Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
29/03/2024, 17:23
General
-
Target
2024-03-29_e652df60ac2fc31adabcda5fdf4f19c1_ryuk.exe
-
Size
940KB
-
MD5
e652df60ac2fc31adabcda5fdf4f19c1
-
SHA1
6db3a53692951cbe1d7286beb1eeee66cfd6b8cb
-
SHA256
f2443023f117626ab499b7451da15e21deac6f6a88112387f9764186687e056b
-
SHA512
39632d650e0052a190bd7bc39b8ec89a30a2d23d48a208174c531d678e11664249eac5fc834195ec673a279054de982612bcd6f634d7ebf647011d580b3da834
-
SSDEEP
12288:6ObfA4LWOsvAYFTaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:rbL3UTasqjnhMgeiCl7G0nehbGZpbD
Malware Config
Signatures
-
Executes dropped EXE 22 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 24 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 42 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-29_e652df60ac2fc31adabcda5fdf4f19c1_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-29_e652df60ac2fc31adabcda5fdf4f19c1_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD53c1078c1aeca132051a6589de8f1f429
SHA1e3ea44bd865edab9e675c9b987100c474db4f42f
SHA256ce00e952971cdc560e2318cda3a7dd639f7f6fcb9fabbde0e1ad72c307559812
SHA512d7b7ddb0b956cf26e77c23fcf7f1ec25467f3952961fe3c608ec75055cc33285365c663128974d596b84f7de337ccde7362b0c43574f40fb1a3515c85d7a269d
-
Filesize
781KB
MD590a0752a937bbb004905026262c7f86a
SHA1d8f42ac3fd647f690600d7add21643af43bcd069
SHA2569217f608c07a1a465d6ea017a4215148173d9d73808eeacfb96aa73c9ac718f4
SHA51282bea7babc6bec188d7e3d7ad07c7642ca14075b796f25ab10623e9366aef327114bf1e7c8b1dcdf63fc37bc99b6ea103a9a1bb81d3f19376a46250af80273e2
-
Filesize
1.1MB
MD5524e940d2c424fd3e33c9ce6d2803328
SHA144c07bac2c39976ae1df86c55967d747f676d5a5
SHA256acc54c78d8e81dbabdc322ead902b8ee9993344b7d9711ea0ed6ed0b78f75dc9
SHA512854199d66115b3283a2fa11f307cbc0fcc8ddf584537ac84cbc1843eded1a543bfab1067481bdf43a487b14daf253740f229da223f05b160bc0e2a4a0aa30f08
-
Filesize
1.5MB
MD5e6a4f8d5da3e65f109ce92fa95815247
SHA18720a2b7f130d7466d9ce21740a4997359966025
SHA25613713d367214215c73a22ef02288955f6d92d7c0b9a5a6bdeae4e28f528951f3
SHA512e86de883bc31dd86ec1b4ec5e5fe4ed8ccaf8dea40fb50c66c3d888dd45f5ceb94b2329c38db0f74b652b21e63dc09a1f0ce5e9ec434ac4db362f60f096610ff
-
Filesize
1.2MB
MD5b6706b431953d63aa1cc19d7ede4e633
SHA19cb6fe34af8cb3f61863d4df1fe9758c661145ec
SHA256fc47a617ed790352a238a4b9ce44942d7618d4bd1e173420b4df69ff7efcd64b
SHA5129afe9f1e4bfc062d340d7c182a410c997f71751683d0bd20c6c333c9e5bf10b2ed595d5542b802a9b4729bd6906ea13147b99b303209ca4685b496b32246f106
-
Filesize
582KB
MD513c7b81e9541d48e00f390d65ff5c647
SHA198e986341b61c286c838d88c349f138ab8019afb
SHA2560e527455fd852754a38a831fc6ce1518e135b78461a4067724aa878e77547606
SHA512bc6244ecf3a698480a94fd1013b6bef26d721849ecb787c59efe35b7d09af6ade056aea330aa869c06138d0aa9027c5010798ca45c8df29229e4bbfa54a56913
-
Filesize
840KB
MD570c9265a9772512ed43dea902b42385f
SHA1f30c2b569fd3a04c7a22d19e11b0d66458bfffa5
SHA2560f4344d94bfba927720a9cfaae9d5cde5deb810d5b631ab3390d4176fe4e759c
SHA512de96cbe1b3cdc04ba5b17b141d123b1661ea7ef4a8fac446443cc0561330ae3ab095c37161c728f2808da8868dcbb7a5eff4ee62dc1b6a6f081ae6897a828469
-
Filesize
4.6MB
MD541b03e1127583c991337e542faf6f1f3
SHA1c5c0f9c94ad67c2fce2477dc8f65866248b00ff0
SHA2568ee774a6684cc5f1adf7b1b7ec6ee31b334f9a7e9229c0b4dcdb5f5aedb0def4
SHA51212bac40fa5e7f6b3c2d89ddaa57e20816cc0875a93bc8c054fedbf0be91f776fccaf714ee22728b1c74453c20185be03cd40185e2caf96a11ce3f1695287b81c
-
Filesize
910KB
MD51f77bde5c807e89f707636ae518d53e5
SHA1b20289696b0bbacda7fd4521ca0f9dc9c0db7500
SHA2561d356f34c013dcdf965a7f00213650baf2a2df705929c93816e55215fd7ed804
SHA512c1ee71e9faa76b19335b445463202f5ae58e11a8530673ce5ca4389c46e2e3f931ada286e151cf59c4f85f2065902c76c85fe20378080d8dd5bde6d04ecf605d
-
Filesize
24.0MB
MD5f294d2570cbd05af4127aebbc0fcc63a
SHA146976686dc1475812e6e43592a88e1035ab23574
SHA2568a7ac859f8da19854b1235c29640c3f0fc476c81bb58b8619760966772db1b15
SHA5127d0b6419820ca452e06a9eec0ed24b4fd7b5b6e440860f77f16494243f819d6f29fd3db3e568b669fe669952b550a3796ba152e8d16dc8f94b6d7d7fd0e6e88d
-
Filesize
2.7MB
MD57f4b2f845f3beaea9ce6ecc510b8f5a6
SHA17c739475b92017e03e31f9be9eb32c9a911e4fa9
SHA2569eac4e8e479c09084a35a71670322f8fdb8b48a22006dff27775688b37527730
SHA512e57a489a9ae8a82d069b1a7c696a57e656dfc0ea7ed54503ce8e109fbe934be0f485ec526e84bcaa23440dd6c686dd147aaee45cf36278f94e38eba9e8d57812
-
Filesize
1.1MB
MD521d591453a055f7bf858a7f3d931c549
SHA1ebd10770c68f591d2e55d0c683fe03ec5518f40c
SHA256c3a50ad48370a730ac9fb1281f965cd7627a391613315f10ef943e3afcb83d51
SHA512dfdc82bd1b87c6eabb8d45413ceb4d9e803e41657ed858714d03ae6d528f38f0a4f48a3d7043b7b9aa4078f7b7f7106cf839605bda7f3274e5537305b2021722
-
Filesize
805KB
MD5de250a6ad31db708aa591ee85012088b
SHA110c5be292e564d2a685b875730ac408a50cdccb7
SHA2560ccbcee2ffcbe295e8217bc04785a86ce6a0f01eff633326690c9a88890178a9
SHA5129f6dbe5f99e958844eac3bb0787fbf47a908dfc6a65287130e8e692796a16419e97b41cc48e50157f9a43b5d5db8a8250f9af7cd887de1cd99755dc8a874777c
-
Filesize
656KB
MD58c9e2d2a4d75acf1f7beb67dc97cace0
SHA139939a5f2a61acf1a3dd08e301bf51f5cf820ac3
SHA256cee8b377d41b1396e42e658f89dfbe6db024fe841367c945651066f2e417d2cd
SHA5126032f5110dd27f7a3b94ef1a6a24cd032f97b5f05d57251a272c528a3ad8b6b8336f7109636b3e70ea480180713b0e6086841e03271a9f4b3dcfddff7109ba7d
-
Filesize
4.8MB
MD5048e2c9d033d97296d6d3d76c04cfde1
SHA1402899c8180c7216c2850b087696b661b4207c4c
SHA256adb10f6dd75e4af61d970c4679099baf22a2bbe26fc039623820295593f9eb62
SHA512c6ed2617cf385f145fc0683c0761637d05974de8def61fc7a9fdc9df2855b1603107d7c72043e998ca20307bb14a703aad5b65382eda29e64da107d16911a06d
-
Filesize
4.8MB
MD5df055f347e165222f33658a9bf065180
SHA17d5461c7fe891e718d4420296fbedec8d64859b4
SHA256fadb667c55682e4a85772a29ee4712e0df0ee31d1a19fb00c588fb1fcaffe0b1
SHA512a306d0726107001e9b226f5ca45876482b58323e9b82bcb9e61b4701158d87bd345751279567a937b564ad145f2eeb14f987b7beb0f3945250b0ab2d9750d698
-
Filesize
2.2MB
MD5f2ed5551a7a1752f84f91d4bf7cf7f66
SHA198081aad1742ba75f2f376e006be87507a853163
SHA256369ad1b9c095187c4d9150a7f3840c8d6592fc4b14193c7bbafdba3e7ef4f9e0
SHA5124d4265a6f8914c615f4b7ba7a3c8a5f4ff0a32d3a54346ce89041a4f39a61be9802d7e89db48e2c5655426075575502d3b371bd92c4a9b3571f521e68c1bb38b
-
Filesize
2.1MB
MD5073495de939673fe1570e2b362ddf54d
SHA177cefae0476c5b6205389152ce1139f21c249f55
SHA256f0ece5350b6106307336bc625c0107fdaedb5392d8461a7bb9b90c1f83b2014d
SHA512edc99803a4c17f0d3192c8e70b4df72327936ed444cde4690faca24350d8d7efc89ccdba6f99e1f953240caaf4c592b54175d3567ccd3dedb0da5a1aff35b9fa
-
Filesize
1.8MB
MD5dfceaaf0214792552d05c0faa7403ad3
SHA1434d641ed885e73b261fbab21720f275b2b9a8e3
SHA256f61354754e43313e13969e5e60cb9f213ee4ca6cee140071c4476d5d19db42bd
SHA51207b1de587e1cd88321504402efc9974835e5d71a29bee88c5ad9abf79818de6daf32d5b9fd67af784f2a40158a46e172ece996933e383d5e8e5e980e8eab132f
-
Filesize
1.5MB
MD55f0c9b348788b84ed4fae2c7b412aa31
SHA1cff5f9bd0cb9953c535c5506d7eeba5391961d4e
SHA256149dd03719ca995f11211aac63f0299a2963faec699756b3d13bd8ee96a9e876
SHA512a95de27df46aacd58a38b60da324bf800027c3fdfda31be6cd814a3914480e5ed6643754782a5a78ae62893ffb735506c05bb4ab3a63bb99203d20a8a9e1dd93
-
Filesize
581KB
MD52a5f98043792626a4a2c2f2d6d3781fd
SHA17652834b9c2c95b7dfedf0f6f567dfda18c97387
SHA25638bb050135f53870038dd9cc03d101ac424f845cb69e18d761d18fbae446c156
SHA5120ae9399e4be6c51c10942aa2ac846a80aa6a782d1cc18bcd11d87a11fc0f71365718baa58cad1397aae24e39e55648c21ae1aeb93b9f5184d1218e8eca5cfbc3
-
Filesize
581KB
MD510bb26b33a581db88a0f20a20e31147b
SHA1f299e37ac8d9e57be2b267a5495ecf112e2968a0
SHA2562ec752eea15c9e994f1d957b94489dcc173019050344a6bbf6583afb96a37a01
SHA5128487873e49bf8daa807db7e9f642ae437795682a97acb4117d6a3aea1bdc9dda12aa6a22e47e0e74fe4b7a8a19422cf564035d0920b97bc8545ff7f45019113a
-
Filesize
581KB
MD552f03c3c695a11c2cc27cc65563cdf11
SHA1fe1a4eb1c298ee2282bc361940d9d6b856cb7f17
SHA256b5089a4b08a3b28e37ce39c70dd43f6f47fcb47b80b59ec5417a06087bca0c3c
SHA512bccc2b27860722d1b90df0256a513f96283c43714da6a0a451f9c635afea521a1457c7ad94e912ad86aa8d5e116df1ba2264b12efc5c79340f5e947d0f5f4109
-
Filesize
601KB
MD5fbf9621c05b827ce84c922771c9b1b3b
SHA12d839236adbf6a649131f6a536a14b35b9bde875
SHA25667c03557790d0850ae753f156eff5eb07f9dcf749ac5a8e6ecb2a4954cf60dea
SHA512fe170cd892620702eb3047448155e73be8dbd3b60dd3da1d7b77fc59ab46d1abee770f03f8ae35a050d09c8253245cbbd1196523bf79d883444dc21eabffd82f
-
Filesize
581KB
MD5019394d8cfa538a34ffc5f70e8cee4bc
SHA1bb3de21bafa8eee69e0cdf0637b6afa3840d0fca
SHA256d6589535c3431b4008e017a47589f4cdf7f4261f5f7898bb328cae2bd333e0a9
SHA5123c07b2db7ce4739dbb89607a84c78ffa3137141e481efa566da20777c62d8201b64ac1b8bdba2cf0fd3b37509a95f379f722632ed9be64c464979f78496157a1
-
Filesize
581KB
MD54585965726c53dbfde686865974d78d2
SHA13d4d4352da557508eac13812a5b0035383a30280
SHA2565fd89d61f78ce1f4f5778d3fab6bdd101a75b04ef8eb3c68590ee507fbb0a2e1
SHA512663eea94b6d22541df50b0e5842f31201fca4559ea92a7ed9709385b77763f4ab755c371e3010d75a17356c471ae4f892b14597b7bffd5f3aff7095d1e793ae6
-
Filesize
581KB
MD5a923e518f6065b0e5f6227c604d125f1
SHA11eabea3217c49503d9fb073e2e1065502b1c4344
SHA256adfb765b985f081a10f9f65904ede3bb72b1eb226c0d8465467744f01b4a0f0b
SHA512a2cb81c9e3852a56f6e5684e360fa31d40944c5e9074261953f5a53d0a043f777b361214ae91fb0209e468a09eafb94d44e0d26eaef693e0815fda1b999fe867
-
Filesize
841KB
MD584e067bedd93eaf5ceaa6d11ef562ace
SHA164ec4f3c3ef844aa81ecf832af9bbe549f5555ba
SHA256051651e94240fca192c4dcf472a2f7e33cf541e705b9e396a65d9644a34732ba
SHA5125dd33fe60099a9888ab60043b11c2e3848e01b58d12706649c70910a0d414e44accd7239e51d93d12f05b441f17a54d672038ce2223229590fc91556add81888
-
Filesize
581KB
MD5876261ca18d7e8c6b718ea2b0d6a1ca1
SHA192c9355aa106e1df4471da059ad08ae02326ba73
SHA256f169f9e0fd87671ff83cfdcb14dd0ec600174f73a4617d2111ea134ac359dd99
SHA5121eead65d410d74170536184a3fff882f66150cf0d5aa31007f87e7f93d8c965ed314af17ca6e1b301e777abfcdc170373d7c9f49f74cd02a6b475b5f84d45c18
-
Filesize
581KB
MD57a52ad0934ee2a74878300c31a1151bb
SHA16dc6944d3d5ddb6b44907233e318047a08eeaa52
SHA256608912940b2f99fd888fcd8e196bf5ab9610bb5cf84c27e23c8a602452d46d29
SHA5123fe5bb96d2baa2a2aaaffe18fa6cb3b2ce5b691afd34d89e58f441d2489ba57d5a030de380968e50df0b1fccb1d73426472a64c499dd3ee1381c962aa65a5075
-
Filesize
717KB
MD5f6a67e5837160b1eab6172b82f6f9186
SHA1bf349d04a28287ebbe4b3f5cc7fa9ff7597bf589
SHA2564c1157fa6741fa93a74c24266c124a2dfc1a729ebf583658b1efc4f631e780f7
SHA5128f631ceb58172bea343e2731879c5ca6df3766c1a53265d3535935dd8ae63fc8a841f439eefb6a515bf45fecedef740b0161b7d003083f6ed7721312bbce6a4a
-
Filesize
581KB
MD5e65ed9c6325be8a7ecf843ed0a8e823e
SHA1f1a405d0f83166ff84d5852ba717c3aab83820ec
SHA2560d15bae6702ed3ae22d48e6f4144278a53194b3a47a56b27e429ba0ddd7abcbe
SHA5127b2ff699f3b5d6c85d42de91156e6f3bce8b977649250a74f7923adf93dcc18d33176611dd018f64b3442ea1fd97aab6bcf703ed740bc4a73daabadd89b85ea5
-
Filesize
581KB
MD55115aceb805d042b33e51d930b3c9832
SHA1cee7bacb8de33f1a3d427d8a23e4135118fb328d
SHA256182fecbe27c296814ab0d20207b0b46d29fdbca621efae7ccd2751751128a863
SHA5127de536cfad4eff9f60e8ce967d8714e621501ac7fd97ff1753a2004a625307425b50a754768f975ce440561c477250df598a69571d278d7e64ba6ddca97a0ab7
-
Filesize
717KB
MD5bb34514fa0e5834fa56bd090b3413c9d
SHA1542505213d3ef0ef045b79b6aeded892bacf9977
SHA2563a6f9b79ac7f30344c2eeaad5ca8537dff26609949c025911fc742a15359ad49
SHA5125528e9e3426b7c76c9c46a7dc3ad7b7920524d33493d8568161c2a8dba58bf293bfea1c96598f2eae55e2d470bfa98c94b8ae6d45bba74e25c81dc047f51e011
-
Filesize
841KB
MD5dd704214d90262dc4646ca130c2b47ed
SHA11a6bb51b1aff12b4cfd37432a1027bbbeeec9ef4
SHA25644146075a5417b5d2afbf50d09f89775fca3cd72748bb995d611223a2f3f61d3
SHA512871b86798d82808f2a5159ee04d477520e6b99d25d70219cdcf52197775b09857f31fc076dedd37c77195f72edf4bbddbf8fa915bd6fcda77b2bb243907470f1
-
Filesize
1020KB
MD5f88422e040b66a8d30fd2a17ecb6429d
SHA14fe1de8982344df61f4b8189f6c804919c857ac8
SHA25618da6479d93cf86ccbf496079bc2a023a66e55658afa13301b15622abc94d397
SHA5125ec015143b17f12611e60f8d0c86e5f799909d2cefbbd12655f9e286267199e48c28b5c62205ec8cfeb81d1853dd1c7ca3a271e08c52ca4d34119f17a16dd30a
-
Filesize
581KB
MD5103b264763e2424a89490aad19ff9611
SHA12345d9e399bd5d814c6e5a2454ac5042841962ba
SHA2561d3801961d74d7e6812d6abd1b4d0201af92303d587022ac708f7595513e2e06
SHA5121269814af333dbf26a1ea27687e271274d8181b47a6fdcf760f3c3102220e91128d193f67a55f463976f7df24c841731e822e8bb26b48334e4d80ff0290353f5
-
Filesize
581KB
MD565a5e5838db66e107aa9b9809b63ccc8
SHA154ffd7af246fd8fb703ef8a894716e9b8053b449
SHA256ae9d5e8d05518351e2f87ef3c62e387e45e64a9f98ee562b65e15d7c3c893060
SHA512c1a5896bc6546e2ba30f1e11ff6c41db023768175ef3d9e04dd7c8ab617a59630cca6cb5da2c3f00c309e4daf5c6819a7ac0c0dc6dd0e0d460a31f63aca87f4d
-
Filesize
581KB
MD53ef1e24b0d4054656e438aa4451e3123
SHA1f9a5ead137017d25992c81a79ccd7256c3660fb7
SHA25608d17cc555e5d12c193576a396a4b5e569343bc4d6721de1aa610257d8d175ca
SHA51277210da92c5aa1d0fee8efcfe1d8c7bd12f08f3c730430cebbed8633bf32eaec2f59ebfce561badcf8f883424f44a6474b4651383a8b74e9048a7ee381040f53
-
Filesize
581KB
MD594b68cf09d2b460cf3eee2db27c23fa9
SHA13e48212c00e6ffcb4e2e648f453a0464827dbcc7
SHA256d4a8711dfac35df9bb15eed1c4ff6106f679f11464affc23c26a553921895b1b
SHA51244da5b53861f89512f6038a77deddd73c07945c7f9f7b153c09150715b31fa5d29d271d60777249e188b198b13a77e696773a8d164ff0d8962896ffc78c70b8a
-
Filesize
581KB
MD501ab0fda0e6d3f65fefce25abac7f5f5
SHA1c38e1cf28a82be1c6cba28e12c8c2cfb3de2aefd
SHA25694ec201bbf2d005c864196ffc9602e24233f9c327a63872e5286b7928a31a804
SHA5125a11580ec9d90b72be89d3fe5e0467470949199067544e4eb0f1ec3e7dd2b7e7cee2cac3b0a9b058c2d88d2c8991dddd1090e123aa6b388c425d7b839b9c0993
-
Filesize
581KB
MD5b3b8d0e849e6be2cf58029a7e41ce95f
SHA1aeced95c600d8a82fd877ee1a08e065fe04eaec4
SHA2561d199e4432de02a78689a4c0c430b3af09cc4bbc1c52c47c827986cc136f51fd
SHA512bfeedfb72a52acae11a9959ac320071aeefd6fb790c2720bdb888e1b8fc78693bce357da7f45902da9d788fb8b5c90f3f2e244d4f8ac9fc995d140f3436c362e
-
Filesize
696KB
MD578c62b7927f976758075ac171b4f7e55
SHA16319076940a9cc98d780927fe2996111fcdb8803
SHA2564400a66e3d362d941cefb4d32cd58eba8287291db2360cac81e0b7181dce276f
SHA5123b491192f2a7aa24afe356dab9a57f4579fa4fa27c56c389fb8f0a22454e8f2f0d1e72181262099f39111c5f23b78bededca72f5d24030c845df09ab065d3a52
-
Filesize
588KB
MD5ccd39011c94d7e58e9ca99978265daf7
SHA1f5acb94f71768d4eb0c875ed42d6e36455b97d6d
SHA2565f492d1a43f94ff40a08f752cc14d3c57e94431e287d3dfd4e290aba405c51e6
SHA5124608ba5158f6b7b728ef65fd0674ce2c8629211f64ae592513053e8eb6b45ea88acccc7000c67ee0bcd9a4ab16e708d08f1582e0ef0aacd5b0d04a61bca87c04
-
Filesize
1.7MB
MD52921759cbff2031c2c1d8da8f382a5b5
SHA15eb37fddf3ba327ba3c87a95d02f85cd2721d65f
SHA256b5e23d40ba75c50be5a4d88df07c80abec5a7747250a334cf0663747eaa5cb8c
SHA5125b8e2197b35501978c25faf59d8c677e0c4778308301d711b5715b748437db8b3724cb2b1df9170fa5357adb315f8a35618f426500bf7b7e3869ca5dca54da6b
-
Filesize
659KB
MD5e014c9242cdf21e813919b295f029ab5
SHA10d75f8163e8a9d12348b8bcde2ab52ceb3599bed
SHA256ac0c6447004f03f92c98412252518960a19f76346d54457303916d30c2bfed95
SHA512e1e8d6fc6660a71d01cce54f2320d41dca1f3994b6a21f2259f561e8de5fe24b8ef1ad69e91daae20df9169e7b3b411a101330e1fa45d24f85367f31ba724f1d
-
Filesize
1.2MB
MD564666eefefbffc12ec6c5c468d80409c
SHA111da3bc0597c582c7b4b7eaa808a4877bad5ce8b
SHA256f5a099c1d4a0000951286107e0c5aceee117713e2892d13fd22dd7b9fca6ee04
SHA512aedffabeab31de7beb2f7092cabd6b99f23c5b0bfd5eb3baa14ab0c3f221d24f891c5e5316b7a7c1d188039f3a8db84b79916fda4f0a72c0d39f244a6ac063eb
-
Filesize
578KB
MD5381c0db1f4896d039eceb8b8ebc3f99c
SHA14874d82cd6993535a51234b401b92a38e97fcd34
SHA256ee4ca094ac7866974d3f609c324fc4698fbd386a0c24a5f2ce4257cf88c6d0a9
SHA512a309e930bc6e47f7584af9abf6e3863307bf3d1f90dc9a65470fc8de167adf0523066bcf7c7d6178ed3215daa833762104cba53b8e47741f86823ce4ceaaea67
-
Filesize
940KB
MD58c9b9d281a6fd8117cdf7649788c53bb
SHA13ebd81a49229f490baf80235747d164089334087
SHA256d14959cc323009b41847555f676ac7f03cb5bf633048b1754781fc28f14ee04c
SHA51201c1a522a93a18da811f0917c739734984fecff69a208b8b24aea76383b915d71a3746d0d0dcfc4385c3cd7988a434c8f71f28e163525cf0cd28f4f4a697d38c
-
Filesize
671KB
MD5f9245ecdd7a846e282ab591002d19294
SHA1cbb0b68ce43ac39669696d1bce4f19a9ce1c5553
SHA256e10d00d9fc27399642ff8aaa6debae955f9b2f79e8c66670b86c989d7449054d
SHA512f5aecf6094ebaa1c3c10900ce72db23af34d7d93f1b2156123e2b32d4cef84dce53abc306826ef46d5b0856d010b7f622365252b0a0ab8a03eb437e09a0a94dd
-
Filesize
1.4MB
MD58d61ff3909de55f96eb4a2d22482041b
SHA104b4628a03a52316faed3366ea40357152bd3459
SHA256072014c7133cfeccb037c9e5194ffec17c401f63f38e5cfab73dde5ed7e96bca
SHA5128ce90fd8e6b78312586af9638c0d6c41ed89f8c96acb60e15d826b8ce8d67914c87c3f4012f674cb85d271900ba2a6a74407b7934a5116168117baac46df3a52
-
Filesize
1.8MB
MD50879996d4a99deb7d5e43ccef964f778
SHA152d61d92b160a0d705ab86cdaf18efa2bd5efd60
SHA25654e08556b48fb002fae35ce740bb0d6055b003ae1bb1e8e3fe16f5a759b72f70
SHA512e497611e481459575caa5b1fe81e40b6b638a313c24e0c12468fce2a350e287790f303c03cdb03ff662d1d43266a0ba69f21d6fb9256b4d5793af20bf128e885
-
Filesize
1.4MB
MD5741cdfd243de18403789b4da637a1a40
SHA1d1bb83059100118ea74578c97b78ba6f04a26b7b
SHA256f8f0c104579a1e0e4d797465ba21f3fe62d3a6639c3358f32c767b40159e6b74
SHA5125b6e3551042a25dc45b772932f30475f68520490f667ffc414a75d396d8baaa04c0f3785b21471a6032f601b7b6026028ee110c3a8d700719e60ccffde8114f4
-
Filesize
885KB
MD5cf75aca1e6799bb8330ba14dd2ce6ecd
SHA1022c715f31b02b1c218d0bad7404ef2521a41f86
SHA2568aa5ab3f07c1ddcd94d142bc4a0a8619383e627e577c8bf8fae91ac4d2bb81f9
SHA512c8418330254459b95d1b687a323edbcee637b5e4c8d7dc64c45d398b159a7b1eea2b4e5c9674831825a46c584a520c1eff1d0cd2f1e3cb78ee8b33dc23e0bead
-
Filesize
2.0MB
MD53fd4b689787efb3c3f49dc3436f42a0e
SHA1834ac94988cf52f041b23d5856472fdabd32821c
SHA2562db69d3c09b98e205a4e482bdc32b634cf5e87e0056c08d68c48d155a9fe38af
SHA5126dc4526b38044350e086b567906b202d828517382e9018c5a28711c1daca5b34a427a9f363c9de71a83127a0d35ecf7ad2b279ac5041652dfe2a98f63fda36d2
-
Filesize
661KB
MD5fcd22af0998ac972d684eadeb9a7b478
SHA1620bd2d9d8c054e4fef206fc89f0e0257e0c373f
SHA25652333ed39a2c93155e4efb33e210f88b4c7bfee4c574b631da030c0f3700387d
SHA51206c766e37c38b893da37f0f6a692cab7d62d6920caeefd430318922a8dbee9b719d37df2fa912bddd2522c5a3d8079ee6caf402089f0cc1fbd252fac457001d5
-
Filesize
712KB
MD5ff1d19047b1d4ea38ace981af1d41809
SHA1db330383fc934d368084c6ca8b870c7b6fc468af
SHA25659ab7139ce2a196a4bc0b06641b8738b71e92825331e0e1a65d9814fc22497a1
SHA512d70a43dcde004f61b79c68a4318541a2ac7011bf169199bfb4b125d9982a91cc287d73365d7d8a4d2ffd037e11c4a8f8d3e1a1bf9febdc1f96b19bf305ea3a20
-
Filesize
584KB
MD5e28d98a7f351a4bd05490d3af3e9e7f0
SHA18d5aeff248fd02dccffda23cb460f9f39c453be9
SHA2568e82651efcff7072850980ca45102c4c4501367b2ce0e07d11db538519b9881d
SHA5122b283f0b2e141384ed64b641dca6f78584218002764e9b3de7b1808bafab788d31ab4ce4683a598fb63d3d21455142eab8b89df039b7b2dde5c271c7b51a2f74
-
Filesize
1.3MB
MD5567c8d72786e8cd70e963b5996575d34
SHA1ce7e0f46ccccc20b410b64acaac796c2b6f8c5e1
SHA256e776ef5f5d01e3172498730841634f2062481dc3c6ef696f9cc3ba8944a7f6d1
SHA5127717a71513afd7f8b2b91f4c38dee55b576b42cfc39530743dc372f312a494771230b2b21aebdebd7e32b983cc214a0b85105cdbf189fb84938e6f8dea0153e0
-
Filesize
772KB
MD5842b2d176d4ce36c8a37e8e48d2a79ee
SHA115e6740d1331d550e9e454e5303ff65164ad0877
SHA256ffa3befd9f4687bcc43fc89e39476230c66946b009db85b434962e34eb7614e1
SHA51245d89dbfe89208270c84bb945957da758eeb3ac3af5c239b68c3da0b045524b5e7def7249ab1576c1db46f6f5e3d8c5d966d961addb47793e8bede33295dbf27
-
Filesize
2.1MB
MD5d33ef9a3cb98dc72447e205355bfcd7a
SHA17ffb7b85b008f193587448fa838aa0cd0e7d4282
SHA25669a4b113b74baa240e3a2f63caefe06382f48dce066896ca885233b139ce71f5
SHA5125e2cc6c9edf1c03a3203c52af64ff6e3dfe029288ec7858149a6962ab777ea2de791037940f90f30e071e7e9e3f0c079a2e36238289e48614f5950a2afbf74a7
-
Filesize
5.6MB
MD59078d9615d9c2b247373e9923a7820b2
SHA1d0999876e866c1d081e84dc7448e41c962217493
SHA256716019db5965ff4e07faf07aeaf0f61f0669db3c9826f22f208ac2feb673ee83
SHA512fd1ac6fe9e49b903b24a4cbc251ec91bc83de17667a4ec8a289cd8c846e376114fe1cab08195aa66c4a6b41e4035c53e0dcd63d08fb54984af2f019247938144
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
1.0MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.0MB
-
Filesize
828KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
828KB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
604KB
-
Filesize
604KB
-
Filesize
740KB
-
Filesize
384KB
-
Filesize
740KB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
808KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
808KB
-
Filesize
384KB
-
Filesize
1.3MB
-
Filesize
384KB
-
Filesize
1.3MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.0MB
-
Filesize
384KB
-
Filesize
1.0MB
-
Filesize
684KB
-
Filesize
684KB
-
Filesize
384KB
-
Filesize
600KB
-
Filesize
600KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
680KB
-
Filesize
384KB
-
Filesize
680KB
-
Filesize
596KB
-
Filesize
384KB
-
Filesize
596KB
-
Filesize
384KB
-
Filesize
792KB
-
Filesize
904KB
-
Filesize
384KB
-
Filesize
904KB
-
Filesize
1.4MB
-
Filesize
384KB
-
Filesize
1.4MB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
1.5MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
676KB
-
Filesize
384KB
-
Filesize
676KB
-
Filesize
384KB