
SHA256b8b5468ce8300b03e1b7c7ba8824164b2f96f097a28ddcbd52d1b560122d24ce
SHA5129f57e37120cf880d71bfc676d630dfc030c2103f82a47593d2640f6ead02735ea6f70cdc05ec9f0110ea7e9f81b386c7f2baaf6b82b967d5389fee7a58e7d921
-
Filesize
551KB
MD5b994a9eb4b39dab371ce2648ce0dc039
SHA1497b7a7cb653f14d222dcdd080a83d7668cfb97f
SHA256c2b620e31a867c1fe34c2a76c11131406faa8ee3fbe5ff8e0c8e1748dadf8a6a
SHA512a06581468a90ff588f5d637c3142d51e72af40b05dc2113179b57f1d865ba5bb9c0d96639479c40ffbabb4d3a80e24ca824bb72c2d2718c3be1bc702253b7b67
-
Filesize
728KB
MD53fa25a9376a921f1d70222d555946658
SHA19eda24f2411d2ca9fe23b6df7a950c96b366109f
SHA2564ef7947bd094d8bf24b0b499a34f00445d6119af004aa87922e8048dbe577660
SHA5128eb6f7f5d890291715775a5598500e57c70ab89886cc766bd87d1606b7c21081188260aee14084edb0faa18bf61e52954524ca8866f67ef5690d351e0e0d425d
-
Filesize
295KB
MD58106450627e0544a053f432c41f89f34
SHA120f1528117793461129290b401b79a4a616c688f
SHA256b236b8b0c689ee15cce4d639779b538177fb84630fe632332eb11a712f6ea48d
SHA5126b225cc23d260f17eee44b32733ccb5d5c3b4c09809cf3635c36b6643290bdb0f9621362caa3e77412af0f09d573dc3d19e0b7c74b884ab77b1cbc6600f6472a
-
Filesize
571KB
MD5ae0d8645c864d86aee3a37ef0f8267d1
SHA15fc576caca52b3b2674d11c17701360006789e43
SHA25680fc66f3977be8ebd4e311a9cc9ab4a90d508fbbfc06b56928638a3eb908e70f
SHA512f225640a21a7c5b0053b3a2222f87ee6ac48e12e719010ae7704024a95122dd744eca874396bcaa47fc71f48b56ce78266f6c564ab5bf83c42b6c00e7bf94587
-
Filesize
334KB
MD5b945a643121cebe9bc8c96135bbdb6a7
SHA160fd11b60117f9f99408107458eccec93bfe88ba
SHA25680b9750f77bc32758e4ee639a92766024b5c008cded5b7c4c358a685be91c59d
SHA5129246cfa7e25644c2820d66d9b6834c7102e5bd767890e494043b4b09ca4a41db7959678b64b2a233aa5a36860f7d4bf008bde9e55dd8cda78cdf5010013ea56a
-
Filesize
1004KB
MD53a02bd32846ccd5689020d53b67463b7
SHA1b09417189605fc3c5a89366acd3c70309a7a7d54
SHA25613bd9df585a95bc2d1e22dc0b4f815a974fb704dc820cd478e49931b4e4f9ac4
SHA512ee7fdcaab894aadef8b5fd6f8642404e922037cf2fccf069dd133204d6927b58a045b8a0f08f31ac9c2f3f229995663bcdfd006467b48af66c66a27490568259
-
Filesize
531KB
MD5206a0d461dbb03d59a620cdfad0300a9
SHA16cb6324b7241ec28008272fb33c98cef45135600
SHA2564604a468718559b4132b2a606778011e5efc0c6686ae146cf7729d0cb1b1322d
SHA51215d439ac54ca005b22b0d1930e25ed5bb00191a4d648e3920794f82e7cd4f1bb2428719da7212cf4f639a6ae61100b3dedf8aeedbf2d3a931e15ca748ba1572c
-
Filesize
649KB
MD5614e6b3a46593e67dbdf59a540d045af
SHA1c33e37211e638ba79f015f1deafbdf43ca250b8e
SHA2567e805b2a7e3c3bde90691a2aa8ade4de06df666111389d34fbc9c9f1e2da7204
SHA512b2b240ee52f275c5d648bf2201edaab90693aa41fee7d6147255da3a197289a78be418271848e280a2f7da2b7ae7253893e83b562b2569b4ceb814e4440dea38
-
Filesize
374KB
MD546e13cc51a39623a2afd16254f83a152
SHA10711c8b143074c72daa51a69039be6811bdf7836
SHA256f6ec2aa41e7e659dce1e144319f6f3f4ed568db717f7e78afa20f0eb437a8a3e
SHA512cefb23ac1f1a4b164bba47a9d9f6e8343fc2282bdddd13a7430b1f40b2fc1b878b72d1f8235f1a2a2a5a1f2c68accd1a3ef8cb4b4ad40b15ba226aea86c2f6f3
-
Filesize
590KB
MD568522555a2944deb26cc5437745454a8
SHA1d9febdb4e228992a4d252826ce469f0c6d2c519a
SHA256a0cdf56c3622300aca57b935970ba0add97bd24c52890945dffe5a636af61811
SHA51292ce05266291152f24c81a24b1dc058be2383967e384ccac4afdf98a136a87dd49a280469926cefdcf20c2c49af2f4009f50aecd2aab1695167783fc96679f60
-
Filesize
433KB
MD5ab7090c4b9bd5f0476ce38fc69f1cf75
SHA19ef2b2f99056b64b63e790b937ba94ae9a48b37e
SHA256501e41036bdbe0b6e2208128a3b7bce604ee3574cf8d1f7f919e0fc1e9986c8e
SHA512af630341018e00e7abca4c345064d688e17e97d92e880cd448c3899c0ad995159024ea9e91423179e53e0dd0f01e7293a067808bc0b88ad08dafdfe527ef3dcd