Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
15/04/2024, 17:41
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-15_629a83c21a785bc622335eafddb58033_ryuk.exe
Resource
win7-20240221-en
General
-
Target
2024-04-15_629a83c21a785bc622335eafddb58033_ryuk.exe
-
Size
2.2MB
-
MD5
629a83c21a785bc622335eafddb58033
-
SHA1
8b87bc55721752cd8fd95041f3ec8d7df90fa74c
-
SHA256
57ad28827cc9e654a1d1686fc106cd15dcb6de85bfa24fb9f6970cfd2dd07117
-
SHA512
e61f4ef57546cb43c1b690f137e2a1bdd4fd994d3159c638972eee1baf731b7ccd1b70474b9fa6e0c56dae1b79b442708f2309c06ee01dc83b50f6654f894e65
-
SSDEEP
24576:MOObVw4TaN1wdkukCba4oXtgLhU3wEdmh589t/sBlDqgZQd6XKtiMJYiPU:MOOh3aN4kuLbegmtGs/snji6attJM
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 460 alg.exe 1868 DiagnosticsHub.StandardCollector.Service.exe 4368 fxssvc.exe 4904 elevation_service.exe 4084 elevation_service.exe 1856 maintenanceservice.exe 1528 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-04-15_629a83c21a785bc622335eafddb58033_ryuk.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-04-15_629a83c21a785bc622335eafddb58033_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-04-15_629a83c21a785bc622335eafddb58033_ryuk.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\91a2c39db3e2edcd.bin alg.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-04-15_629a83c21a785bc622335eafddb58033_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-04-15_629a83c21a785bc622335eafddb58033_ryuk.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe alg.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\dotnet\dotnet.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe alg.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2024-04-15_629a83c21a785bc622335eafddb58033_ryuk.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 656 Process not Found 656 Process not Found -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4292 2024-04-15_629a83c21a785bc622335eafddb58033_ryuk.exe Token: SeAuditPrivilege 4368 fxssvc.exe Token: SeDebugPrivilege 460 alg.exe Token: SeDebugPrivilege 460 alg.exe Token: SeDebugPrivilege 460 alg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-15_629a83c21a785bc622335eafddb58033_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-15_629a83c21a785bc622335eafddb58033_ryuk.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4292
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:460
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:1868
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:4492
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4368
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4904
-
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4084
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:1856
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:1528
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3732 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:81⤵PID:4996
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD595cb7765dcf985a5211c426669f8359d
SHA12f8f9efbf72ee47a2dc3921e94607674cc8a5955
SHA256673ae6ef516f6025f61899ee412ea8537a2fb8504d9d2597a75f7df2b7eb23a7
SHA5121be2af6aacd60ec897ec7901efaa7100734b741859e93bf95db8d65c3ec804da6e48d121eb67eb0ddf2ca3f7acc68f6178eacd41b13323d8d72bf56a748b9788
-
Filesize
781KB
MD5d5102661e5204172292985f310934c6a
SHA199649191deea67968c6f8f5ab2add607625865a1
SHA256e0b32111fd0dc6e9fa4c7b2e867324eb9455a7d9f2e741761ff738a8ea75acf4
SHA512c81d4933c6bde2225e31b9a34f23c81dade67bc71f169c5daa2a78063358437dd1a0181156c77f34ed1f16f440dde9e5dd8d504f25a46ecc0ef4b2c64b06a006
-
Filesize
1.1MB
MD5f51028a24193b1a5709157a581407a3a
SHA1708996933c4e902c089a3e51d91ef59c7088f0e4
SHA25638b62663cfa73f12a0b4761dc5488cfa58b3156ffee1258ef4b8a5f170ceb836
SHA512329c7216c884323ec61508ddd3fe05fd27f5fb285839b78498b83495dbd391f815faa3d2b0be80ba7f64dec324dc9da7083a18f1f4c269d8aa70ff331e1991d4
-
Filesize
1.5MB
MD52cdf1e4ddd617128478647ff093148c9
SHA1233820f91222ca55d74e6e0c715220eae781398f
SHA256d2c7fe809cd96bc9c92fd8490426c3134b6cb951b702da92ba7b68d335c4c3af
SHA5121b0256909b7b359156b6e65673f2f4224a5c50b9829c755daef5d047fb06750c5b83ad6269fddff84c5f217dfa3bf469b9c1edd27db157891a893227b9fd37e6
-
Filesize
1.2MB
MD5fd3f01ac818c7c06863e6c1cb337bef7
SHA1a4dd5d1234567523bb6cf38145bdc6920c35c068
SHA2564ba3f6af772d37c05a2b76f4757e274d169935d3df8dc31768fab52954ee8d0d
SHA51247560fcc9c0acbfdd32ee5efbafebfa1750694503a1c0764d43d400126742fd24efe0df3befe84e537394903c542e212e754dda6666661de148db977c8f3ea38
-
Filesize
582KB
MD509ee9acc171166c797e916809710f627
SHA1e051d3906dce1bf10298e534ecacb275274602ce
SHA256d3726790d50e2975ffa4e618545073a7a537b4ff96e7dc22a4155028c510d213
SHA512ffef6faed4a5dd281e72fee894c9ae3e2020185cbb9d6b0c9d590c9324eaa9dc37b6f2651cf8a2cc9194eb1c158950988b8fac859361c25f412c1f07b9e17161
-
Filesize
840KB
MD5c6d6ef987c41c28b7b1fdc6fd789a9de
SHA176b0073a0add1a43059bdaaf644b1612460df920
SHA256a84a0d8c264afed51c7429608c51f9f7f3fac27fc20bc55ddf76bcec91737cf0
SHA512ff7525bfb5abab7398bf86586030c5a6ab17121f4a282547ed100ba3ccbeaa108e5d7d5a07af21d0e43f1a8b91c8a1be5990746447972d444ff3ded5d2b4bf63
-
Filesize
4.6MB
MD5b050ad331c2564eb3687ed46459cd717
SHA1a3fe86514723d3e6ca75e88adc7113682702208d
SHA25642bfed9b7b4f66f886712d971bdf6645062488103ec1d41e258023d2d03cecd6
SHA512acb63ca7b537bbfae69dc8dcb99b5dfcc4e95d941281e2c375700d77bfe78a4752488b89a50d801bb22cfc8f800b3a7528eb6cb1cc70a226c8d161b6bb1b9dc9
-
Filesize
910KB
MD54c10e4c5ec01fcab6bad70c1ea717900
SHA1037f20c04cf465b3dab602fdbe5ce2eea8f0ef25
SHA256139ff0022f956d8adc77bf6e21699024c5970fcaec4625bc6587033566feb097
SHA5126f8b6b3623caae621e85220dc8bf12006adbb926c524e5de63dc01ff193ff39d4d755d0dbbd13eb7d5565e9a276a417028e0d52c92dbcc767b177949f42a85dd
-
Filesize
24.0MB
MD517e5694e477f165dad9785e88218ddfc
SHA1a95edac5b1ba4f834c6e0c926d6e43cb9875461a
SHA256449c04e63c953b80d550709340a401466b91cf55a35d332aa51cdfd2e182e0cf
SHA5123acda7682c1b3bb6f4028494cbfb5297c5648e48cea5b7fecd54f9639bfd24f789f6b29621cba9884dc09646c160522a4f8f3478c22551bed40c7d6449e8054c
-
Filesize
2.7MB
MD5add6f3fabb9f016ea6bb59a033fb71f2
SHA17d7b06c3f16aea934a4be86adf64a2d325778a18
SHA256a34e05b08a141c902c988a90b4953c5ffab9035c746b9c1f37fe4e3af71ff987
SHA512b3fb46a144da44bb6330b20e3e36e50841894b1ed1a18e9d1c81cfb7a414359179639bdbdc61b310d6d7fb9395d73c72f1d51dbb817968d03b837ea76e085828
-
Filesize
1.1MB
MD52d66ae5da367ede44d9988a4bc6c8b0f
SHA153d61fa6f2f26b57c6e5d38021a43ad93af1ca82
SHA2564881950bc70b0e76ad3dc4c5d88632469837bfc526639cd483ddf9178a47a36f
SHA512defcfae9713ad65a8812cdb4835193ffe3730bc3880353b1ac67f716e64c7f65a87ee3b0966d640512d00f3343403d0b136641140151ad628b3a279064422f91
-
Filesize
805KB
MD50c53ced764de99feda7e2eb38440da7a
SHA1c65eda5559dd8d4ea9c64c60519d19d203e1be1c
SHA2561ef3d9e50740d6a498b0298539a68de47643d13094c5fd9972dacf3ca3194ff2
SHA5129a13e1304a1230fdd9eaec3bc4997e0f8817d058810971554051026d492fbb8cbece0e042743afdc694d4d5d05dc88be7dad604c235fe30fc108304b6fbbdef4
-
Filesize
656KB
MD5af56a808b88bc74455738122074adc09
SHA1047a3d8ea90d72d6376147c2739d90ed3111a2be
SHA25616a97b77588c3a8d19e725d51e10a58e31573c9cf2c789767cb2b52301ea81ab
SHA512a53b2fc54284c42c8151fdcce37f34eb64117686090debb18edf1cd3205c4d5f469fc3344c7211ee0c68069e64dade040f7cb4742b7a3915c69ecb0daf72c2d6
-
Filesize
4.8MB
MD5e1338b5381695af773c0e5ed5e746640
SHA1bfa4cd5ab2d10eec6aa04ce818d971ae02858d43
SHA256f9d768bc62c92f7e8c2d3692dba416df3eba6328371dd19da52ab77782bd0aa0
SHA512ac39b72e65bc5914d50fe3d3ec5d5f4729b500ee8939b93b8f44d07b192284ce5653668846ece8a41037c3499019077ac5052ad6d2c2be64d8afc61973862704
-
Filesize
4.8MB
MD5dc462468a32347f0a1eba224e978da7c
SHA1bbc70b519cd9df7218d1b7de38b69cf44653258b
SHA256aa9580bb12dc115978532d3c40c30c3cd9c84d2d8eda819b80c2784396a9f6db
SHA512c4cbd51db901ccef1059f9f9597da46e2a36a7ac60533bd70557b8603f3ef33a33e69f78f67e42e782854412185cee62a33878bc2064ceeaf04f8a052677ffbc
-
Filesize
2.2MB
MD5c5dbc1ba114239fec6acfefc58aeceff
SHA1efb1bdb97b66f4f496fdb7b33ebc73996a66b649
SHA256da18560216e89eba030ee6fb83443df8f458e788a76b436130ae98cffde5de89
SHA512fa749ff365119361f7efe06671fea55b6f4c2212302e3f4cbba1e92b3c1a3f0d110884e8c4c33227dfe0a7e85022841bff6a6bcac5e94df3d5d490992515eefe
-
Filesize
2.1MB
MD508be340d90d0f7d5cc17f3285f78e7cb
SHA1cef01512599ab1200f978dce5ae7cb85e0820baa
SHA256da9b829cc5da89bf6847ac53f8c0247a71952b68ad892f2eef66db2bcdd55da3
SHA5129ab7bb2bb0f46feec939ec29ca5c516f8816a57ae9f06edc33d5fea57f6296a0c4bbb06c5893c1261b75c7872f1974e5aa1f042aeb0ef686199ba88eebd84c64
-
Filesize
1.8MB
MD52e43ca705d79f2ac0f257f33471bf10c
SHA1099022ccb0af1e1e5bb02c2652a2801f7235814e
SHA25637aa50d846cba7fee9f2cc6ef5bbce05bd55bce1bf45d73c82f7d993d38f90d8
SHA512708a9a20e641120f6874dd7be977907a6e53633e35e2fbc436d76fff14c63e0f17c113a43f7c91c97974a830c800dab22669a4d99bc01549b29edda1b6c91b73
-
Filesize
1.5MB
MD514339716f05cd6a2e61ad6de6ddd4f32
SHA12157373352c88af45f9a70f4f1d0d2300cc29bdb
SHA256abc9329ee6801e514c0cf99694ffba44baa6a0c46bfd926ab5b87a5dd3065492
SHA51232968147e60ac64e6c5591c65b962a5c3e913e59185ed4f6ffef035f1c26786977170f84de73899e5fa4362cde47b459e2b7cd21649b6f418b263f827a6e3cce
-
Filesize
581KB
MD5d744ea1b26dda6b793d7ea2b966b3c79
SHA15775b76257bb897cbdc04e3e38b4a02b9cdf6729
SHA256fd32562b7ddc3d6e31794f7bc8d0a51346f03d61452d8db7e52262964dbe88fa
SHA51209ae585dd27b0a673a0094bdab0f0fafe00fcf1bb78fabf631068f6ea57e738410ed26e3fd88baca41fcff5cc29a2208cdb1eeca9084494803ae81b67a448d00
-
Filesize
581KB
MD50e954c4e0ccce660bc81b2c35e32293d
SHA1119f3cbc62dd4413a362e11b75b9ba877ecacef2
SHA256f67e97006a669614f8a15bdf9ebfb03143335408df7b452642a16b521af403af
SHA5120d0035ceb1c86c2c6abfec87cd363935db2031be8c195c1256123299bd1f2ff4d3599afaf4b7f649215b2065e82bd0e68e95b5b9e0119da09cd4e8666e4d41b1
-
Filesize
581KB
MD5247a34e49224cc21fb1d9411ea71edd1
SHA1464c56a360386c6377a96437255e558fdf223849
SHA2566c1772c168a0c62b36992cb4bb51f0041a6f2ad8fed19f78837ecb1cec2ca095
SHA512584547f1e1c8decfdf96cb88776a1f790197a65c22e97055232325a80dda7f99e5ddc3b267c2fc229f1a4b4dca39b925438f36fe588c41c61a56c20798e804ce
-
Filesize
601KB
MD5151f124412605ddf27061c141e97abf7
SHA131cd66844c3b17e3174b988ca1fa0d4d41fd87d7
SHA256d4f10062fd5f09b7840824cdcf7469fac132ae092ec2af50e4075bd86e51d418
SHA512e15336c3de0153899224fae7821f895ea81177e2bb17ab0b85830f488b2983d5cb22b006623f992fd762d3fa986b517a17c94de883d3182927348084878fc34a
-
Filesize
581KB
MD52f2053d455cc5e23f2cd8b65ba11acc5
SHA1dc37a8a144e16bc38e4d119ee282816e26a01997
SHA2560fedb0842c575bc5d9bb7225f2fad0b9c8fd9e1fd3981c008aeb7bb2bf2b123e
SHA512828cdc9a319c4ff05ad9b1a211ccc795ce1cce92d022db6a45c5c6d64a31f964a3bdd32dc658fbc309e21c2cfd341aa2574df109e768e38ae48810224be24f13
-
Filesize
581KB
MD50079755b536667efae803450735cc679
SHA17286bdacb1727268dfff10ee8628768140adc837
SHA256c52983dbc23c1e6b9678fd3b2e3c1b5957d384814fdf5c04cb828dfd1709de8f
SHA5122683609fc31f59f9bce10c4b8429fc6e98b093e0abf5c4e3803104a8b4fe390ee7d3e557110d5e8caad26849f022efbe3f4c536ded66a0dcd236394113ad8af5
-
Filesize
581KB
MD51ea3adb7dc3634affbd686a314c3d4a3
SHA1b2c6d9db3be8c352eec89027d990e9678ad7e6f2
SHA2561e6cb752182f10a4b5ddc7e58f7bd9fbdc40a30d5f7292adb3a2743b310900eb
SHA512db94ff154ee4ab377ac2a363e2da6c8d34b0b04d134d6d774c1b5b565030067386b2480e81f1dd6bd36f251599581846d2dc6679c7fb9b50124c82be759ae011
-
Filesize
841KB
MD557dc57db7d10a2301b07e218ae292b9f
SHA1a8141781bc209114f7f5311dd17e2c0c46cb1f56
SHA256ac0be77b035e737bd638b70df169d6ac1ed1b5a6bfb9315b7c13b4261ab7e702
SHA5125ab8798ed2ad68ce5d16b5acd898bc633c258df2969384b1bee386d7831b79cf95f06f0110cf2cd0a9f94db1e112062db6c46d8bfb37856bf9f46eb3c5ba22a8
-
Filesize
581KB
MD599096aed457beef419979b87bb796c16
SHA1cd4fe1085e6f447e1b78628bfbefc1d5612db3ef
SHA2564393ea9364b7285952911eb6e26316b417f34cf592b9f729478adb64941b6a65
SHA5120fc7ae4a8ff870d78c9e51b23678beeb4b09639365fd433bf5a50367ec203188c765575ba327a58a93b28e74ef8a5427ee5bc308d013fb2aa270d5010c8c50ad
-
Filesize
581KB
MD5c268026eb01c4380b3351a62bfc54e26
SHA10f2b557d1ac0403bce95671262496c6537e85867
SHA25633fbc9b840642699c73405dbd57157028d6e0e7ccb10096c13a5a8cb90f6be49
SHA512fb43a18c5fa9f813089dc57c60e35306e898b3c027910fc7bfb94bb7ca1c7550d0f398e381a0371985997616c00f68564a5cb166d82b89b702873eca8b9b7183
-
Filesize
717KB
MD50d234cfcb218ab0dd7fcfff2486671dc
SHA103e00d6eca5b3e3fd46b2ed763ac196ee663dde4
SHA2562c9852d034364362340f4d164724805ae51c9d55892522fa888a24d45e0a1583
SHA5121e7140f510aec72a5d25ca48fc0b55b439245858dd019da1d7023e3610f4f370c846c169bdf688f7062cc19a3c7678def540594a43f0d1a3611ee31b1cbb5720
-
Filesize
581KB
MD506ee89ecafd22ecf7f0e23b128875e22
SHA190bf0710a6dd1d632f1c44311f3f9dafc59c0828
SHA2560919740985b5486dd9a7f41ec6ef64b3db1401ce09dcd3653a6ee3d68d1116b2
SHA5121fe0fecc68783eca73e14ed9faa582c163e9cddef9e57046a5e05869c0cb55d8cfc4614da42f16660d6b75e86c27f2d434d4c905cb50d1cf07119a0c5692c88d
-
Filesize
581KB
MD501b5f21d8ee7f39e2028b71ff322d898
SHA11b999e64b75dd9d7ca8f28e4ef6ac78b53aca1d1
SHA2562b85cc0e9b025439ad00ffa214d93d608a66df6169f8c96763eb378c2d491f48
SHA512c007090cf80de0900c17a4e6f2051d461995d83b33bff4efc2d8286b4a115c8c8dcb9650701a57e52e3add0fd47de64a4bea500bc9ee5a9fc1589b7688324abf
-
Filesize
717KB
MD5e8a4afecd73b83a2a515cee3699da4fb
SHA115b6aaeeb2579136f844c9890479de2cba974525
SHA256f47b88d3d340153abbd6e8077dbd76d84c4ea9fe73dd0399704db7726d940263
SHA512af83db4ddf22f212904df67c1d07d99e1311d6167a6be209ae25aac168dffb952f9303cb3c7e9e05cdc02ffe538bc62b2ff5fe708845364ee2c14e769ea16ccf
-
Filesize
841KB
MD575a8a8a3bfa5f910cc8305e25de9823f
SHA11ed28cbdcf7fbf4c007477e46cd71a7a7b6ba261
SHA2560ec8c4fdd597b296c303929ae9d679d024f18f643ac312b309dd3b3cc1b54750
SHA5126cf327cff5f2324c8e460fe1e45f53a9a9bad4c0e3a28d3d3835e6d6e20d8484747b42f6c1a28fab4a65684b22823a03fd27a2108be14c1d81823c0fa834dd67
-
Filesize
1020KB
MD58588527636a119ec1b450c8c98131edd
SHA15c8f6cfe3cb98490db284934b10441384b9c8bc5
SHA25659d44502c36dc7571103bd4a2ec01ac8b18887fc5977d2fa286dff2b15012448
SHA51200f5d0bd26d15b539dbe48d27d862e7f02c629335f78d9aca10fb712d9ad02ef0f69b12beca508cfbefc1be90af8513112df8f5846fb01faf77aa11e9f280e72
-
Filesize
581KB
MD543a21d9ab3126cb8375d17c27f9e0a77
SHA188816f4e967ac966c096dbb24ab51662bd89fe2f
SHA256408044edb86fecd1ed7f1cda23f1bf08956d301e101e9bc0b7bc764c5b40abbd
SHA512bdf46c2a6c362944a9f5373b1c6cff9a57e29acfd1d4f22a096f3f27c5fae3dbdf95fb64f0bb44f7cf91ce3173b57de069146ab74b02408485d50a0b9b14b856
-
Filesize
581KB
MD5136c18514fdc98e49381f793de42132b
SHA1a20c552d8769dc9740fa711bffdcffdf1f8eb662
SHA256c7ab713c54bd9d6d5d02ad6c78798535dc00cf949625359f1cd8bb20078961b4
SHA512901a9980f57f3b4f3ebc2395b49256de4c221d53f0eaf6b0adb05a74adfd6d3d0f34e6cf2d0ef9bee5d9f0c2d812dd2590badbc5e6b8b60a4524c538bb66ad12
-
Filesize
581KB
MD556243815dddace78d602da785944f841
SHA16067bffd4b1960ee65d47094c3040d5b046ba6d3
SHA256aebbe31102f9398f68d2f24e6cbef56341eab5a653582d0a6fe5b9f1d2d23900
SHA51214b18379bc22141b7ae66acfc671b018bd67d4b6b25aa2ade4d05393e9d88a3ddc08bb281515ec1ea18d9b425497afdd05a065f9e797c84d6ce2fed95233f82c
-
Filesize
581KB
MD5460ba3ef5ee21687f1935825aab3be30
SHA156d79c298f3b1195666e36cfe799fb39a9fb35f6
SHA25658b2c6578cab50d1fe372d97dcb4912b7877778707e5780e2491866abad8aa75
SHA51231edc519438860dda514c212598c602857608f41c5814de3db372ea79378d75eed77381b8c30269a856a963a25649f2835516f106b745a61d98dfd638720b7ee
-
Filesize
581KB
MD5bc22176221dd986ba9d9635d66145a69
SHA1386037c0d77b7f3737bef2d909a085ca3e2ab9a1
SHA256653b3898aa7f3aa1874d43e6865aef439f1fc537ba52ff434f28e9d0e5054995
SHA5121569182e941eb6934771ff674af395579e67bbb401e1a91dc5dcf58fc45b971193b752d0fc5ccc7aeeb12f6cde564659e46df8d49dd4696a53ca413a59c10a28
-
Filesize
581KB
MD598075eb21d54098ea7989fd78975fbf4
SHA134434b35b76e8faaa97c64802ed80bd30555bfbb
SHA256f89bf52100306a05eba65774043d063b85fba2fa4088e589c59bbf8f78d12887
SHA5129396df1ce719bc20e2d409169066fe110ddf6bfbd6077e420816c41b13c0a9d9cffa7ef335344e33dd746bd9024657a6d2580ac497358f6e9c21a581f0b8480b
-
Filesize
581KB
MD5ef38d2cf280be58af9599ac727853aa6
SHA1c77349cff4d8adf85ee59bcac60fe6768f774c1b
SHA25635ffa77bcb861fadf88f75d887aaca596dddbecf0ffc3f0242dedb84f487f526
SHA512be33569493600042bb02961801e996cebaa2681e4608b8363f51a6a4d5881be6bf6c587def4b229de85672ec865a2efe9fbe7daa144fb544b4a4ac6cb2fa657e
-
Filesize
581KB
MD5408d433f604daf328e35720e665600cc
SHA126abdb32e06fa6428089195a4de0fc403793c874
SHA256dd7b1d453cb8ee059d39bd83b5644a4ecc8fa0b533d03c8f0f911652c85d533d
SHA5126d8bc96613ede1134de80d69a789d00479a1add16e66ef34ea528134e46558deffc7d798c19b8e24e510476107b06e40de6194c0331f3cdfc92849106067687c
-
Filesize
581KB
MD5ecd0f4f14d010186958faf734c62468d
SHA1ef6bcfeaf41edb72a34f35f2356bafdbd816c7a8
SHA2563d49dc669ae64e048d3e3020947e12728ae7c22bc0529d720a72b65a4964866a
SHA512086767d63ec79ba3c93b060090e2d92bb67e04bc3f6a8049e67177127111c609927ffc99241a8142841259082bc3bc51662bb107430052777fa8abca1d7fff1a
-
Filesize
581KB
MD5bdf16befb07ab5043c46984d0f28e642
SHA19a256c26fa0d5e4ba2235efbb226f516509d8f7a
SHA2563764bfe72996af563fcd24a7d2e89dc5bf1a6319b9105e50ec82babd383950bb
SHA51270a7e3de8a000afdc6ed8aff6a15c5c05066a9fcf833dc02f9b64ccf7555fd039522efb987dbabe3bbba3524dd75a1e9fc56dbfda8dd537dde675780b2fb0bb6
-
Filesize
581KB
MD53deb7be5d5fbed6f0c7383a9bc841d6b
SHA1b86f8774a42f3baefb75c66d1a0a4bae28743fb4
SHA256de0a99b5ff6c77b2ad336bec2fa95e95a2c64c19b66b73ec7812e949dacb9d25
SHA512f7698c5f9e74ba392fd506e0b2881d8048c81d86fece3a7bcf9dfbae4a9af4076d4796cd38fc50bd914fa8cdc6372d80da2894c6d48116ac818760344d374f77
-
Filesize
581KB
MD522d8678fe0af6f688da34c5507044fd0
SHA1d041adc54684a64940fb2efca35f16a2c6f76d66
SHA256621bdf0338aafc531565b717083755c312a26d7b699cfa790935f51f7d01c9a6
SHA512bdd144f2da18f9bdab5d7a791a4cf44684f5e023b32f4f7bf2085c8d36b600bff4f196c69160dafcc6f9a8ddb0bab67e5f7c94a6a75b28794b630f0c1627506c
-
Filesize
581KB
MD51f8a81535f885558714a029e69a6b037
SHA1e44f1487f7ad7a93322f0fa06eb6efee61016329
SHA25699b2e2fa8a2ffca620979043e29d0957e62bfd1a66d6791fcbe2a86a9c97bedc
SHA512a4fe5295eac23cf202151c957a9eb7e1babeac928cc2be2c5643afb4a0a9f8664b7c43d4b989c662e61465fffbabed2628f9e187ab92ba10df78e3d438baab76
-
Filesize
581KB
MD50326065e592f4759477e975536bb919d
SHA19c4907fcc45f2ed3d982067726fcfba2b87fc4a0
SHA25697b739348f0265a61cb132fe5c4606c15760d0a814b7268ed5a2a223e699768d
SHA512bd6c937f49216eb71f33cb25789af5739696117488578494f2d27e40b5f5ee6b0aa310cf35db8264c21bc8b3b031bcfb9d51816d4e7617224e4bbe5020283c3a
-
Filesize
581KB
MD52ffbcafc74b590ceee80004f45d92f68
SHA12886f507ece1f28de581908638714d9dc4f21272
SHA2566bebed033b57d3f4f9d6709f7c4b71a660a6d257533b16c63adcc4ea643fb1f3
SHA512cdc07d9ef86ed8c33ea0d67637bc4afa3f06a945f0a3ac0e8768e722fe519da6b4f999d293ec6087da27ba934d3bf2a281f0a8d743b9a0d617bb8c368ad8ee84
-
Filesize
581KB
MD50b2a3c0105454b556a62ce65f925dc93
SHA17910aabaca1f2b1f29428a6637064c2096275acd
SHA256819993e3dda08aa3c8c0ec2b1ea278d3e8ed53e50539ba8fb5b4e166c0f01001
SHA51255eb604bc787c27ce741bcfb04cf27c148f05af034fff7ac4575d5913ed4c95035590b45fa9946c619fcb15e622315216af45bea0adfecfa5b14c17906e29987
-
Filesize
581KB
MD562c1917d328ae740942ee21c4a19033c
SHA1aaa02dca48d6802e18c842a622f592362c0ca063
SHA256d3c02225e3ad4953e4f4b6694a89394bbfa7ff09ffeaf349fa5c03977f4a6ab9
SHA5123e74f55965681adb306e7e20d33ed181aa21be781a448cb810a15e8d2ec09ae12352f28c610777895f6dbead1aa2643e2773b9e0b1be93c24c95de2c445b159e
-
Filesize
581KB
MD5fc71830042d43bf26d4ff26b354f980d
SHA198ccf9ff70b2d0c21cac5cafdac2c6310cf972fe
SHA256a345b21b574cab21c3cc97bc0935502e54f46775a7663f066a834d1db9c75cce
SHA512ccdfee7b3aa211347e6a7a153d837be04425b8dfa1f87187ece0f2c89531e8488ad09741f5f3b377a41d25eef303d332e4df9c792fad2be6322c62c878c1e992
-
Filesize
581KB
MD5976cc345e0930107b2f5028c1ef3c50b
SHA1de622ae6ad59f16da0ce1436cd5a9714eb0fb43d
SHA256b5a2c9513f6430baef6e0dfc5580bf144be83313aaf24692f94c86736c257621
SHA512b60411146162d7ff02118e2fd22cec5ecd948f80ca06b0fa25894de49ea0b50465de22c331c6618ff63c041b9b726a6ee42909877b3bfcd5fd41e30e355948c5
-
Filesize
581KB
MD53423c820a392db8d91358d97e5a9d256
SHA105c56d68fdb877cea557114a99c25d39fdb49315
SHA256feb7bd512c34c5874511da4f026dcbf70f45018f65b0acb542d57764405a2740
SHA512420fe560bb20904bd5d122e99f3a0b92c455c8fa9b97fd38525ae2cb3a8f8543fc4e5bd93cc0cea3a125f1dd78f1eef839e38dde60adf4afd51124af4b351686
-
Filesize
696KB
MD557a879b1f0b686c99e93ae5a97d6b8dc
SHA1dfda2c05b5c9ef62e1071f0d743749f4b2de7b66
SHA25639ca6a7ced127f741940f6576eab3db27cbea6a1d7aeb634c6e0965956bebcd5
SHA512c24e6c96f7b488fa3a55037264c7181079b430f278ba2d6aa3e76f3b59133bc1a2ca191a86e8d135b13cf7d923b59b01de716d15f70631acc588c2817a91202b
-
Filesize
659KB
MD55b819d31db01a28a47753260038b0f31
SHA1bf6e416be5846e65e2539aaddb8b848c03955634
SHA25692ded251051f82b9553644262ee55a358d680ba10ce70b8c393829e67c77f01a
SHA512733c76fb6a3a0cb60e0967a144219c75a990e8f81d118335491189b52836fa5f13f49f510bc8b4a0dc580754e34afbe99eec9805f60aaa9452bf9e1c8a75a616
-
Filesize
1.2MB
MD5281cc6f7bb487b22e6688dee7d6c370c
SHA191f585692cd7119d619a089a3ad3a1011983c5fa
SHA25682631535ac05c7f08e51fa0cdb5c92f0512356048f76eec00e42fc64b547ccff
SHA512768871668992263da07f17330ab172b63b7ddc6780c192491ffc55da5f7ba61f32620fabd66dc9ae8681ac2439022f3777e1f237ee17c4c37beb3fbbfe8600d3
-
Filesize
661KB
MD5d4d23523c8bc88991c37b9ca85f1c0ba
SHA1b076f59ca9bd7fbe6c5c1879761c56581e2d2362
SHA256e03d08338f86d1445d04883736280882a57fce52bcebff65cd153c4519399e1f
SHA512193f90472b34f60b7e2a625b660bcaf9e83708d36b440c81cd95b127bc7c4de2e6c01cb58d824e651f52892e5f1087e64fbfd6fb4925340826e7a5dfad1fcfea
-
Filesize
1.3MB
MD5ce61864d4bc73c0493e4de88bc544029
SHA1bd95547e772837ba28ca290a7fea5bc7640f3ff9
SHA256aa23b69d60bdbcf199a7fea2b3328d4f04c30d1a37cf82cb67efde9a28a0aec0
SHA512e2f39af838718e24fba6e4caf254fa69f93a270721440d32c19a54114ae03881529d09179063f3a6f4a49973a6b57af51d33a98b14a883ece2aeb705e5b47650
-
Filesize
5.6MB
MD56a2f4ff4ba55bb3ae8615b3f6237563a
SHA142f14db3aa37ac52b160d734947d72bdb698b32c
SHA25663ab969315896b6f3788fdb8095ab51a6fc07e6466143fa763191a3458955cfc
SHA51284695024e4e87dc1b0e0c495cb4bd001136f853fcf4ceab82cb476d5b0c4b43ef148e2c912b61ae2aacdf1b08bb18eb7bc01273ca40019ec1dfe4c25ab6b1621