Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
15/04/2024, 07:06
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-15_1daea250f0f39cf8e6e3ace932a38cec_ryuk.exe
Resource
win7-20240221-en
General
-
Target
2024-04-15_1daea250f0f39cf8e6e3ace932a38cec_ryuk.exe
-
Size
2.2MB
-
MD5
1daea250f0f39cf8e6e3ace932a38cec
-
SHA1
425d6e0bf8d6f716b87c21d81600e98e0e0d1cad
-
SHA256
2d0fa1e49bea8abcfdaefdd97a56486f27dbaf10f09df39a19a8a1bea25553d7
-
SHA512
94fa1cbe481954c89f8cd8a3ad4932c50673f1268dac72bf98de5bd9eb293e693f71760f38706df0cf8f09acca9f447f6f8c6ab9e7d1431e03d74de5b3a7a8fb
-
SSDEEP
24576:nOObVw4TaN1wdkukCba4oXtgLhU3wEdmh58c1SwPHU8X31PfU17DhZy0lxHZ9/I:nOOh3aN4kuLbegmtGcw/3FPfUNDZ4
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 4164 alg.exe 4676 DiagnosticsHub.StandardCollector.Service.exe 4744 fxssvc.exe 4956 elevation_service.exe 3224 elevation_service.exe 536 maintenanceservice.exe 4348 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 11 IoCs
description ioc Process File opened for modification C:\Windows\system32\fxssvc.exe 2024-04-15_1daea250f0f39cf8e6e3ace932a38cec_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-04-15_1daea250f0f39cf8e6e3ace932a38cec_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-04-15_1daea250f0f39cf8e6e3ace932a38cec_ryuk.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-04-15_1daea250f0f39cf8e6e3ace932a38cec_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\366f8cb02b574d51.bin alg.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-04-15_1daea250f0f39cf8e6e3ace932a38cec_ryuk.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7z.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\dotnet\dotnet.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe alg.exe File opened for modification C:\Program Files\7-Zip\7z.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe DiagnosticsHub.StandardCollector.Service.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4676 DiagnosticsHub.StandardCollector.Service.exe 4676 DiagnosticsHub.StandardCollector.Service.exe 4676 DiagnosticsHub.StandardCollector.Service.exe 4676 DiagnosticsHub.StandardCollector.Service.exe 4676 DiagnosticsHub.StandardCollector.Service.exe 4676 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 656 Process not Found 656 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2756 2024-04-15_1daea250f0f39cf8e6e3ace932a38cec_ryuk.exe Token: SeAuditPrivilege 4744 fxssvc.exe Token: SeDebugPrivilege 4164 alg.exe Token: SeDebugPrivilege 4164 alg.exe Token: SeDebugPrivilege 4164 alg.exe Token: SeDebugPrivilege 4676 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-15_1daea250f0f39cf8e6e3ace932a38cec_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-15_1daea250f0f39cf8e6e3ace932a38cec_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2756
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4164
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4676
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:2116
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4744
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4956
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3224
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:536
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4348
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD52761468557942cc22d42a26b29aff3b1
SHA14c600c58066d39b879822bc618d66cf20e401061
SHA256b6818155f05233399407b346a6f659102a1d52d68919678304857fe48cecebd4
SHA51284ed3a50d2b8dad4190b9cc08c3106ae8d6022d1c35d8959fdfd72f4e835b9f2a7894b4fe78fc3882f3e885f21079587bf050ed5b82d215a7adf1a32ac84a8d0
-
Filesize
797KB
MD508692df786e6535c9c9ee656ebbafdcb
SHA19bde940c5a13e2768ae52c655bcfed7d7c9fc890
SHA25602fffec1a0511b39177e10d78d3ccd2d646de834b963fd7f895e55f81d11f18d
SHA5122b0481c1ab2a2f37198534ce0469d75f4e84a906b3ba1d1b7b183a60dcc1119122793a699bf408a042cb1dff2c1f182e0c3cffb73889cefe62882aa8d5d7a396
-
Filesize
1.1MB
MD519c53e9fc83d7eddb074e561ad02db03
SHA1b7696d10c1a3356cf6856b39cbe546fa1de88af0
SHA2563d2812aaad6439f4868cc54b84b9fb010386f45b636f1ea9213add10f32184a5
SHA512691796ac31e82956ec1ea6a0d8f0bf5b51b50b95473789aadc9ccf450ca1aa71b335765fcdf18906ef88eced30d798e86b25fc23e6c604dd98eb2de445f5572f
-
Filesize
1.5MB
MD599f5fb036e689ace4d776e7688278d1a
SHA1c90dcaab85bbd8479c9baae334df9610d5004878
SHA2563e7152cfcc94dfd5f5e9d86472c307db8e22834376e435d4408ddb5cd03cb5a7
SHA512015db9867e86c8a4c2e96618bebb361a82b79d2a67a36a3010a334a750a60de4b68018713fbb1f2e0b8848997a8c128a13934e796ec29288f9334b93971d45a1
-
Filesize
1.2MB
MD5d444dd91a44e17da2142bdf4b9fa7283
SHA10a9ecc6c405987796332692b508ed1c15a63b261
SHA2560e9a82ca13d43ee87785b6ebf636dc1a8d597dd4aae4ed6b396c4f83cd282531
SHA512bbd5bb239b6096544fd6832a63df782a6544bd79863b483574c7ed7eb8d7337eb9723f62d8b7582af904d7d46147ba09a766ae95573c020e67f9e1ff886d8411
-
Filesize
582KB
MD5fd640256493b55feabadf589bc8ca236
SHA1c74bedd7867ee5adb394d523b37dac8c34137bf1
SHA2563a2cc911887f24e799250e1041519db180de9ceeed964de5b1d9e2379635952d
SHA512442dc677c6c36976baaa58cb78fbb9ca6ca1b1cc1a9d1be07720a932514e49868ede205d22c327b55d988328ea9677db198f239986beeab522304db58340e1a2
-
Filesize
840KB
MD569fe5b35d9d812bcac14f460477e0f07
SHA13b25df15e223ed6c43a2e06b6ab43851f89a8b50
SHA256fa788df5786b50ba34182b28f8e48ddcfaa1b5d4f0fcce1544313439bdec41dd
SHA5120a4bbfb1d466e371ab0b3a8d06f4113d0f1fcb11bf9817aa4266234248986c69167dc5252591b77a951bb3b3c88c9f4e3290ee683e34c3ca98b33e9406a82222
-
Filesize
4.6MB
MD5f6b2f712bc9252ba59e3ae612223ca64
SHA148bebadd8e66d9f0106363134f9109a3871c6f10
SHA2564571a9a795f92a8a3c60f295a4d060e939ebe41afb0c0e731098a45cc97e38b4
SHA51297f64b9b2602ece597d8acd30268f803eec2b5b0481a871e87046a7f0dbd7e429c1a9209a1dc20389d47a1492add1607bb45dd5275d6f14c3e7cfcc676ec49f0
-
Filesize
910KB
MD5d6c7f28aa915bdb48c7e9a405d247464
SHA15a84a7eef8ef73f7991f1a9c888683e7bc60325f
SHA25655b922777c6b0866e9012eec726127825c6663a8e011e28b1f64eb46685f2c7f
SHA512af8384d27d84355436ec534114377274cbe439c9945e4591a902aa6c407ae09729b685835616f763b78eeb2b45f8bcf2a99cf0ef75f07963d6fc1649a8b7bb94
-
Filesize
24.0MB
MD531ef621b6a9196bd1034921416054aa6
SHA1fa019955481a88f52c204458aeb665ed1a3fe486
SHA256fb0715a23411fa4bcc9acea1507d62ce0c23e5467892a8ca693ca32551a1d96e
SHA512d7844864d17f5673212570c03e955a1257394e45495ec333cc702c7c3571fd801fca49001eeffb34faac65e57be898f1d820e16c3eab23c706b639bc7267e9b4
-
Filesize
2.7MB
MD504f48c85da7c4b7a4112f0e18c557b44
SHA1615cbf35a773566e4b788e3bdedf3bfe830ac8b5
SHA256c36b45d4ed9a2d19a8859e15be3cf78d454196d01173957587cb24b3ca0e2f3d
SHA5128ca2125039e9d408fe3c72b6051657ab84a9efff9b7aa327ac81bc9da5ed4054b2b13c1cb3484484122ef27cc2efc067d5894fd7381c5fc5a30129c7ad1227b0
-
Filesize
1.1MB
MD5749a04d7fc06a200287fb2b64401867c
SHA114f4e2e383d9c08747ac66d530892229bb335891
SHA256a2a93310e5331825ab30e86fcb3eef406973b26ba0df484404093d0ade3acf37
SHA51291615dd08f7c150f32f77f8f94ee7d895c05a15dd945cbbf83213edd2513428142b369587bdcd074557fe97c66cd301cc5c7c1a987aca0a33c4dc0a33633539b
-
Filesize
805KB
MD5ab83514791203907be2556cc2b88112e
SHA1150c436266719105d588b4db6579615e736a8b4b
SHA256ca3096a2a076bf4ec2fc6bd8909751d78d25b2b174306d0c71b48fc503b3d32e
SHA5120c4b3ce2ba75202dd57ed29965e112057e0a8d19bba0c403873b5bcd88001806b3af951ba0ac79408dc9ccda0b587ba054f2fc9339c02930524540e51d421e29
-
Filesize
656KB
MD51f2745dc89efc85eecad065bcceebcfd
SHA1f3302d7e7d2659b0d8d7153f947b00304eb53395
SHA2569d33fae7c9b0b17d67a637b679995107815924ccf1a86f0e4271835738dfc216
SHA5125ceb00df2e716fb0065003f9e986f91f3b98ff9bdb3ac22417b4e326dbaa431d98e6ef8375c66fc1a14991a3fc7b19d94de5a6b26835ce1b2769f240ba015626
-
Filesize
5.4MB
MD52ba5bd79eed6cb0a324c668bda7cc01c
SHA1b62c3fa51671d394ad8b3fb28a23351c91e71545
SHA2568058a25a5930a8ddcfed2cfba3e6d5734e5270bb76b9ecbbaf9c1581e50034f9
SHA512dde9dc544079534d42f842ba775661260e7444ed269a10f55ee3d54ec9d6469f036e07a27caa39997010e9f59e1f503177385a6b481af904fa177327d0755af7
-
Filesize
5.4MB
MD5a187a464cae7d24fa65733fa08ea176f
SHA17428e2f850ab8f90189340e091a26536e4238168
SHA25680609de59d67a7167a2c676aa2efd7c8b706cf01207978eef1de0d41980b4aca
SHA51297bb910022a34016286f16ffb7e1119723ea10bd7d9504f85bd0c6f6974b61ffbed88d46b4e07e392aec8ce61a5a62933f4f75cdbf00ce557fcb0bd7d398f9a3
-
Filesize
2.0MB
MD518cf2dafe7867d101b92afb3b75c3651
SHA124df75df42308581b18a42e4e207aaa4d1a3ad78
SHA25658a6f362632232945db5a9611f87016ef879b57f6e57dc415d4fc5a0fb25960a
SHA512cdbfc9cb441c5b8803481d84f9aa62e133400e24390995a6c83ddb0eb51a18dec08d1f7172543a6a31eb2d649b4329de5f3580d90466ef40ab000f116b4fe899
-
Filesize
2.2MB
MD56ae1788e6e9517d9698bf0df2f4bc2e8
SHA1d74fc5193f04df90905312421a76bbff8c66bcf6
SHA256812497983c053d6763ab40f2a7ac90ec06ac8d5d12e533f6ee3b40b804d7eca7
SHA512444a20dde32232accfbab1234243f3e4ccf4863e44f3bc3bb8ef5b8153b57566d8413cd95223d020a07b9ea13b452dee410bc59796f968301e68826b486f2bb9
-
Filesize
1.8MB
MD5e6abe70f662059035cc9a35efe7d4c84
SHA1d5dfe071c990ad91c6dfd3844ce8d31765ce1385
SHA256ec26f75526a93e2b13f6fe4a18b7c8c71de719ac660942728d617716d0ddb0c2
SHA512818b7066ccf7ee2e4894e0b8affde96c24da670e4bb5813a14a363ede152972dc806ebb615e9f8092972f99f24ce734bfcdeb52aa450f5fdb29f167f26d2575a
-
Filesize
1.7MB
MD50c8ec9e48eda639a70a2acd6548990b7
SHA15502cefb069af2944eb3a3d4156ca5991f9f5988
SHA256fd07d4d7db21f91e1ff1ebcc6e336e69339bc4539af2ac85e60a849fa53f45ae
SHA512acf82a4bea54db1d771a1433dc8468281e5ec0c2bcacb061c31337ee7d514221ea5d2c42b322582323cbc38dc043e6979541415fc037eea121a46f2b6e6259f5
-
Filesize
581KB
MD564d756901951fab0a0b9602e56a80ac8
SHA169ff35c8c2d224cc10d807daf5aa6ae07be5099b
SHA2569597c13dfe7a4cd7abd8a6d4728bcc010160aa347e50e1a6068a3bb942347fdf
SHA512024b4f687d7e09b93799ce4255b80adb229ffaa3909ca6d431b97c9d714baa4ebf51380fec9349b0a969ea49ec02d8d0ef59acbdaf0dab8a91067d79e96ba6a3
-
Filesize
581KB
MD51ea7861dccbf6d769a0d7b922741d2fb
SHA17e3b90c8af01dbf06f6752610416f5b1c6e0aae2
SHA256f4d47f6aecba01546549c018f5ad36f35bac561dc91e96aaa02b2fced54c30a1
SHA51288ccab0c66ca95d62408614b609aaae56506b0c8a1de1b95da3dcaea38921ea64e9a77d0b6772d68249a7d4c55e1e68d68c84194cbb86225505d9d166db9c45b
-
Filesize
581KB
MD5bbe7e551f94534d32a1e59bc98af1602
SHA12bf4d231c73bb448fedf0c32ddf5d9c2fb4ddb9f
SHA25672938f882eee76b31671722423085d49ac7711fecd1903aed98045d0e69b9b33
SHA512da63546b51f59485ed503171593147fa739d1ccc5b5393574ad0e454faeb33e1679cc9dc439ca62312879c0518d21eaf2928eb23631194d94d8bc78246be56df
-
Filesize
601KB
MD5beff2960efd3423d574a6cfefd15afac
SHA16757c9d6feb75de2c7b7c1bf089dd07ccf2907c6
SHA25609386d875748bd9bb24ee36bf6253e0f0c18f271d292c021bffc95747d253403
SHA512eb3ffb101ed2ee3fa25a55f8c9b1b894fb30d6171d63fd6f3dc49d46b9a11d3fb14ed42874183b445de21ac792b578050e23abb5569a522a2bd8540b2e0445f2
-
Filesize
581KB
MD5b585d01700d23c92a1060f43f3f15984
SHA1f1de561924a1cc45f12e0b7ab3643b89f49d9f6d
SHA256d7d4a1848222f67badeb1bac81324348865818f0653db4ac90b6a46c86360602
SHA5124483853abd70411e40e5bd2c785661cc74aa709f6d47cab85d6570effc26c510ba9d4dd99e414f29f1de2dab1f171c0d953aab9250665f6f89262f77061f4c26
-
Filesize
581KB
MD5186b2790d072eebc537d6c629e98a298
SHA134e092e913a4cfaf8f4532c3a9910f227910c068
SHA256fa5fc807c38aa7dd12260bee77cd0c07484e00834fc0169a167c6e164aa995fc
SHA5126a907adee5e8d6bb307b94888697c22a69934ce014bc2e4367d305c7f91dc16cf92c368a14697bc1b7313a760662525172dcd1e33983920d06bd8b5590ba6d25
-
Filesize
581KB
MD5d6db9444f8c6bdd9d6c2bfe61a4e5bac
SHA1115140c40fb4a7861dfff0d6b3ab8f4afb6b8a87
SHA256580cd5ca595ac7dc3bbdf1de473fd77572d2bb77f5f5a4674e3f4a1a714103ae
SHA512e1ceea43c7712c1d389dc42b7e271040e6685d314c7a874b1675f992eeb2a97102dcc6d54da0aeab238619dabcf57377e64c043dc7841baa5a0aabfb0a9f1b18
-
Filesize
841KB
MD5fd15a75e5b7dacedd4f6789e36974d91
SHA146cc7115f3c313fee9433240d5261b9f0f0214be
SHA256fa95f368740baa6e7eb0397bdbd1ccd184e58e9903d9b8388e677583eb63bee4
SHA512e69214864e94f9250deebd31853844eed25330712ba2d545fef4dab36c9a11994e2c9249485cea5664e81480c757cadbf1c15c5e04fd99dc31283d6b41129f18
-
Filesize
581KB
MD5db09b58dcc4af65060fecc345c097432
SHA1bc4a9f040295207f38973d52d5e1295fb106c2ed
SHA2566dd0b742f6694b74b788f9971a50ae3eaff58d6565cfcc3fb119f8a0b9327c74
SHA5125b90b7ff3209639e7df8c85aa07e8106b5e6ff8b5be7f5e2e2b5447493d9d1ad5178d1013a54ea42ab2db7ec9c251b8fb74b35f959dbf2b22983ac01142fc1f7
-
Filesize
581KB
MD581262b2bf0a4efecf2c9b20f910a2bc5
SHA1a99274d0af8987211519c832534445b1c81b3f41
SHA256b151dc9ce8bb8a04380b68ed744076ba1d59535c4687b4cf9d335add4f12a664
SHA51257155234f8ee297e54d70d2278f2b786184678e1375ebf58a0882a747e3a8a0f609cec586f5248b15fb76e551f4c65f144c66087fc3b839ca383d89dff2dac3d
-
Filesize
581KB
MD572c20e7dc1743847fe5742bb8ae799e3
SHA1a276469ea47f4520bf017ea26fc004897fbeba44
SHA25668be91169e8621c34d4ab6b9740e3a54f862e4e32f448ce63c73b65cfe28afaf
SHA5121c92364b68e80892cd05b7694b57632b5c8bfb3829e35c55f7dfdd2e6d605df5a2ffa2027daa13b5e268980d3c6719c090f8ebcae193aecd2cc0569dcc6ab8eb
-
Filesize
581KB
MD5277e5a8f7926f9e55fcd07ba4fa106a0
SHA14828d4c819a51ec7177fa3addf2f74ba86d852fc
SHA2562171b576ae26bd7c304bc4eecfc34cee23a4baad633e8fa31303e8f7a7f19eae
SHA512e9ed225b4081a24624b97ec9cb2c650b419daa563187cc3052d16324c4e7ba440f06ee27a85fc9c9050e6f3bcc5b806f8e8f25f0814f5a0b2e818727f71dd797
-
Filesize
717KB
MD5b83910f4f986f4c7c3c3c2ceadd5e0a7
SHA1bdf4f684b017073efa9c0be25cb5243946af8482
SHA2561b984ff9400c64b15da11624f2cc14149f1fa60506f88c494babfa5c908bbae5
SHA5122578e845fc38b4aa3607d6a517d1e5e592697dba19e769293c975dbce8ca3fa1c6102e25887ea6846fdafde3ac2d7abbb2f583dc35d4a5b0bc45b198065e0ad7
-
Filesize
841KB
MD5dda4d410eb1a62cc6963a8afeb859e2c
SHA15ac4dab549e6aea5c5e40e14b745091009029997
SHA256c90a0020202a1d94c6bd490afc6e3109e6e54c80b2ea2a547fa5babd8f14319f
SHA512380be4b485d30b2819135bd324f527d65dda5d6cc6c83001aca0d4256b3eb2aba3f56005302a98b1d6fadb36489572753c11f5474c3a8b867c4dc042f97161e1
-
Filesize
1020KB
MD522b558deda698e0668c5e3c2d5153d75
SHA195a367252974e62aa78c05bffea7b72b64317b20
SHA25645ab4ecf8935acaf709bdfe0edd70134e6bfbb66e72409cb1a40fb940a331aed
SHA512e231856eb458723392bf0e2cfbb819ee31e85ab47140b19cf5ba6d10d0258e9ea9cdeac9fab1c296cb023cd752a3283ac466b17444cd9f42045c4eb34dd82f75
-
Filesize
581KB
MD56cb0c6f69393197b84141e4bffd09e7d
SHA15043bf390bf4255fa0e87ba461a7ff694549ef9e
SHA256e9d757bad470b3a3a059bc50caf541d58463393a481d9f73e72a4b6c9c7f1001
SHA5129993aae1b99a890e99ac5b34231df6d23941b1385f5b8b977aa5b53a943cd38c70df656498dcc668af561c77014e9f9267d5d002efbe90a79873c714b8047df7
-
Filesize
581KB
MD536a36f38911ae6f9cba0b01717aaa159
SHA1164a6907f1127079936518f2d9b561d63b3d2823
SHA25679bd4c752a44bb38bb914baaab29cb84703444b3447b9bdb88968bdff8053a9c
SHA5127d9549a5fed1e3c9aa083db2064e81f27e6c97a56052974012a13696e0e6a5c8f33ed8e416c9254b494671ef6d5abcbd2a4b69333a4bf04e51a2679944eacf37
-
Filesize
581KB
MD5cc1d24e4096e304f9fc9976fc722e5f1
SHA145b6a48f450dd409765b5047eaec58637a4c82e8
SHA25656f76832522d9aa0fcf38da07af4674d05f1217b004b98a6d1b0b96a44e02e4a
SHA5128b16541dca3a16225ed419af21ec58774c37cbabf9113ebc42fb02bd0d37d49a4a34b862f9adcd72ad590aabaf0c9dae72e9d9632914b727d2c3596591638be8
-
Filesize
581KB
MD5809e4e8ef5c7ab089d63f71694d07ea5
SHA1926da6b7ad7709d25bf0f85eb571700dc8f6d9b3
SHA256f9d94f498e393da05d3332b6aa7b9ba6c18e974a95e22f3823697aaa0095f520
SHA512a574279b4d52dbb716ed33ca776e6287dcdbce3329c560981fde68d12fa25e857cb81292883770c3c0111774f6d873df1271edec0f1db6ad48b536c2515b672e
-
Filesize
581KB
MD589cbf8a9bbe2949b412de6460af709cf
SHA126326f9af50629710e12e990f0a6c7ed727044cb
SHA256f0b2bc404d9cb393311af4f8f011b8e5e63c3c4f4e41b907e0661ac80aa13fa7
SHA51268aa4f4f7120953f29bda6456ae93f87e4e329a2b61bf5fcf10529bc2233e47341bb893d4234991da8c7948cb45cb484458f49b1ffb5e7321644887335bfcb79
-
Filesize
581KB
MD593b6c5c4b2748ea5ad9cae10d0e43006
SHA10b1b6a91f6f169f27a0ef6ccabb858996eef7fae
SHA256e74dc916d2fc3973a7e9b7da1d8831bee9d9c1cb9158909f151d1e2579741f06
SHA512001779c2a5f09687d3458a811e0e0eb79da0c2e623f7cb5a00aa98e545f1be67ee3f110cc655d8f6f111e3237d1ca26251a9511a40629425de9fee4e25f09108
-
Filesize
581KB
MD53d9a76fac92441f40dbd11744d5404b0
SHA15fef34ea82300844ec3b5003c611f0cca9cc770a
SHA256857b194b928ba6ed12d8f02c9d8ccf10c9108ab0da14a7e42b431f9136a8ecfd
SHA51235b6c2ec3fbb9b320254d714ad68be355a770aaadfbe3e546951b24ebfbc6c23e42257344a427cdd4c6a2ae7af4a694ec745e93b3835c76c2cf177ce512109a1
-
Filesize
581KB
MD563a63a473666440be77ea2bce11f178e
SHA1ad320810978acb4107c50c8edd1a4822120b6f0f
SHA256a223731a5044fd0ff8d76fa166d7581ae38ae3f7b4f475cc021b2f0ab6f130ca
SHA51288fc984f12488dc4e98562376b4cb60632eeccacea38893185e507bd2177eb424f539c39b3774c6aa1cfffb2acb64a0f3a6913b60a268de8d063238087a3cc74
-
Filesize
581KB
MD5c97c0add45d01e8641087012f6e99a1b
SHA1dd1920ae69a08a60c45c76f90b6b5d163b1c6e6a
SHA2563f9f758e40e63f3660bbcf2425e0d559f6a32ee550882149c7fc5f61077bd9e0
SHA5129300a8e7d2a3f3b80ab4d29e2f54c1b7cd88007826312fd3a4b72939bea84d2028c19bc262162345adc1b48923ee336db8b0849f1fa9a81da131f09f927f67bd
-
Filesize
581KB
MD56857de8a1b03db66da8e2e77d728fc54
SHA1b7d7672c0722995bbe6e500effc1e4c9c377e1a2
SHA2566dc3962b95994490dfa199c324de4767e9d170ce1083a3a671bcb43e1edf8c39
SHA512279c81cfec41a793561d719c713aae7cfc36ae70aad7be077c89acf336d805ef2304cec62daf496ea5bbdbb4ce492d86c8058cef27b5afdd524030e8576466b8
-
Filesize
581KB
MD5956b9c578f019063e54efe1aa12749cd
SHA142412d6ea795eded7afac39bd8b28ca26a5b8669
SHA256e5628a7f24715afc6e6dce692fee67045cb55bbc32b24c75e81079300f31226d
SHA51288bf6b1ccbd257fa587929cedfd99203bef52974808894ef80e0985d279f25f439751094e7086068e93b176d0b588c091a54d0464d5fe69c6eb204adf97e4d05
-
Filesize
581KB
MD5ff740de082d883c1f5b4b558b28b8b99
SHA1c3f9545ae8ece49fcadbe1db2a3b26648eff8568
SHA2565add21d3b6f56178ee8b272676a8e2d33aa024ea7d2b4341a847f8e1440bafd1
SHA5128c8a08cdafad43bfdeda01ad5449b8f5d0fdb3d452390796a4a7a53344f7ad43f5768f2632303f8c028e55914faa858b96e21bda5a1d3537460e8f0f7c39f7e6
-
Filesize
581KB
MD5f5be1ac8ab819c58b6c39186eb3c1b63
SHA16711b9abb68712e88f3348eef128f766557052e0
SHA2561e3afcb6398a9783a66a59b7e7e12694de9d0ebef896ec9ad8ad84407c792a6e
SHA5124b6842ea93431b358bb4e29d83deaae0369ff6a8bcb9f68b3f16ff09e021dd704352f0ae8b2e0e946adc32310b595a51ed1ebf82e397c8d7142107a99a99a4fa
-
Filesize
581KB
MD527b867e444feb2bffbe759df2253fca9
SHA10cb399dc236592612f6750f575cef6dfadc44bab
SHA256f388401b941245e1e218c39fa1d10df450903a220c42700422ce77dae59bc58c
SHA512b22fb30316acb20942791af92500add3c849eb33ef4ec0f6fa1c71c8a06351d24e399dd1aaa78d3787df91eb86b99a547e24a920cedd5448ee004fce299e8723
-
Filesize
581KB
MD5781f7de4b202763b7782bdcf6f98325c
SHA18ad1d443bec60699ff70473be5677e4379a3a698
SHA2567eb228e896ccc475eaefb95db85c44bc9d91938d454ae902dbb976615f200cc7
SHA51295d4c1a2297d8bb26ea2af0c14978a751cc501a31297e6442844b4cc615a7425d9c4d33fff3efdd72ceb3be18dee9fb41643415a570d398047507a20fc3ab24b
-
Filesize
581KB
MD55c8b5a5a4bcbadbc78084e8babf78be5
SHA1bb35127a54665b18f8b8e543122fd7ad414679fd
SHA256143ef7a7fedf15120ebff1692c50b6bb6207ce8c5d2d0d0085e5a4e363501842
SHA5124385ae7f09caa9bcf14bd6ab0af15265ca2fc4fa6627e30ddc80856db54039e411bbdf949236fdd2f7815819fc821aaa1814b45410a94ef584655e394769137c
-
Filesize
581KB
MD5b59e764bf72f0a16a5c9fe1db7316303
SHA1be51f186a413dcb7a0bee6924e6a36d11f35b86b
SHA256dc07879f32238c1fbef41f1ff42bc2da4d959adf0ee1cf2485364b368ba124f5
SHA512be4761b03d3faabcb69ba7b5db672191f12be04c021d7fac4341df5dde81eb429c19775fd4035faaa384c550794c2b88935131c6b4f2cbe3c1735ff10bf6360f
-
Filesize
581KB
MD5763dc4114614c72cc2539adc79331a38
SHA1a3a55c76dcf30cbd9eb65555d5d93757cf59e419
SHA2560f6eb320a1bee8e59d9956a4b0a2c79564b0d5d79d8e24d109d316f6c5f6429e
SHA5121b6f3387ae4280df8c2b8744f2fb8f680d6590aa49dbe5f1b3da75bd7b91c882cd340044f2fe76d4ea3184e57bfb1796eb0dcb5951a6780a8b44c6a0749761ff
-
Filesize
581KB
MD58c9760f99d01c1c7d010d54ba996d89d
SHA1d3c15d3542b57933e29dcda6ae6c2c8d9c436d4f
SHA25602e9f4bd7cdbd0dc75ff4c78f7e41b2ac3c6d855326b96ec3f18ed5aef143f0d
SHA512e5f704ffa7f9d9bd75872d668a24299b98766df36f0630a2c12a3b9ad9cc1df92b1c06fe6c27a01163d2f94a8d823e386ad35913ad096a67ef03f796bc2e001c
-
Filesize
581KB
MD593d75d35097dec7b2353aee8c108776c
SHA16c776b7153be7efd22a9fd9b024a3501f8d3c742
SHA2564802ccd03b20f6c5ad156439104309d07823f9585f25b8caf6ffb659f6132be9
SHA51274afd3224511b88a6c33586d725ebc46271651f255acc10d6a8c2aa428fb700c54e34eaa817fd97116bd9784c5366d6263ebc68156948e9a561e6c52c4932cc8
-
Filesize
581KB
MD5e9165e228c2f452f689c7404958ee789
SHA1cacba5245a9f9341ad9e978039fe0f7005810ba8
SHA256c7ea5b406374511f4cc415549b4f2d556c894b57205fe5e79ff11a7721328c1a
SHA512ab5b54e3d7929314b3ee3f561a8e94bcd9e1ba1189d1a9056e2a508b92e0a84728397f2d9900cb4bbc29beeeefb85a4c20d7a83a5b5b78ecf5b82cf2ad3e65ef
-
Filesize
701KB
MD510816168ec8311e4b691df4248577b14
SHA1952eba14bd18925bb4de82d58d923012c713f63f
SHA256f076c9eee7f75760b4d47d2dba32a1f00ab8770e39daaf6cd9c751bdfd761999
SHA5121651ffc26322e5c817ff1f983e22e2227c1d39a8b2f3ed26247fe50213e6a62b24a963ab59ccdeac9eec917845205ec4e12fbe9f2ab1a85247dbf6de8ad2f01f
-
Filesize
659KB
MD51a59debbadf6f01a0f3be89ecc0693d5
SHA1009a0f6bd0aaa741cdfcef0aa79b473e5b309ff7
SHA256e6ca2ede6c430142b70756a3f8a1b27bc0bcc08a7e316251c7c77846c2600f1b
SHA5121b839134c1404753dad7cd2b6e7c2719358833ac092c43c7aed0853aeb87257307786565a145ad9f330afddf73c4fa459d724e05a9387217d9d219deaf5cf97d
-
Filesize
1.2MB
MD5007275aa962c93899d7c10c4cf716154
SHA11cea3c62e3b5fb0e71dfc7b36c6946501d260477
SHA256768c53d9397c130716e9d6319cf2c7b70ff1583788de2f977815b76c518329e6
SHA512f2653f5040a5f6f87d0fa37701814fe3d6382a1a1c4d7b888f4088bf5f4baadf7e17523ba63314227f02b793117fbc3ad5d9066a1c94f42bd3e1d52018224bd2
-
Filesize
661KB
MD5da011be7dc1bce25b2849c49d90e2799
SHA11bfebc2e0c8533323d017032c22b644594ceac5a
SHA256d4baa395cf8c25bb59177f4a3b0c763699df168a459f47abb6d24f4fa84cbb4b
SHA512524f6f774b2ee1b310f80ca081d3067c7d1088a2292a1b9a03ac75c8c31b663d19eee4664b5c4b04a82c7095340f077e8da86fa0eac81726569789f3103c89c8
-
Filesize
1.3MB
MD50d911043558699bd9e130b755dc2e2e9
SHA14e1022b1c2f29989ed7a4914d9effcd574a61b18
SHA256f82316e79a8497f774462e445444e5ed2cc1aecbe122d5d38140b13b90697c89
SHA512a37442f2266723d1c02c94cb1e8956c6b15cfb70a71f25a831a72e1d8ae8ad69cd89bdc9d14a6d58f55313cadc23a6ccad6e331c2e04ae1c8dfb829381501c2e