Analysis
-
max time kernel
129s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system -
submitted
05-02-2025 18:26
Behavioral task
behavioral1
Sample
IDA Professional 9.0.7z
Resource
win10v2004-20250129-en
General
-
Target
IDA Professional 9.0.7z
-
Size
353.1MB
-
MD5
1b15082e880eab231a9f898c6de91192
-
SHA1
f5e361702ea1151a41b9ad1a7e4e31394cb68051
-
SHA256
cb3e2b8078d1a04b7c4a508971fcd98a3a5ab57fe3d203f60e8a62121d7dcac5
-
SHA512
7b42baf3b02fd3a6032003ba5fc30e65776427938983444628be5ae98fe82aa8f35a1178e7ed8b180787b46478e569aef6123caa7a8652761a7228c2f28e9ca7
-
SSDEEP
6291456:x/GYZAq+Jos/sy9A1O1u14vthMe38cwurYZw4mRqoX4kFayt+cORNaMDMEhvajLx:h3w/u1O1uCHMaT7YZwtJXY7cSo6hSjt
Malware Config
Signatures
-
Industroyer 1 IoCs
Contains code associated with parsing industroyer's configuration file.
resource yara_rule behavioral1/files/0x0007000000024037-2120.dat win_industroyer_w4 -
Industroyer family
-
Executes dropped EXE 1 IoCs
pid Process 576 ida.exe -
Loads dropped DLL 64 IoCs
pid Process 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe -
Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\explorer.exe.nam ida.exe File created C:\Windows\explorer.exe.id2 ida.exe File created C:\Windows\explorer.exe.til ida.exe File created C:\Windows\explorer.exe.id0 ida.exe File created C:\Windows\explorer.exe.id1 ida.exe File created C:\Windows\explorer.exe.nam ida.exe File opened for modification C:\Windows\explorer.exe.id2 ida.exe File opened for modification C:\Windows\explorer.exe ida.exe File opened for modification C:\Windows\explorer.exe.id0 ida.exe File opened for modification C:\Windows\explorer.exe.id1 ida.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 61 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\MRUListEx = 00000000ffffffff ida.exe Set value (str) \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic" ida.exe Set value (int) \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" ida.exe Key created \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} ida.exe Key created \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\1 ida.exe Set value (str) \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" ida.exe Set value (data) \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\0\MRUListEx = 00000000ffffffff ida.exe Key created \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg ida.exe Key created \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5 ida.exe Key created \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000_Classes\Local Settings ida.exe Set value (int) \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\0\0\NodeSlot = "4" ida.exe Set value (data) \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 ida.exe Set value (data) \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\0 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000 ida.exe Key created \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} ida.exe Set value (data) \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 ida.exe Set value (int) \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" ida.exe Set value (data) \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 ida.exe Set value (int) \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" ida.exe Set value (int) \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" ida.exe Set value (data) \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\1 = 19002f433a5c000000000000000000000000000000000000000000 ida.exe Key created \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell ida.exe Set value (int) \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" ida.exe Set value (int) \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" ida.exe Set value (str) \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" ida.exe Key created \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\0 ida.exe Set value (data) \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\0\0 = 7400310000000000465a891a100049444150524f7e312e3000005a0009000400efbe455a3094455a34942e000000622a0200000002000000000000000000000000000000624d49004900440041002000500072006f00660065007300730069006f006e0061006c00200039002e00300000001a000000 ida.exe Key created \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4 ida.exe Set value (int) \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" ida.exe Key created \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\1\0 ida.exe Set value (data) \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\1\0\MRUListEx = ffffffff ida.exe Key created \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg ida.exe Key created \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\0\0 ida.exe Key created \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags ida.exe Key created \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ ida.exe Set value (int) \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" ida.exe Set value (int) \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" ida.exe Set value (data) \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202 ida.exe Set value (data) \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202 ida.exe Set value (data) \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 ida.exe Set value (int) \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" ida.exe Key created \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3 ida.exe Set value (data) \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202 ida.exe Set value (int) \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" ida.exe Set value (int) \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" ida.exe Set value (str) \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\SniffedFolderType = "Generic" ida.exe Set value (int) \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" ida.exe Set value (data) \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\1\0 = 5600310000000000455a4e94100057696e646f777300400009000400efbe874f7748455a4e942e000000000600000000010000000000000000000000000000007c6f7700570069006e0064006f0077007300000016000000 ida.exe Set value (data) \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\1\MRUListEx = 00000000ffffffff ida.exe Key created \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU ida.exe Set value (data) \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 000000000100000002000000ffffffff ida.exe Set value (data) \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\0\0\MRUListEx = ffffffff ida.exe Key created \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell ida.exe Set value (data) \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 ida.exe Set value (data) \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 03000000000000000100000002000000ffffffff ida.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ ida.exe Set value (int) \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\1\0\NodeSlot = "5" ida.exe Set value (int) \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" ida.exe Key created \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell ida.exe Set value (data) \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\MRUListEx = 0100000000000000ffffffff ida.exe Set value (int) \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" ida.exe Set value (int) \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" ida.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 576 ida.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2592 7zFM.exe 576 ida.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeRestorePrivilege 2592 7zFM.exe Token: 35 2592 7zFM.exe Token: SeSecurityPrivilege 2592 7zFM.exe Token: 33 2928 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2928 AUDIODG.EXE Token: SeDebugPrivilege 576 ida.exe Token: SeDebugPrivilege 576 ida.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2592 7zFM.exe 2592 7zFM.exe 576 ida.exe -
Suspicious use of SetWindowsHookEx 16 IoCs
pid Process 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe 576 ida.exe
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\IDA Professional 9.0.7z"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2592
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4960
-
C:\Users\Admin\Desktop\IDA Professional 9.0\ida.exe"C:\Users\Admin\Desktop\IDA Professional 9.0\ida.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:576
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2c8 0x2f41⤵
- Suspicious use of AdjustPrivilegeToken
PID:2928
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zE02A22E28\IDA Professional 9.0\plugins\ida_feeds\view\__init__.py
Filesize15B
MD54a71c8cdf8acd75a540cd6a4e99cedf6
SHA1552c9dbe889b6957bc94713a73cf62ffe04f9707
SHA2567376a37be5e4c2b241345d8d667055d92323dbc2791761dae58f3a2706cf95c7
SHA5122ca08dec2697f2d330b555466d9587c98272e831d2d852ae714fb95dd8b9fd5f8793ae239622dbea7cfa0c247cc9e4c33005fbcd92971a009d99c31fbf26f480
-
Filesize
2KB
MD5659c59af4841ab542bc5ae43abe187c9
SHA1838206246c95a4b673408c78fc6b294246d53913
SHA256618cdf56d2935c762f32b9c73e5e998ddc471f5f70c4c5a980dc22386e898279
SHA512e88d5cba70a86aee598d14305eb92baa9f22ba3f0c06ef108334f663413ab54c8a6dd9e57b13a31834a8e80cb86e455a97bfa806a1697ea39a639dca79be4aa6
-
C:\Users\Admin\AppData\Local\Temp\7zE02A22E28\IDA Professional 9.0\python\PyQt5\uic\port_v2\__init__.py
Filesize548B
MD571014d6369472d3184315f736d945afc
SHA1375858f197d1403c191670a3151ea51329ee75cd
SHA25632bd356bf7687853a140d02a5c9df551bce86656ea6cc587161887be57dc0edc
SHA512be351c9c6ddbfc23dc0bc1791321c066d250ade7ecb393e4b17ea9357810db368065ef601e7d469031cdac710bda8e824d55c7a32403d269084aed93ee4f9e6d
-
Filesize
5.4MB
MD5d8666b3b2317de24795c2c7072a32f22
SHA103a433b684a4b5f2a5967445a1f9e9d94929af07
SHA256a1421a4292f3f6d6a3c533f287188b9208a917acd369cc1ecc26823bee282d3b
SHA512f179f6846fc8a72eb5023c9032b05fddfce26917f85766ad6fa06bbe6e9d5d23024a01a307f9fa996d3331caf8684cd0386f1e666775cff19929245578eb5c3a
-
Filesize
5.9MB
MD5fd80d43e803c146d0718b811e96ef21b
SHA12d53fc58d9e752b9577fe1e78ac117d9d0703469
SHA256695307903ccc11dd4972015bebb160b7f0ba414a95e8323e5788476e69e3f83c
SHA51201c8a7c1b5fe6d752e237837e448cde3d52888d3d3bc2185bbbdd11557b512f1175ff7c2d3260cea7c7600f6ff263c730d7149fea25f334817541782eb3c1c13
-
Filesize
6.6MB
MD5367ada59863dde5902ac813c765c718b
SHA11c30b98f93d5fcb49a15ae22ac9ab1792a0cbfa4
SHA2562b8df2fa3a3f75be898ad826e3698a562cd3cce71096ce0b0abf362be6ba57e2
SHA5127d57df5c3a9d7de2969074a4ef59cbca6d51fa84de1bc76d5fa4e633b6aeef9f00351ea1774b67ac3565ae6c48e18f0e561487c60027326defb166f3229db057
-
Filesize
309KB
MD54cd655f4d826e8437b0415aa6c8d6550
SHA17611161c774c7c72b189b420772d2c65e2634e4a
SHA2567b105ebf20c0b52259c00ff645f95f584bbe60b91c90de583785ac88b448e26d
SHA51282745e4139f72f6843d0f4b588c2744b60a405e398f158319ee336758c09abfbced2f0ecc4e0a6d3e535384a9cbe69f89935b11a9b5857cc8f7deec00f044c6d
-
Filesize
324KB
MD5f3cd456d5fb9685304dbb53cc7b9ebaa
SHA18eadfaf8b8e8df16fba9e1dcc36d0ab3eb6c9f42
SHA25662089b5a811c7c0cc408335dbafa0c7060cc9324c01595e011abd6ac2e868442
SHA51203c3c24a95042b5e4337f2e093d219ebe3a3a05b8a78a8029550f1470c51b4433a60ca7d1000e238a3bfed51b6e6b112788a0663ea6618b4d052214749b4035c
-
Filesize
5.3MB
MD58b786869feb36930f8d6fd7be98ced2c
SHA1f6fc979919df931af8fbeae54eff502663b2793c
SHA256af337b316a39107944bdeb117798fd8ce02c3307fb415a371b6bc431d470a3e5
SHA5129eaa2390abcceb7d69958be99c75dfd60edc464ea8018d3657a39846f40ecd6c6e48bfd750c48264047cff82b6aec398f63df5f70f0c95484a052913e845384a
-
Filesize
76KB
MD5a6ec833fc2f936cc9cf678413c670a72
SHA1a2b460ac23f390e8b58cc2220883473df5ae7486
SHA256b4459f8d591ce8ce38d64acefc9563e85cfe8cb91fe6f68b3a23cbf029547bba
SHA512f5e02a549fa57ca3d1aec7a8988513c8db5194e2f15174b980f480c37b3289f8ab1749d7ec68c1fc584fe243c0d95d2cca8bfa275f6bb3888a5dd65c39359955
-
Filesize
718KB
MD58485b66af11c7a0985636e2d45e7597a
SHA1862975bbdf036552d30801836de51784c8b7bd1d
SHA256a99c59800e7f552a636c8402de52b00b8de00ae4abc9af404650a043a7656be9
SHA5129cfbd5f40e83cbac8312003d73448657058ffa5a7fd492a05b469f3a7a3a1a8d66bac638a238ecfa0c149c76c15f2acd73fc609449c47125113bbfc8c2dfd9ef
-
Filesize
4.5MB
MD5841ad6f0752199fbb3e1f0bed7762f62
SHA1cdb78c1fb416dd02d8e331c097be547573e75243
SHA25693b3014077366c1a4de5a1043a2775d66bc10d00af259b75d630e3393877ad6b
SHA512e404d15f3cdd0854a83cd5b46f714c6a5084755623cb084a5b33b36d883fd250395d0410d45b5c871a69898bb18fb24563812e6f218a9ab25047f92b78ef44e1
-
Filesize
4.5MB
MD51f65e3ff946510525a32e5d72b1abbf7
SHA14b6b8d97aa8138b6f2bdd987e8cc3b444d58aeac
SHA2569540cfe753fb5b98ebd9c54baea68834231a83844848076df07c16e95d306180
SHA512cb0a3f29b6f7cd879f376ee90671aa9272b6cb58d76de3d7e9887f447214f4f6dfa7214230e1ad14e2939a847c0e7f365771054894b12f67944a56c6fa6615ec
-
Filesize
1015KB
MD5ea40ecdc43c8c006c97329ca4e4a236e
SHA13216379aa883d5551c0600aa648964cdf49ba336
SHA256e57e9ebb7bef4a46789fc8d775f3efa55a16f9e638f3fe03bdeb9ad3a71b2386
SHA512a11ba7670793fbf9e509ca7ab90a3206cca8794b3b8ea6cbe8862a4f6d75246dd1d9c77b0afeed563112254ab7cf83c3182e82861434a12243e4e6499566c3a9
-
Filesize
2KB
MD5f579b3ce020c8b1913819562adbfdc82
SHA1325c78ff7a8a56e4337e65d563cedac09c16be61
SHA25635325dc0914aa18c4f5d7bff456980876020ac2d5543699e4afddd1550284411
SHA5120f275d9ba5cf5f9654fb0dcb2d4ac485b157cb224e647a8f535fa7554b5bc1df9564360c5a630528060102a86352f81ca44b93e8aaea765575edfffe19f7efd9
-
Filesize
311KB
MD5805b25bb68ab59fdd0dcf808ae41ad88
SHA1e0b064babcf4ad826be7edc18021b94328dddaae
SHA2568dc5b8591bbbac05c02a5ca3b3786f8a6492a9d9033643ff86a8ceefc9616944
SHA5121de05f21dc05010878aa6633340514ddb5ca123203131bc9a6e9c2a87106f79decb1693c7fe645bb3b473f3f5967a0d94e6bff17294a5f22b884cf39f4762ee8
-
Filesize
181KB
MD51cceb01bdc38bb4012b594b30f63b421
SHA1e26761be256aa36fc355a7eca9fb546f110cbabe
SHA256ac23e37be819f3ca4af3dba570f17c57fe132abe500a37536963778fab787641
SHA51285f5ec0c2f5d3ec345476a43f3a15103d5e1426818e3ddaa708db33f98a1136877dfe5e6862943c914ddcc72afd5a2fd099cd2f4d84f0ed2937de9effa008ebd
-
Filesize
134KB
MD5fecb71cdf56dfa51bbf250fa80c0b866
SHA16e1d8a92595ebe2d3a9518cba000be85b396d959
SHA2560a094e451aa0be75caaee5e2e9771ef2c6d19d61fdcc3618eb4e3524e4eaf4c8
SHA5125c66cfa1f99ceac12d605857b8aa26e833767e9d71c44ae32340b8dc290f26fba0871ec4c32cc4567e64937ce598e32ba1debb9749e01e3ca3ae41b1c3145a94
-
Filesize
20KB
MD5859aa6cc652fface51bafcce57f800d3
SHA142b4033b0eb8cda96b8e8280afede3a41eb5de80
SHA256f758beca47f559a38692b0ad1b33bbc76245a3cb600026f789d0534cecc7ae8d
SHA512b9543fd40fdc6aa30b2593689ce86a2da98d36186d26d9b241b9df529faddc7eeda9a7e15195441eeb7ea1da1b9cd3b0472ae9837c3f9c6d6ff5f0e549579edc
-
Filesize
300KB
MD56c4ab8e939dcd454eff73feec8fa738f
SHA19f30bf63684584baba4e26b730bbe70586f08717
SHA2563739b0ca22084b74d8018cd7baae34cf0c58a4cacba76f1af577185819a15246
SHA5124fcdeec28a845275a1209539871d9352e03deeb459e44d802bc06eadd16e81984654c0bed691a71490f14d78d285e353048c733d04080bd9305f37cf91c2c33b
-
Filesize
12KB
MD5d29f77513d0e135cdf0c7f2d388ba7f9
SHA10d94ed69b515db48a7cd59c276b639d4de2b5cb5
SHA25604dcc1205cc71db448536cf9be411f3a125769a29fffc2676400b908c7b77629
SHA512a5c13c6dc82b33525144e379f8ca9a77f79462978b27d646dab9fe63f2337b03ea1548ff8ddd097fce538475da5f7bdd1fcc7b4eaaf55e5034872d58384fb8e7
-
Filesize
27KB
MD5edb32add634383633ee23ac194dda717
SHA11e72c5a85b9c9dddc6ebe7d2b27e3e1a4d68ca58
SHA256f49f033982741f63cae3e8c959b10c00cd8f59a696dfd3461b77da8375a40c80
SHA51268e07ff7e8926185bcd031684e5225cf2f73cbc73800d40fa62e43356c018835e389f07495e08f39734cb64c674ca0c9d085fe4775a9d3e66ff381480159de8b
-
Filesize
365KB
MD5b9542b300c03397af0ec733089386d61
SHA14613701a94d4e246293a7b639486064956425f11
SHA2563b1497f9b572bcbcb5ddf201ba9d669a8a4989621db7e4ef505aaac0ed64ddc9
SHA5122a7631ce3359dca590566998e6d32e4efb2314b4339206b6b22ce363adecff7ef010fe379cb3bf3ee8549f7e6c11da830f6aebe946c03311e6eadc511fdfead0
-
Filesize
65KB
MD5ebb2e1ecfdea15ccca4d4c29162fb1e4
SHA150b5e091a65a7b898659b92c01544874da069c65
SHA2565dc96ae712fa474b526c36d0c64a59184aa21787bb929348e513dc053fa02e1a
SHA5127e35994b6f837926f3959bcf5f56bb0a7c7832e2de21dbfbda44d30804a13bcba62afe84d33fd775175cb7bf0fc4f995b7e2744d81dc66c438a7db98ec95cb20
-
Filesize
90KB
MD54d061b3411051574039f3dbb13b5ec46
SHA14a5a4e1edbe41856a1082acc45944bd138b4871f
SHA256ef1a4bf2a3d1e65e1108ceb4e9dde6f4fdc47fbfa7314e0608b9edb0e5dcc58a
SHA5121384da78a772fe1e41916a8d0c2d8b2fb5276cbab01afe2402c66ba68d49e25ad66a6bce3be3db9c6e1901591dcbd62fbf99cd97a5296845e43fc3e2137efa11
-
Filesize
553KB
MD5553d32a546f97c7fef4a037475825868
SHA1de6836c14bd14c6f3a1cc24819c9ffc18cdc4025
SHA256eb62e320b20bea05644cf451279831c80eb89b4cb54cc8bfd4f18da1f235522b
SHA5127ccb80b6edc09a77e918b63beaa486db6449ef8d1daa02960a8f3c93356ac334091cf2eb40c648fe5874acfffcb500c959132253a18b170045149530b78cf881
-
Filesize
424KB
MD537e40dc1bd586a89a14fff56aa56a599
SHA13640ce94215f780868d3fdfc98dce715668e9f0e
SHA25647b1cd6f522e28c746027a9e70061d1d18cb0694e1d9762510c79db11b9cf868
SHA5128186f38b2aa1c5b152709fc8175609b2c3cc41b198b842753e0ed3bf46c1769df16e6808ae089ee3782fd4ed13eaf910137d7476bef408652b054f9cc5083153
-
Filesize
145KB
MD5f0f9f59a4958291add18ac00abd878fe
SHA1bfe39e9c5976a19289e5866a3f73e0d8cfb07794
SHA256c325a91d7729b8ba25ce7d3f43499c90ae7782d09b7738cf99fb62fc9f534211
SHA51209ad3e626286fd88903158498ae49c4863dd54441e97ed6494842d1db3e9e7bc69638fb516b2fe66cfc1bfef4995b8b28a7f92b2003f060f855cbf9539eb663d
-
Filesize
278KB
MD594ee61ea9b785084007bc612adfc7df0
SHA170c8821f6fa3a58896cb238c1d29e24de7cfcfd6
SHA256ed2c682b7fda7af9a3cb9fe8936670f7995e94d2b880739b19c73668c2934189
SHA5129882ca3621a6c32a899b92d9da7834edace597662cdad18615e313166fc7734bb653a72cb7ea603e778ee730e275aef2d3bf98681414e2f5483a4d8ab2518a6e
-
Filesize
35KB
MD5ed973fa567bc9c2b14ce5be86679f08b
SHA131f66ade30fddb3be4bed51bec2358f52acedd03
SHA2562766cf3d89a52b10b8b3432b3a0b991a9a4b36a127bf00ee7cde995a50c46fb0
SHA5124392c9d8a941e7a4d99f76a7f4572da43808141e57c3cc09df32740c6cd947e58de74a2db8b2ce9923b11ffa961fa1eb792b830ada5d797ae0ea7e746668fda1
-
Filesize
124B
MD5030598a6e04e7f04a3c65e1bb90cf862
SHA1f303c40e17e134616674c0b757086049ea70e13e
SHA256d5c65f1c79b034b09946b7e2ecdef844b3e51ccf6b505ef4865a51204278383f
SHA512edc0f623b99bd06536df25d7ffd28aeaefc8b338fb9094d1f3bd44de0600c957a82fd7c2d26be7174919918e9235b5bc9a0025c5ab131d0e2830f9984c2b49b5
-
Filesize
32KB
MD569c91874901919939fd596b09ca4885c
SHA15d328548b7457d4a60ebfa0b1baefacded626db3
SHA2562580357f70041ba91a0da045e74bba8909bb1bbcd85e65c941bdc0ea38176bba
SHA5127ede554c246d000e7e3a793cfb4319c9877d9e3a49eff81ca47e44df4f3ffa120ac7a34b15c8e4fe1229616934cb1042e621f53ce5016b36567be4c8ab6af153
-
Filesize
405KB
MD52755b62dcd497e2b2caea16e49c231b4
SHA1930d1432c58ea717d058369a63f4e49998af8b29
SHA256ac85edeacd9d45beb81101c47120c3828d8d62b5d19dbda926466efc18e14261
SHA5121df860d2a95e205f916c0005405cebac3b9c779abb7e748688ec14cd21cc2e49e31db46d53b03c131b9d1ba687de77d1876a5044ba4e4b80a875ce4d3e48d5ec
-
Filesize
25KB
MD510be44153141b7f342a98371464e9327
SHA16d2b21d0a28382d85a1872ca964c0693a3caff0d
SHA2569cc9cfb7db2cbd70e199c32456186e7ded266fe30e450207387494101a44a99b
SHA51205c615b9866c63bf56270e844f83d0feb6483b38bdb1f6ad0b3f56070c6b29a118bf78711f9256d3b1c5ee20292d88332f00b89ec9a6e943ba2c80f108385f63
-
Filesize
1.4MB
MD5d806c1f1e1ae1f2a4481d15d57035d19
SHA1bd3b915558020550736946de5c06cb635a706a0c
SHA25649f621f2e5a8b3907099ec0ecc65f3519a5105b8446d7ac451a0ad7359fb7d22
SHA5128df43f5da8dbf6961b2f592e2a1fb2b5ee279b44129a6f732e932d00e41eb7ffd083e5013a33860a791a769282011d23e86196e0a85a207b46afe2d7ed07a341
-
Filesize
5KB
MD5924f9a5a43200018262ee034d1432c43
SHA1d3903d0f6a8a4f8d6a71af51c61bfd8ed86ff3f1
SHA256e9bc059a7e7b801b4514df206329e54190cc70de66057df1607b9fe54678792a
SHA51201d817b5fff3905e88b9345478642b52b3c6d7815421ad2b3045ecc5012a22664fc2c09991491bdffe752ade9d641b6163b3a8c4e01785a1283421dba91dc56f
-
Filesize
136KB
MD532e85e3303bb5675747fef26fc744089
SHA1f5b5a1c9834a244ca73368c3ffda1e7aeed1dd04
SHA256b7bb8a6ce946cd9fd74644aac3152ee8130875201ff174662a7f5fc28d1588ef
SHA512413c5cec9a198bc43769fa33da7843ebfa4e73d676132d08c8ba076c37477c2c4cdb2cf2ef73905bb805d5348577e61187bae6ef61227c104703f00a193e99f0
-
Filesize
212B
MD5b94a2770e638de7b863b8edf907e9b1b
SHA17ffa722fc4db9b413f9a2364ce8dfd4afcf678de
SHA2562b946593df3a65ab7d2bc4d5ab26606a829260de2b2441299e1bbcebc33f4722
SHA512fad27a4cf44b45e39fa2d03a5fd9ebb8c4119ee00d3d0b58cc712492a3b5d1fac31cfd02480b7e2249eddb9a3cf873c1fa84c531242d00266df69e7dcd15fa44
-
Filesize
37KB
MD5f0f4720c44329562b51c001afd160631
SHA13fb9456734ec3bbfd443cb026b423f91007e2ab7
SHA2566281896174b57dbc20660d94798642a6a0ce73c00ccedb2df01e160b0dfd2055
SHA512f6fd38bb6976119557833cd0c4583acaa100a1d4c59b23e4714f1eb837115516a244eab46d9dca759b4768e3912beeb566dc147e5f94d45f18df8aa12d76d34c
-
Filesize
9KB
MD56bc29f8e1d3d7619680d7a9f7c602f11
SHA158e9fff92595fe743468d5e11fe68a76949af83e
SHA256658b5a16e75bfa8cbb8da350fabbc2b34524a99072dead9c715b79277f14e324
SHA5123d2e811841a7321e0df53fdcd416896e64c8098acd0e6ab24e5c281faf1bd837f4a6575f7f89dbc02505f311552a93d4c871d619cddbc78e93e1c6aece86a2a6
-
Filesize
16KB
MD5cc64769cac3bf5752d58e6683d6bd581
SHA1c45fe8a1c32343dedab5df71c17be8210762768d
SHA256bdc2d88816dc006ce36dc4633946ccd5e00676ff57a19f9262fff85724568a7f
SHA512253124f1e21f5b3f50ea71c2305c05b63a888c86029885a83e506e579f8d05b52d9c2882a6011bbf2553765a6b126ab42ddb592986c5288431af777453829fc1
-
Filesize
16KB
MD5404220e28dc0873e753bd230e316dbfe
SHA176e5b250c1e4949a330b5c843e35fd87c1cb8c1b
SHA256cfe656a0c8f075b74f5d186e7b619f0434768140fd7086e162ab2f46331532e1
SHA512165377d53c27a457562d593b897f20733dbe27a1392c45d95e9168bc01783035fd35737f6b1a8fb3b249c545225f2cb011dc6c92ef6259e41243e791adc808d6