Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
20/04/2024, 11:43
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-20_3c35ad1633d9aa044aaa7c837d3f8d3c_ryuk.exe
Resource
win7-20240221-en
General
-
Target
2024-04-20_3c35ad1633d9aa044aaa7c837d3f8d3c_ryuk.exe
-
Size
2.2MB
-
MD5
3c35ad1633d9aa044aaa7c837d3f8d3c
-
SHA1
34a0ede3f4aee18ca4a24110ddafe19e4ff4f81a
-
SHA256
31886ec9bf75540ca20ef29b794765da2d92dbd8b7f592132213131a7a833356
-
SHA512
c887bea9f946bf10ecd2561e1be9790b8d9fb5ebcba69ce2f75adecc2bab3b18a40a3b221f1a1755be696d6062ddfbe280ed498b3aba7b128accfed01fad842c
-
SSDEEP
24576:eOObVw4TaN1wdFukCba4oXtgLhU3wEdmh58MvoKFLgYHJWwl24C15rDY:eOOh3aN4FuLbegmtGXQKKYpWwl1+NY
Malware Config
Signatures
-
Executes dropped EXE 6 IoCs
pid Process 2484 alg.exe 1480 DiagnosticsHub.StandardCollector.Service.exe 2632 elevation_service.exe 4836 elevation_service.exe 4756 maintenanceservice.exe 3284 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\system32\dllhost.exe 2024-04-20_3c35ad1633d9aa044aaa7c837d3f8d3c_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\System32\alg.exe 2024-04-20_3c35ad1633d9aa044aaa7c837d3f8d3c_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-04-20_3c35ad1633d9aa044aaa7c837d3f8d3c_ryuk.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-04-20_3c35ad1633d9aa044aaa7c837d3f8d3c_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\ce45572cc43e60d1.bin alg.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe alg.exe File opened for modification C:\Program Files\7-Zip\7z.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_72093\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe alg.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log maintenanceservice.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{2E67EA64-8D74-4AAD-B11D-5C46D99A6F7D}\chrome_installer.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe alg.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1480 DiagnosticsHub.StandardCollector.Service.exe 1480 DiagnosticsHub.StandardCollector.Service.exe 1480 DiagnosticsHub.StandardCollector.Service.exe 1480 DiagnosticsHub.StandardCollector.Service.exe 1480 DiagnosticsHub.StandardCollector.Service.exe 1480 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 660 Process not Found 660 Process not Found -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 400 2024-04-20_3c35ad1633d9aa044aaa7c837d3f8d3c_ryuk.exe Token: SeDebugPrivilege 2484 alg.exe Token: SeDebugPrivilege 2484 alg.exe Token: SeDebugPrivilege 2484 alg.exe Token: SeDebugPrivilege 1480 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-20_3c35ad1633d9aa044aaa7c837d3f8d3c_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-20_3c35ad1633d9aa044aaa7c837d3f8d3c_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:400
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2484
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1480
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2632
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4836
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4756
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:3284
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD50acbf6235c0edef0897415d6f67c9fcc
SHA18ebaf8673e5e8ae83c1466ed6ec47e1c7cfd92d3
SHA256c8e59da95fd0c803dfacc955146617429107ade672e5d448707777995b110c86
SHA51229458fec23dd8ebe7588b4c2418ff02681e54edffb45ab67e7e09c743916e5af80309e4b572199d3f5cf09e394315289bf3a0d1f305d5c7e6305f1d749427448
-
Filesize
1.4MB
MD587e0b483666c9f7a7c34e875f7ab41bb
SHA1b25d72cccdda25c7f6a9be8d3acbb82d047b0da4
SHA25617181c5ffb06794c1b4874b33d06f2d746dd5831eadb871786a2794dc4cc43d2
SHA5129f8e740456ff38257b418f304d763752fd3825957b3f3e650289e10dae1a237ba07db63d738adb39767c0410a3227373d0b499a6ff086fb54992442f9d1a0984
-
Filesize
1.7MB
MD51ce7537d63ce1335a7c74a7109ca4c51
SHA1ae31adfdc9947f328b28b6cdcc51ef6e3a9b0984
SHA256bb4f164ecb2cba02eadbee4c758e2a0708fba0c2f24a025ee8216bce57c5eb8c
SHA5123aacbc58aa30c741825db8887a2ebcf47e0cd48b638c2919d1dd40c2020532d3cb6c664a76780d41556a8144df4c05c2da271f2f9c64bc9b5472d3bcdeadd0d5
-
Filesize
1.5MB
MD5af005f49d40fed59e8d5bb30ace864c8
SHA184de2732b5a52cc231bb8270116fac976843ebe1
SHA2564535fa06f77654fc1be15f6e1877ed38c8387feb333ec3c66ea33db4509f45f0
SHA51273e2fbd73663bd7d73e372c0bb3db57137a6e68226c6c000a4d3ff2f04b7bd62198aeb69ffb943722d77abcd11ce86da8e9d10d8059ece07ee28a43b831af61e
-
Filesize
1.2MB
MD54ca0b3523aa7a0eb6cff760282e52ff6
SHA135939cd20a156165db66a20ca1fe06618e055719
SHA256c6970235aaecd2993d6b96d6e9ceb006c6a5003052d4f6c4c7741e57dfcf2423
SHA512c993da9fa77793920dd1c656630a8cbab7b17380efb0d3ff05b3946dbcd1bb643b2d2211ed6cc31af705de5240fc7f419ea2d80d42cc5a98d54c2b716e2a35fe
-
Filesize
1.2MB
MD52f29243b26b29c233e4486dfe4bb0f35
SHA10a790e7ef9dd8f54c7f02ec7f943f85b6feecfee
SHA256305178b5c73399c00e1399812f1f3135a45809ee8ceee775aee236b4e681bf87
SHA512795d4508603e9174b2bc727293bdd72cd94b096c2a46ac152cacc21366066dc36062375b05cd272e2ae10ef0a4543e947734b9cad88e067ddf306ba8b2332d61
-
Filesize
1.4MB
MD542ff6903ac359b92ce90f64d0d236948
SHA1d1a805b8da4480a18792e1196b708ce64353a2e6
SHA256f05a91d54928a3c6374c090d649ca8a2f17e7a9bda68def648dda17b490800dc
SHA512e7451d5a0db87b715638bd965f12c8d778e6dbd5b61e921545042f1949df9ef345071ec21b53c0d1948f7054f0ebcb7fea082f9d4c554cef8f6c0fbd870d2c21
-
Filesize
4.6MB
MD5207e71730ab8a1e441b4da319d6afd87
SHA1ea24e8af76da5de7e3db726169c2c753421c4dca
SHA256e32fe09865568b8dd7be26501a0a66b3776e32db9c8168d6cbe0a999656e20b2
SHA5128f2319c11f6a93d22c6f4ca4f681c1ba27ddeb4e8188e9ade346c145adb8703d3008e022ec34e4b90c2c04acb0221df80f33749aebfd501c08b055bd9a71607d
-
Filesize
1.5MB
MD5377256861c0b0c21f03d93ca276bf7e5
SHA1cffe494d73f88edc0619fe8ce1155ea2dd4879cd
SHA25669fe2c1912902bf6d62cd47e41037f352ff8f0a1d8c083c970bbfaef75921d63
SHA5123c2f3c59f37db2e7e58d583b815c69d2a457a00ddb415de358d530e3e0e50280c67e6835d30fafa241dad60f25ebfe28606a8e793eed91ebacd3df32e933df25
-
Filesize
24.0MB
MD5f1c827631f2d5e8ee702150ed95e7697
SHA1abeba339a6ef159dd7b60644ec54a7510999007a
SHA2563368ed2514621af1d62e14ac034a1013e5dbffe74e37e38b677d078aebcc9cbc
SHA5126dd5f4a720817306f67a1bc49e1f91d36328470ff37d76d07c91952fb10eedd2f9118f2a1bf7a88e426aa149d039a857239ebf9c69fed027b59fbe77e1ca3aca
-
Filesize
2.7MB
MD50a4adc019b811255de265c54078d2cac
SHA12f408aa01bf548e623caf8633ccf00f7b80abb81
SHA256aee39a27db25d67db76a5fcef8f6b8015cadbab5683385cc9a12cf9cd4349b9f
SHA512726a10767ea6744f3613e559e9cedecb9bfd90de2a731d4858f6aafa6d093fb452f17aa1c6a73d0224edfc16abf507aafb6bf35104b46d6553141117bd3f4ba6
-
Filesize
1.1MB
MD54dda76797d0bdf4aa630f609e7c149f4
SHA12fe18078dcdded6873645fe93708c5aa78dc825e
SHA256a32bc58dbc6723abe4010e2ac1c994edaaed2e7efab3a55d6a6a96b7f480bcd4
SHA512c3525ef2372e30857ec679b0b3d5cacdad46d6ba2d83b2909da2ae5d85898910bd5fcdb3f7094aa469e0df3ffd88fa70cc313f3affc9e94e2aacdfa411d81b7f
-
Filesize
1.4MB
MD51652742b9463a6c8edbc7199e6852273
SHA1ca5adc0a00048495f0272a4fc3ca207e4a7c5371
SHA256dbc296d7855648d6d4f6ebbba2454d00f23d62644365c615f34514065e55b578
SHA512f085bfe4ac9baae1ec7630d06712fa0a19ab2315ae3f45c271f46ade26b3569cf0cc29496d1360ba0d1229d4f1b5101ac65913a2598dc1635170f399da110091
-
Filesize
1.3MB
MD5fec3db7151f3c94e2cab4728bc5aa994
SHA187d3bd7f002e1dcca61bea285d1220196d624761
SHA2560dd2dd1f3594e8fef35658cf2e1fbd6d614c6d3646f6810f2cc22eaf8da95da4
SHA512be453c64bf468cf911199dabe3ef1a16de7c7e3b64845911b4260fdded6c421160647a48d7321826aac367eacf31475f3f188df6016bc61146364e010116b7f7
-
Filesize
5.4MB
MD58ed89954aae5514a34af77faf1a82f6b
SHA1d30c733db6ab1ac6492e9ab7bc7f706d4c57299b
SHA2569b99ec007dd65ddca03c3bdcb61fc4228d4d474aeef14f10bbc777ef4f003bae
SHA512da351ddc7cacaab7bcfc69a492746725b0a83dfe2e9e824a5aefa4ab73a394980124f49cab3d65647577b0ea8f21e1b7b9c0cad979ebad8ef051ffa36dc8f372
-
Filesize
5.4MB
MD5ee4d522c7ab34a02bc527f982d5c3ee7
SHA18f9c8178d2b790b193b9f337513bfe8d94d3508b
SHA256d126dcd6bc2f6cbc68046c606b330f7cb64d8a0d03634f6db25022d2ef0213b4
SHA5126de1f945f5ad47ff7a90ef701ddf3f73cd47c782feab61ad9ea036ca143ff74a20405c5e605f5183569d76913483f5e1724fde6ef60775cf2363c369657df323
-
Filesize
2.0MB
MD5db6cd70a73f15ef092a2460a0d17fc5f
SHA1dfb4e9ccbd9eddb43e8f073dff4192a07a34c07d
SHA256bb2d523f5b74b2dbb9af6336ea2c236d0e8405d474fb66d30d3e2663b26c5a83
SHA5123deedd30bb456e10e0effb3069092c6dc4b94196f52c96482b1ea570820efa0457be6d20b56f020b8aa14384dd001c285892cfe12b25e50d6d83de4a09ad722e
-
Filesize
2.2MB
MD59fd751a70a1f4525ddc2d158a02d333c
SHA1f39146e42b1916ca6c9b4a1e59a435088bebfbb0
SHA256f088f1a0e8f0614bea4867c95f05e35bdc36ecb4ff6fa7e08c9967b9bea6a1af
SHA512b8f5d9a9ce1cca8e2b4c469d7a2afffe683bd24a677c6219da559084b12886f10236f6aff40e0acd7c3de175a07a225c57e60a20d36eff68f683a001c16b6aab
-
Filesize
1.8MB
MD5b1d9ada53615b83652864cfae70864fe
SHA15e5bba2701e27c2346d7d3aeacd49164b3883f70
SHA25616ca3927ee92047e926d8541a89decdcb5c046f1e6a84282c1fd5cc276de5d4e
SHA5125c34aaca0ada2031cfd0815d83eff640c8e6c8e20b234ae832805f376c5fa717d5653010390340dbb105cb053fdc115c54fd82957fb0d64f582c2d513646d87a
-
Filesize
1.7MB
MD5abd34ff3ff58891a760fc3f4111da213
SHA13e9bf1b1fcb7452fd5ee21c5e8810be272437fb0
SHA2560ef9b2d4718e67abee059263550958a8fab4803c88b58bba60f697a9ab366bfc
SHA512d51687f1d828892bc8bc01b9471724fb06b217b9de32f31e3d2db67043f84677bb333d1a840514de7a7c29898fa9739bb0ea1328e7f2fccbf2d83e45ce2ea656
-
Filesize
1.2MB
MD52b9800caa67007fc9f16460793269c20
SHA1eabf9ef708860ebafd899f6c0f267d50bc662e13
SHA25657d4876f668f718948aa9c1b816e8f36e40fc63b88267fbeac2db7a7bff4978d
SHA512cc04a3f02eb88761c8d78aab680c304a0233e47fceb5635a61aea59c893df3ad27f45112e8065586765539ce65d091507065623d5d0de7f0f459e44a3a988e64
-
Filesize
1.2MB
MD5995abdd3150163f8443e174fa4e3ce8c
SHA1cffa05276044c81cdcd22b4fa25543b2ec214f01
SHA256ce10166473cfa81274688bf69fff627c8f4ec3dfe8a1067ab42b56aa0a652c50
SHA5124cd6d906f8ef77603a8c77edc79239a28c224ee195f3517f387182f015f28c7a943dafbf49ea0cfe78c5c0149473ddc811dd936ef20b799f7e030f95bee7f557
-
Filesize
1.2MB
MD512ba676d345d93efba7785928779fdd5
SHA17127b06aa520db4ec5832e39ac17d3fc637cef41
SHA256568e42221eab2a86c9baa5558683fc50eb72e53a6c7c3f0fbd738e0fcc491143
SHA512a557d30bde25c36efbaa22c650d9fa3442cb898bbc6abb57f360bed1cc8ad776074540034db3a445f8ac77e192ebd059ca8d933332faa5a3b6ea62d4d7be0b44
-
Filesize
1.2MB
MD5d3db91ce30ce0388684a1c65bda1a832
SHA1746c96671801863f1040101e8b16132d9ec97200
SHA256c367d7eae84fcfc12766e43f98e991a5dc6303b12d3028deb74bfc939b75d755
SHA5129bd0d1154e5ecfc5aa367904b9dd45b83d49f6e21ca6c6b1b2df02209021bf182aed82ae93d858cca39ea9fa697c0d9ddf02544ed305be7f7679c99ee9e47eca
-
Filesize
1.2MB
MD54fcb8c34e182001a2171c92e1a47c883
SHA137967ec5f4924668cde93a4c9fd001b2035a6721
SHA2565bdfbe9a3c7fea67d052649767ac32bde72f76c375f8e00e0537fe0aa1b66a90
SHA5120d8a8225fca219c06f0af8f0c15a7cadabc2e8426d5293a431385ace361bf23e151eb2e3e97fd2619c665e7c3628b334643af14a30d56159fc26fd4d180175ca
-
Filesize
1.2MB
MD5f7bc3d2d179d50f339fa60aa624aee0b
SHA139b7792151ada64889c6626204d74ab3f5b47aaa
SHA2566f3a03062efbd29154516154e857df2220d6ebba47f93efdacd9fa7bfb7a1e8f
SHA512d7a47b63dbe62278f2b5c7e4b6d4c57592ca7df7e620d04ffc0456245430420e45de164153b27967b8fec119b673b077096164dc6da3f54f70969a20f0d9a62b
-
Filesize
1.2MB
MD54de8d3c0bbcd3d3d1ab51edab28941de
SHA1f2ec163c581527b012bbf1fd108a5bfc5fdee060
SHA2567e575067d0351d49c3cb4aab4e4eacaf4b1454b2a5e9b5562fca42447509bba3
SHA512c56e55958ef04959bb4817f97f70e09efd0b9a501847ed15a435e08b3d31feb06207acafda3d7ed9addbb1ca91b011e9fe51fa9e2cb1d1f644fd9dc55f48fbaa
-
Filesize
1.4MB
MD51f53a57b6f2f79ed5338654ffff7a320
SHA1059b43eb9e78c6f1a6f8dcc629e36cfb3e67a1f3
SHA25642f897617f6840da4ec2165c8f38b7930229a10ec0ecc2639b25ac55bba5ff47
SHA512ef2f69b1aa2c6751160284eb5da2eb77595a1dadb4a9616c94b8b63823b660792b5d9018d51263d24d90c72d2e663898bbd0d332807ac18f0468f3a421987258
-
Filesize
1.2MB
MD593af9dadb7e0b7d347311be1b5fda00a
SHA10a8c7b768e5eb3b13e8942e093477546e37e4a65
SHA256c158e3394af63852c7cfc4264527055b5cbc4dd734dd167763e63c295b80aa98
SHA512ba840cf794bd6c35c72fe87dcb8244b600a3175d03395906693f55471f81051f26926acbf717cc3e90143d78c0539ff96650d0a96a9d5ab6af833247f031de86
-
Filesize
1.2MB
MD55aeccd3fc33f73bbe6fdf3164c7163b1
SHA1ae419f23436550e36904cdbf2cdacea85430957f
SHA2560670dbdaad07d357f6a9342053f317591c7e6f978713b52034f664da6fa18fa7
SHA51253e917364be3c5fc86de819e099699d76ff440fa34e4bf6e640684e403f9a8846352a528501305b7ee5852ce9c80c8c39824acddcc8b126c613b13a999196eea
-
Filesize
1.3MB
MD55630393e48a246fb98de9b88bf7f4785
SHA1b77009baaf98cde3d1f2c12a39f62a7b19650825
SHA256fb2cdde790f69282a983c62b21f364ed964bb8dfeccae589706cf4638c0997b7
SHA512e2a5b52064fddb73eb6f4b0611fe47948432c6356e30e6d2d5792c734c23d3f3d278f8d526aa216e213a58409c6a86febf5e7781b56ffa4a96f6ff11ebaa37e3
-
Filesize
1.2MB
MD5254d5c33ad631fab0abba2fe727bf8fe
SHA110116ef6df690bd09e3b6b18dfce0a98f975427a
SHA256ea11db3b507dc90a368c55cb6b0b3f23d7e956984e7d2f080a7fadc3803f7e68
SHA51241bdef8211ccb5a9dc0c013394ddfeacd30e3409a37613801113bf5f1cccafa893d1545d1d9c45c40d6b3171b67eb57fb3e91b5ede4f09db5d87d129a2ca8123
-
Filesize
1.2MB
MD564d4d22ebdd7275ae91f27b30b122dd4
SHA16bb561a0db3dcdc77672409cf25a8f0167effc9d
SHA256a4d82fdfa3cbea990dc5874abdac651f093e98220fa11fea26bd1e28e99fbca4
SHA5122c275b97fc4bc61074b9778ad5c25af3527b5b8a0323e1a63c2241f76081b5050c4354644631da1be3fc76831cd59021b779ef2ca7cc14aec86cb7b5d1d654da
-
Filesize
1.3MB
MD53c02d6276a47708ab5c49621f2b54811
SHA1da8e6ff3d18201d23a66b728a00a56faf4343f94
SHA2561ad341f9d4c2e7e8773d138a07cbfbdee1686d42479e242d2ffd80598f172b0b
SHA51201e76af56f0bdb4b468fb589edd0317555f35a5d29723a47cd39743c30bc9b59c681bee91946bffaca090083518bae5a6c7bf8c9b7bfdc18c55e421f334286e9
-
Filesize
1.4MB
MD53f0f3f94898cd90861efba58b308747a
SHA1159410869eab57eac5ab53bd03a3eefdb482422e
SHA256c2bed40315a41d381002e3e542f6e3bbbd826697f1bf75f50a2c2879753eec01
SHA512fe16a4dacda50c55d92c944dbca9637cddea8d12443b66961bcec2d197238602e19907b27841d5bf3cafcebdf75f9e7fa01a4073ca157c2aedb0812e6232cc1e
-
Filesize
1.6MB
MD554ae83aba9ceedf5f800d206b07e0d12
SHA164d17da5f37e9b5fce0746c3e28a6ac64aa4b921
SHA25621f1779890fb34f7d3caf06118afdbff6cd8a54351b628258be7186571278315
SHA512bc479404276def06e86c6b49614d4751924f7c7125d1e01fca04997f68461e7624ffee407e9cc363a89faa8f1b3947e5e784856083ad15dcca7c920c9511e5e3
-
Filesize
1.2MB
MD5ba420af7a136d90a154727339b9e34af
SHA1d3ca4803ce3bb9e70f2249bcad051b67e324c3b1
SHA25651f657b48d9c317197a2f75648aabd6afcba8fb83339ee672a460a32436ed1c8
SHA512cd9e539d172a510bfc21b044d3152ed6ad96785e73a9ca4337372478b6f0dc9e8c744d36b19bca1e4af1854648d610f2717bf5032fe908177ccf13348c1688f0
-
Filesize
1.2MB
MD5fe1d0a46befbbc79659caaa625748ba9
SHA17f71d0c382cf09750decd57f9156d6ff8e4330d4
SHA256019b66346b8c49b0dd3de2ea77272a4d5aff91db1b828f743fa2b22cc6dd47b3
SHA512660f4b532eb11dde4d04c76ce04d25f30678cf4036c54677e01878582a6a6f215d577fb5c0dda36b50f19534883bbd21eec7c60b226219e3d086682fd42c6317
-
Filesize
1.2MB
MD53cbffcb5a487ae62fdf7c56781348a5d
SHA1fee7404b902ed1d2cc28a0c2ea60c391a92d51cf
SHA256f5103b952d01185ac02c268c40b73970d686589be8181a7dcebfd7b42eddf2f4
SHA5127c28e0490a6c332399f8f671c28468ded0fcd64a0d8e61f84b12b90dd72c4b72ecdd63aeddda3208e90126b589872d40292a586af547b745946547c49225d0dd
-
Filesize
1.2MB
MD51b653f4649e987f8c48158644bbbe242
SHA12ff28108374272f59737b0922c47e65a5d8fa62f
SHA25699f592545a8ec389133ae45a159bf9574318de549bca6fa86477e4752b23b326
SHA512ff55df3fe98a2b80aa59b265a04daee9a82f6af1f3dd50ff428d7b9d2345d9b8d23641a7d695b2b3a64d6aaca40f9b4a3d278deac7f3873a62e67ac6856f89d3
-
Filesize
1.2MB
MD54a0ac982209f4feeb7ea91f665bbdc74
SHA1fbc713713f812ebe6ac583752be80a3348c874c9
SHA256b13f8b95f9599c3c39502a6a5b3ef2626e5e3c4a07514510a63e0e11ce459856
SHA5121087c46cfa98999ad20e12ba8cd1b01d13035abdc23ad46d9ca618f6c7a066ba7dfda88ccfe767c625c4247734daffe548e42fa407ac63e38de1716a3132fed1
-
Filesize
1.2MB
MD5bd8794542364c632a1d183075bd978a9
SHA130596f6b1da18b94f2ac2412804d190aa4287cde
SHA2569ade5749fae1085b92bffbf6d996e852af7a4b79e560ae5228cd8ec7ef29dd33
SHA5121378e9693460b013e07b57c0774f5076f571b8530de58b74f26ceefd148de7a4744eab7ab19f2c6eade0ed7f3800780bd73e8d899427f67894566b655b36a75f
-
Filesize
1.2MB
MD56f51779efac87a9ba4a8e7a8609fc25c
SHA1c0a098ca525c297297321e2177889e0b0a977205
SHA2565d1247f21ff82d981a1ae0e2876f3adcd6c6f90f0cabf96edc710411cb7a3ba2
SHA5126d4dd978f9daed5de838a407fcd97d69f3dececf6ebe5422dab1045bd206c1da38e8a771f76df45c527949fe7455e0ac6206a75eeb2d57e2326a8b19de2456fb
-
Filesize
1.2MB
MD5e11f3f5044ce22c59a66e92d594907c0
SHA1c2cd64367a97679f0515592da528539dc82c5657
SHA25685002f4d6e83bf64fbbcc491e25ba556007e7d1dead564e75eea65923e56206c
SHA51257caee6896eabc415dabb6b46ff91020af92f87f586cc935d3d85ff236c9b8b6fa5e86ae439ed160327cba0ea5bf0aee70b9f26e15235ff07693f658607cb82a
-
Filesize
1.2MB
MD5ed7333f7de7025966bdbe93be32f780d
SHA1ffc08f265a428bd159ba65ab5df3085aa0dd8d39
SHA25607cbd93e568e5748da6382ca97c84235ace4538743454c84731e89cb61d8b737
SHA51270726a6ec0098a5b1a9c545cfda7604f591b934fe3086368ecc8849278a8b71cfb40b1acc95ed445ace9da938d34a3a10e2777299ec7dab6c8b7f61ba764ca2a
-
Filesize
1.2MB
MD56c3c430a0492db3fbf8bc1443ded84aa
SHA134a7d034ecf7a570df8cf1d8d57d065d5f5ecd25
SHA256104d293d18ab68670947db9bfa36ba1796036986ce4d8a8ff4f4fa8ff66ac646
SHA51283af4c37ac7e9f07caa0603f6d37edecc393ab743b3d952bfc4da6425ecb7838d978eb5254e5b4e7954b6690938553c39821e8b3f9703e03e108a098e0daff33
-
Filesize
1.2MB
MD57450734e26c3a2f203bc933e24904ce1
SHA1d31a8c4171f18f3813c11823eb38031c49294895
SHA25694294c8071f32c16a87d04b69ce386cc61bccf931e9c03ddb65c9358231d8e3e
SHA512d4ad27bd71028f8476c0e94e4c35e5f8edee1f09e54fe2bba4d0a0b715b50fb047b3ff7a89d8efcb2963b310e215592162181f95362ecfee24377328c5852195
-
Filesize
1.2MB
MD502638779e24f59c8da5227c63a4036d2
SHA15a420a53c94435792666cd3563dc09aa819551f9
SHA25688d39f744f0a2a1674de9d2eabb5d40574a7e6f2520eda9fb369671e2ae877b1
SHA51220dc26c6b37ffd61aea25a947cf58cdcce5af33d4605f53404814398b0d6c21aa7be6912da52503c27e1369806fd8bd7240a2451712dee4148222ade61abf3e3
-
Filesize
1.2MB
MD56384cf6eb4f5b6613f02160d8018676e
SHA10abdf461c37d340f7f94e4ee1defc313af5d633b
SHA256c9e410fd2da57b2026414bae092e3e7f1324c066ce1779c29ae33e3d9a66ec60
SHA512a9f2a698492a910fcbf2dd180a2ba5c02fac121efabc5a1df689f8e7a826c757f1b416ff80fd3f21067e2555579f67b6aee08b82430d138913f4a706ba549c7e
-
Filesize
1.2MB
MD576250ea5d34b230a954f69e181a64a50
SHA1e7d729ac2c6c81530dbbea040cf30793ca15aa8c
SHA25667aec042c1b3392008786e4ee583aba610292827844e1a293d50110d68777a7a
SHA5128488e54b9251b43f1e4cc352dd574962069af3a588ce962bdbd6f2c0fcd29314d0f36055d37c7cbc335ebc9fc22188b52cd604aac0c788b99258400cb9338bc3
-
Filesize
1.2MB
MD5b90e5af6ecd0ef65533641d28258bbd9
SHA176dc5f4a3e0c7eb7de2cff8c539631a0d9d1d781
SHA256f7f500ab53bac99414541aea32d9b2b63ed10be6ec7771568fec86455866cefc
SHA512e5d79013bb520c6b2902bacfa5fb3ea5966c822ada8be51c8024047a0c8e55b19ad54767ae1a5325b8307d46a9730c407881c24388e602e40a9084933a341f71
-
Filesize
1.2MB
MD5b8381bd1f6435caa950fb2bc2a516d28
SHA1cfcda84fbbf68ef3f30b998e1ffc99075199acce
SHA256888a227ce234aac7245bfa0ec5625bef35cdabd63fbb9b0ab439e3d82536520b
SHA51205b178c4362b392ac999894693a7e49badce4a8780c2748b4034d294d79a667013217b7f5c775e5e3b958149eda88146b05ad03075076c2dbe1ec19b67243618
-
Filesize
1.2MB
MD5a54d66aaa1330effb0ae261b77ea9291
SHA1c813562f08856f80f9f6386a596ad0c782730136
SHA256ac39244cb956278d02afd75503b281ecc017232e81eabb61dbf992752a92d944
SHA512ca59528e20c671db597941f0eb5780be7479dc1a7678e3dd4ab9df119700f625bd2b362c9d37d3ae6b2293010dd83e2034399cfdeb9922c19e24ce48e0a255a2
-
Filesize
1.2MB
MD53f21cd5ae798816687193dc8b254f445
SHA12e22163100d59164b7f6421234491e642dc89394
SHA25626a7f91f0f5e88c787da0ac0e1dcd0c14b4a4620990b584e98b79f3fa79833e5
SHA51241e30ed317324d750dcc3fb6254176c6da22c28f4742dca4d5327d4c3a67838b051eb6511ac8f8f693cc00242473af73766b5d06481582d48866a3c59850b16f
-
Filesize
1.2MB
MD574a785c1ee7bc7c1c2852f6b40fb9b83
SHA12b29241c2bf9d9f9fd6799efe41fd3dc9d4bff93
SHA256b0617c70f7d0d124426bad1162b63a6bfb4f02355b0d4682ebcc817c515910b2
SHA51218a82a8844702c18c5c99f1cb42e28896aefb744ac69b23d32bf7a445537e4822456323cb5d9ac0e315c38f271b57e3559b4a83d2e9c619eb2985875438a687c
-
Filesize
1.2MB
MD5fffa925c746ab320159382fad807a92f
SHA1c04059c0d861035b63d9e1d01ba07e4fb2e9e8f6
SHA25656433f48c081455bd9af16c4da42b60a5e8fada817e1a5de3dd75bb8ff59cb95
SHA512ee3781dfe5c49e30e55d175038324c7aaf8424783acc641c3e3fc5a80add634a3b2cb6c0604ac8c40214cf7b5099b31f8069c43a9ccc56bcf422f26135951e1d
-
Filesize
1.2MB
MD5ac0508787d785bb01d56873e6447ad85
SHA1c6344949408ae936d08006129372c537cd365e1b
SHA256cf0a53727ebe5a391d136c0a57dc7ed8e0f3c2527adb1a9dd15690d804a09b38
SHA512a2c99d1f5112eb211ac9b91109270b234ea86df9dde955b24e9d4b6f4d4bc1d1a8365913e09bc41f41cd6cbfb14c4940acfbb16adb430b074d341ea1da96e013
-
Filesize
1.2MB
MD57fa08506298262cc0a343f4c3561b742
SHA14fbc6db1e37e2ec673900b9f64ab5a3e14fd2a3c
SHA2565b3a40aa1bfca1461f8d5527a0d88d842e4eb9c6af55ebe3b26bc820de978aec
SHA512780a9aea5cbe62a3f2747eeebc28ff94e313a72963516fe96b1bc12977a036c4508f897314fb54ee7a7e0f6e8a844b7be8379490b5ee32477b97d1b87548f498
-
Filesize
1.2MB
MD505e1cb0929a2014edd71023ae76e8215
SHA1b042f1d448b9fcca0ce03be3581a7df92d08c2af
SHA256a3ce509ff0fd4aef28d05d99e6255153f6e3c4f0d991d03995516849b1fbfa6e
SHA51298b82ed54ebd0bd7e72f326330a0da5d6961a639c8f785e7f08c97cd78ebaff68782c85a615fd01be50c7e3932814ed0d2ce1b98d6c6944ffc6a34e0cee557b1
-
Filesize
1.3MB
MD52d8d91c228f699e2dfdf7aa6798d9a65
SHA128559d14f0eab6e3c635c272995bfe17b4d32a80
SHA256a3bee41cf71a0584313fe9e88f1b59f97be45c1d5222082757a049ea96f0b3c2
SHA51254447cbe7453cbec2729e0cc18fc6f360aeb61dae5f0da7730bd533bff90c2b35f6852ac77d795f41b3664a7ff68153de2c1a06d09119e6ecc263a38f166d404
-
Filesize
1.3MB
MD57cb9e89ab3f27e257e04a510b24c379c
SHA1a52a17d464f6a516a18db9c1581324197cc49b15
SHA2560f3c66fbe0691497b6c783b350596044044ccaacd1e926358064ea726fe6e426
SHA51202d89062729057cea78fc9dbe58f89204287bc20d721e2dd9d0c7cb94843a744e595bed5b321faac73a1e9fa6d1ddf67d181267861776c25de3180d31364c645
-
Filesize
1.3MB
MD584407977a0e36ace2d7bb38e85e68207
SHA116de304849e838e9a3b49c6e0b51749605cc5093
SHA2560db42bf49423e8dc8c0650a59aefe9b058e220b9b891eebbf5aa30f93919d40d
SHA512be56c1717278130ba3d57a647eb5c950bdf62d60fbf18b1d39e9e26c9f2e2af2d2778e87deb87708d6f3c0d95c8919ec7b9b7fd237cd6c5919a6e3ab293581a1
-
Filesize
1.3MB
MD5107aa4f301f1c212eddb1a6ed5fff573
SHA1f1e46c3bbc11a884c7588088652a6ef6c247d65e
SHA25654f0d583ac3d6c9a65538d50f7397b8d9ae9cde41a15dd3c2a2f07720f69cca4
SHA51295984dfe05f1abd426a05ebb972aa71100570b38900054f353e10d6e8bc6eee6ac437461a38d4fa53efdb1858454067421fda529b7965ddd550d7485aa781aaf