Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
30/04/2024, 20:53
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-30_7a821f222c2e6cd9a36bf9b4e4f5920e_ryuk.exe
Resource
win7-20240220-en
General
-
Target
2024-04-30_7a821f222c2e6cd9a36bf9b4e4f5920e_ryuk.exe
-
Size
2.2MB
-
MD5
7a821f222c2e6cd9a36bf9b4e4f5920e
-
SHA1
cecc7b740eee486599ffa54045f6b6a706532a2d
-
SHA256
dfa1e51ebd7b57da990637363111b7f5e00470805ac135a6820433913cff6323
-
SHA512
d6d0cb3077d91faea24d3f9b93c17cbfdb98afa721de01b9a6ecaea95b7f10024f2f813ebb910ba25fccbba7f076fea556e55505050de3cf52af5e44605964da
-
SSDEEP
49152:YOOh3aN4kuLbegmtGHRVlbnXf9gPTTW7H1GXC:qU4ku/ctcRVlbnP9WXW7H6C
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 464 alg.exe 3812 DiagnosticsHub.StandardCollector.Service.exe 1368 fxssvc.exe 1904 elevation_service.exe 3344 elevation_service.exe 2596 maintenanceservice.exe 2876 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 11 IoCs
description ioc Process File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-04-30_7a821f222c2e6cd9a36bf9b4e4f5920e_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-04-30_7a821f222c2e6cd9a36bf9b4e4f5920e_ryuk.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-04-30_7a821f222c2e6cd9a36bf9b4e4f5920e_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-04-30_7a821f222c2e6cd9a36bf9b4e4f5920e_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-04-30_7a821f222c2e6cd9a36bf9b4e4f5920e_ryuk.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\8269b80aad45b396.bin alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdate.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe alg.exe File opened for modification C:\Program Files\dotnet\dotnet.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7zG.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE alg.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.106\Installer\setup.exe alg.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3812 DiagnosticsHub.StandardCollector.Service.exe 3812 DiagnosticsHub.StandardCollector.Service.exe 3812 DiagnosticsHub.StandardCollector.Service.exe 3812 DiagnosticsHub.StandardCollector.Service.exe 3812 DiagnosticsHub.StandardCollector.Service.exe 3812 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 660 Process not Found 660 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2912 2024-04-30_7a821f222c2e6cd9a36bf9b4e4f5920e_ryuk.exe Token: SeAuditPrivilege 1368 fxssvc.exe Token: SeDebugPrivilege 464 alg.exe Token: SeDebugPrivilege 464 alg.exe Token: SeDebugPrivilege 464 alg.exe Token: SeDebugPrivilege 3812 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-30_7a821f222c2e6cd9a36bf9b4e4f5920e_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-30_7a821f222c2e6cd9a36bf9b4e4f5920e_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2912
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:464
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3812
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:3540
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1368
-
C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1904
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3344
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:2596
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2876
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD58686d1d43e8d1c02d4fcc6b49007ae08
SHA15c155c31b8771f170dea0058f463fa023ca01a3c
SHA256ba13692555a4d99bbee0b05004cc8d4d0cd8714e273a047e636367102673bea1
SHA51202fd63c925ec83ed0909fc0570fe7345bedc66105dc6f1ec3d370bea52e51611e84f641cbf137f4dd4f31e9c3766e0d6ad9397999c21eb0798619e5c088cdbf1
-
Filesize
1.6MB
MD57086126dc61524d9fa4b38bba997bae7
SHA1d3a536ccf041dba18ed0f61f4aae40196bbd4f69
SHA256db619aa2a7c37c26ceb2dd1929a2af317e3b4b1e0996565d893b1b16237ea138
SHA512017ee024730c59d7080cfa98c454b4fa524e0b003f18ad57c7ac595891e1b75872079c93075777aaa064182f595427352aa3c57bbf5210cc311e434597211a5d
-
Filesize
1.9MB
MD55de7752041bad2b4c8bdff8451f011ae
SHA1e456c5021d7c4857e751fd7d1dbf60ce67c98738
SHA256488c51da480140c10120368844de86e072a7b457819175d2cc1893ecdb4f2afb
SHA5126a6a577bef4cf4a1aed1b0a70bd4c8a2cc1156ce9ae52b56785238e1ed4943cad8ca95275a0888cf86d118545c38540a510364e9a6d61d63a2b10b28d8979557
-
Filesize
1.5MB
MD568dce46d0a8d586b6fb19830792fb6ac
SHA17187e473442c015739fed347f007fc10a05184e7
SHA2562792e06b636a852901097b0304870609cfa6accaa14866d82b38c2d7c545e34b
SHA512caee5d39c25c6c2ebbcbf7f5fe5762dac2eb35ca986a9ad0c1d384a16cf4998fe587132b2bfbad121ed426bedb46c0d06a10fe6c1dd8717dd2ee67a3ed42da73
-
Filesize
1.2MB
MD5a84888f50d3b7225b768850712ab22d1
SHA175d61e3c472abb432feb01c0c8f402640c6ed4fe
SHA256019e2e9c1032e3599c69dc93edcfadfd3b42c2bedbd02aad2ecd0c6d4e6bfb0b
SHA5129c443a343f58f3a5332bbf0754721d05ea3279c627f4b660ae12fd0b64ef13572083046e59938445199a814f07a51cf5b89e2cb0a82f9043c4c7f223fd635187
-
Filesize
1.4MB
MD58939dde4f2c50a22af8917b2e8116faa
SHA184f5afaf383fd7e182fe66943c8fd88913787b27
SHA25637c9e85a3e299b64ab93acbbaa6bf160651153fad5f5211e857628cfd9669dba
SHA5120af1f9e2c76b111d80c10f6fdb7e3436021adfd4211e1a8bf25c35c5de713774d2b12ce481816c049aecc309cf79ab207e774b233351ef8ab56c14c1df2f34a5
-
Filesize
1.6MB
MD5019cbb0ae4d784cc6a572715dd9f64c3
SHA13c4347258217e2c406044b9d003f0ecc60a90077
SHA256ebe73cc47f4768cb626adaf82fe100c5ed29d98b6a6983dd4df4b934ff0043c9
SHA51261a07f4e757508d80a0017df7cf0adaa7ddf0db52b9568b09e624c0fff4414771b69161028cf9152f8958066144e001ee18d3066f59cafd0300766f0f4321094
-
Filesize
4.6MB
MD50d3e8aa0d73df2bd055efa9e9aa96a17
SHA11a2be68885aaca7efdfaa6b64f91eacb8219d3d2
SHA2567cd3447f97b902089dd30a993206c0c8b3b9b65c87f26d741625747ae70d11e1
SHA5125f6242a83d4cf14f6d4a6a30c3d4bb6efd48bb5ecb996e3ae178878fd4e7cf642e00d9ed4d5dc21a634d45fc2d3db65b8d9a9195cffe208243dd82e051e9e60c
-
Filesize
1.7MB
MD5cf861534329028e8a2e1bfafbf0f79dc
SHA1cb7f2bb51fbc0356012cdaf43190188381298bd3
SHA2560c61dd09cf04d82aa374ef6782850f3912e1b06a281862b2b44a339dc0d3dd7a
SHA51250b6fc7c4c47286dbc8b21dbc6579c9c0ab97db2a56e55db50f2b9931615dce5be5eb7ec06cb647918b2ece5dca4fab04fd878d48ec2dfe583c11519bb6437e3
-
Filesize
24.0MB
MD54b02d12ffc52862db6c94e82481eefca
SHA15380471a2119346455be363dd2cadcdb01b3ec6b
SHA256d78a7bd80a8579ee8a24f3ec528ff2b3c07cd43b3d26a1ca5d40e72fc04e1a43
SHA51230945d1bb261a9efcbec7f23bf124e917bbd394f65b2dcb44f7e066d9eba5ef222ca532f4a05d71ebb736cac0991315c637ec6bf0ca9af1efc4f15ee4b2bf6e9
-
Filesize
2.7MB
MD5d35c567798f31c780d51f3998653969e
SHA1a32592b44e0a488bbab97f70464f4228bd3b9855
SHA256831183b8015c2bc6c0555cc24ecfd2e8ee7b2789f368b03490d81f44504a8c49
SHA51261d79b0b30c7103a8c1a59bb4f5e825334929491f5a6530169a6f04d4668d89d6135a20ca38a0cf0ef0f8390db6dc308394d64f5dcb19e105c0d1257d1d9a7fa
-
Filesize
1.1MB
MD5563c732f5e7e73d3de7cf0a9698a8bfe
SHA16c3fbf63876d66faa9d607347137d88188b224ea
SHA256586969dcf2ea07e73c1647c2620d4bfd5a9f17e8016f6323f1da32159c46ccfd
SHA512c1b8602ba5ca9b158b877045f66514c0c687616180b3dcda48f330e40d8dacc933e3b2ba5d835e05df03677d7bf46b5c3888e93da408dd4048fc0338e7d53d08
-
Filesize
1.6MB
MD5b49146885f5f47f73374c23af87b178b
SHA165f0cfae94859f2fde64991e555d3185ab459d07
SHA2569510ad3f65b3018fcefb5e1604a0a48a483f1cb60ffdda3e8458dddc1f1616d9
SHA512af418fcd9008d91505e4e9d2690f9ab8b43a0e218ea5cef718333e5e21fc59ac05fa056c5fe4882d3a1e7ac435d1668efe3d784b539a88e3e83becf7564a5f55
-
Filesize
1.5MB
MD51f7e40b4e8c684d66db9fd0543e356b1
SHA1fb5e01e8fe2b3405edea942767bea6b23ff764e6
SHA256c382d92e0f0589ac1728965115ba367fae1d1ad6ee8db2d11774daaa106b5517
SHA5129a817d8b7626f403b9d29c2a426c312f616fd712bdf894c4bda9240a43e29a80377cd4b517a37b1d4b7c75f7fd44083fb47ed7036a1aaddaa539676383aeae23
-
Filesize
4.6MB
MD5c0d5ed636da1e116c25e3b276b8ea1e4
SHA1aebfabaee4a77066709f11972c398cf71c20b4fb
SHA25660c4a64fedb6633a9ad7f752453caa09d6e72860f5de5f28486a0133f0bc511a
SHA512e42c6b29297e0209a51578b32b6d7028d3ddc079b37a3a396305c1d568b9196ae285f6761a561bcf753099d7bbbbbb67df4c8facac396da6f6d7628790608daa
-
Filesize
4.6MB
MD51ceaf935819801b542bd885620c2f18f
SHA1791742c60d613859f41b252615d683038ac84839
SHA25647dce64dbad993c5d74e37696965df1d2fef72f31bd5709030f26fd52f64318b
SHA5120fb31834dd3c2be5f81b7517bd403159eff360329242d8732e8caa3c85d81cbbd0105b34964db420bb1ac19aa69d596b579886498d6f939855d7ce5ba1b4cb31
-
Filesize
1.9MB
MD5773ea9758e21d5f9335685f39c77f5f6
SHA136f25de84b45ff4a41d6b95d30d66813c7d2a63a
SHA256a4a44e8b7c2c586f7438056fa908d0dfaf657155d5739a89e65a339fef3c6789
SHA512e7faacc5731fef3cd3d0ec5adbd26df9428dd326217e75a47855a1f8be48741fa117e96b1843cc3b1f5c0630d41e22ccf3796d3136fbe06240989a015bc6b64b
-
Filesize
2.1MB
MD568369655b77185bc4cefe17f9988365e
SHA1af52e3aa995285a87c0128f468f5fdabb7c05042
SHA256201ceeaba580baaad76d197b5447a862673d175a6b8cf7abc473cf23f919dcc3
SHA512d94ce6b62e31602e35d2dc3ead2291f0e7e57ee83ce402eb43f12c30c6ecf1d0311f26695557b1dca4e808c11e9eee6f5fe8d5982a8807dde60f788f60c23d17
-
Filesize
1.8MB
MD5a0a9277c5aba52b6b15c92510e455872
SHA1813595438d1c6790c87fafad5c91c327d8941bda
SHA256286a7d83b9f759aa51fd86f998c9aff3e1721c38a5b3a1eb138bedf516250f35
SHA512d10936353521d975163f6e8af9e5021b34dd2d5ec5196d25430a4f9cde970ebea31c5b5d38913b5f5c8fde5bcfccd364f946b94e47ae10b670d2c66414cb3062
-
Filesize
1.6MB
MD524a5ebf42b21d8fd7b1d88568c46d058
SHA12b16f268961b9ed2ef18e1b788aae502ee67eddf
SHA256034b237f54f32396d96500b31e45808907edf883bf2f53a3c778b8156df1be18
SHA5127cdf7205b0cbb4594d2d1e33f0a32bed3e98a9ab2b0a7939f1695e70ef7947561924d30dfa8db209651b51eee7349e908fe9045d4d8372ea16afc38614e58cc6
-
Filesize
1.4MB
MD5939a4404e5830349402ced0164b38ebc
SHA1718f465f13bb862a3c9c1553aa0ba52deb9e13eb
SHA2562faabbb2f0258e99f5cd6a9a254f2c9dca79934a6877f022244d938e2bb3c6a9
SHA512d7b22e5b4110960a9f2d0df04390a320b3bf6d6eac515d3fc9969da2332824c5e4d004d83796803316fb0cc8475deb489399648caba48c024ab198c122847264
-
Filesize
1.4MB
MD5307e94eb9583b377fca76d87bafc0853
SHA194aaa872236e3cca5ad125dd6935618cf6175e2a
SHA256788eddc26a38dcb54a1738094b75767bdc2bf3f78c0ae25fbcf929748c0372f4
SHA512bacf2fc1a781f37ea1aa5cf475e6b18488ae27c1cd7b0d0a5782665ebe5f828aecde3e7c04460d6883d51ac2a83e2a3f94595c9fa05558bf312ac79eb4359d90
-
Filesize
1.4MB
MD58b027e2dc2cfd67d50b5e8692a87ee73
SHA16944d3d63090eb8bf95d10fdb48e51e9efdcdd8d
SHA25628e9fcffbe17e91f48c193b7639d0cac2fa0cfec4324445c84071671e2335e87
SHA512d35f549e5ecccfdb69cd45f6981e84dae10e410c8367ed03f2caae49d971f6b86f4b9188bbab8ea4ae61ee48f4d1d366886f5ed0db0f32a68885f047a479a57e
-
Filesize
1.4MB
MD5e49e892e399d988548379dbb4eabcf07
SHA1ad2b43c2fc3296e68dd9456f510226be7f7ed6c2
SHA2564b226ccd4d3d59c03c4d2e50bc449d6146038572c4d4c5d79f6508fa9aeb6f62
SHA51295c3c90bf14b34aa15756e1194b6cfbde5652c5b41f5a23020d1e2b3c50363d68f83c6904d941989dc39bae017d40da99c3582d2f0a1caab8dd6485fd9f3c4f0
-
Filesize
1.4MB
MD59a25b70327587e36bae0fcf7f3bc10f2
SHA184e1dcb36493f785495dfa668f3b9e372f41f4e5
SHA256a01b1304d15960d4fe0184c92e8f01beb6ebb129066ef28c31483f0b90d496ba
SHA512be355680b63111f5f95c85b05445749c3e2d5423771b5cf20ab4c60a3ed61c75df6aa25ffbdb2d95ec36a8c360cbbbbd26f61f5f7c5a2287e7a6d678ddf9a822
-
Filesize
1.4MB
MD5229ae3d82144ff11142995e03ddfacec
SHA169f6bb8b779409cc5dd50280148b00866c8d08e3
SHA256580f447b53d85aa8a43d943e1d236511f150f8d3084104429de4623ae3392b4e
SHA512868b1891b7960b52d43004658a7262f4a50019205c07f7df92cfd5924920b4bb6ab2b491d2c62fc24e13e8c04c606570f7aa6041fb0abd34fa7e618a42fdfe0d
-
Filesize
1.4MB
MD548ffa4e96c3568beef14aacff039bda1
SHA161a30271177fc5bd5dd5317c180ed6cc807f9d0e
SHA2562a05f69101c9d515eab943af7e2fe0aae33309b6d48e8a1c1871777a46991bf7
SHA512bdc4de095a1f849e4110f2110bbd50de71a27f9814cc424963b42a452234dcff0d5240eb05b5e214d546ab3b7a1c9b91824e4413418ed7ee364423ff0050cf2f
-
Filesize
1.6MB
MD591fab7232c6af8fd796839d4da7c04e5
SHA1ec0a80d06b02e35d21dd7ccd2f8fdd0a1bef34a7
SHA2564ba665c8c01e0c02e6e4be1942467162f81f0cf6d299352e257cebe749510d90
SHA512ebefa7d4d42f1d961a80e4d70f672f5a96295e4739da43b5be9a1d7d0d63f931451229d9aae97aa8d8d50b71a197d191976d24ff4ef938275cd38db00e9a2029
-
Filesize
1.4MB
MD5ffbf8f07ec9fb57d1ae180680662e91e
SHA1f7f0011a54260bb97b4831f94f88bdf235f028ae
SHA256a8901642f879522e3f3f037179cd34cf1a3b9ddcc0e67d9b7117383951d41424
SHA5125336e8a50c5648cc045ce3b4abf1256b4bcc660495738eb0f5aa89e56e0d865ac6e91ea4ee2dfac5c7c1654e8539aac9e43363fb729c7689dde5d69dc745eb3c
-
Filesize
1.4MB
MD5a17f6791f8a3ec13734b007a04fa28fc
SHA1bc4393683a7aa668dea90ab854f6d4408731ef87
SHA256dcf505fd8d2598b751ce203efb2049b8dcb0fadbd413885e549493fd02c30a01
SHA512cd482c1b17ec65f44eb39fea436b4f899b2e80496a70f45ad043c4009369cb95138173255f218e76691708df5a4abe6dd8477d2c052f57df31eededc8c8e63d6
-
Filesize
1.5MB
MD50ec18ab5435c1bbff046e57c59072d13
SHA14235ab386e00ce98125d443648172f6d1b673422
SHA2561448575c961724a3181e89b6fd23e182ad002bf23e4d6e84e899d97b6aebbfd1
SHA512bce03fca14befa809620bb06f6e5c2981535e48eba60f43762f5b99b6ea6c5d9d90543fad4adc58dba64fbe5834f4bf55fa15393c29e883a2f8b42d2cebc657a
-
Filesize
1.4MB
MD5faf00de08bcfd759133872da39e72721
SHA143eebb479f100a4081d727406aa91af467c3d4ac
SHA256596115a2bb6cf3a9dc0007047cc0c1a1d8d1c438bf593c113651fd3f09ddc60a
SHA512b20b7a5c940a28509ece52d778f3db46ff04069a98fd1ab5fbaaffb454c3b9f30a37b4c6ef35385ca257bd6072da564ff5c1cd89f22a48d41e362299d890da75
-
Filesize
1.4MB
MD555310c22356b5d4764aa2f2884647c4e
SHA173c6503d54c3ce88da056e9ab3524e15dbab72a3
SHA25690d64ddab2c3ee22e2bcb957e8784fe6f7947d1aeb129f48ab7b19186d108660
SHA51241000d9c9513701d91464cde51964e786151646e84d0d3ebb00682afed780df7b1418be7105342a9b49151085b19c31e4b912b7aeb402c7ec2985247732e018e
-
Filesize
1.5MB
MD52eb6432df404329846aa124077ab096b
SHA180222a544babf55b91008eefcc932e084ce50759
SHA256f63a14f461b43108477d2d2176291381d5cdfd8d271cd0de10d05104d7af2f07
SHA51298d0152ac527c503ec1d38a380c32d615f0bad6b97f1c41ab295e81790158cf49d9e5930213f8a26b280f706d5cdc2d0e2bfafb7a92a375e593c4173cfe3b8ef
-
Filesize
1.6MB
MD56f92ee39e91aa80abbf997a41950cb70
SHA166aa2f1ec26fd267e08931198f86d4dfbb90f652
SHA2566c6e93b62597e0091c6a861806ef327a428db8076730f2f8cce37d9bf2a83090
SHA5125e9a8d6d3d59d6a040a1e8d5b6e448a0ef544f6aba6c3f56bc85ef5b1ccd4e8ced445ee60fcffa2528f893fe0166d38a1bcb33b74b21b87691b059a444ad13a2
-
Filesize
1.8MB
MD5c1546b9d9f350fb21802d3b6fb1c032b
SHA135e315e439036969b1b930983aa7530f072dcaca
SHA256b6f49131624056b202130b0bfac4ceb96d5ed0c4315b4f069d0b4385fc525b2a
SHA5124025dd2a6706a20946d240a2b92aff2786d30667ec7d13dab34ccb005f004a978cc068a6a546165cb75b46b7d29b124d2b025706d2237a0ada126a9cffc365e7
-
Filesize
1.4MB
MD5e78c23016ce8a1ffa241789fbf9e583b
SHA1a45ad8369eb0329b77c58063d9c6167fe8423d7a
SHA256c2e01a5b21b47612949094fae378866b2e29e9161fb3f18cdeb799ad965cc618
SHA5120b8f3d9f4edded7e541daa35f873edb1cb4948f9a3090e644557b270c7aa679df0ac68fb06524424435a0fcc6a33df2dd8672a04d00fd06b14e5f6d527062e1b
-
Filesize
1.4MB
MD592fde322fff5049cc37f37e374e08304
SHA19efe10e1e9924967ca640baeb07dcaf841d2d613
SHA2567285a7da4e0d2285d2cca8cb3d82b037b12e82f8fe32ae1bf49197cad8f4b3b8
SHA512feb5c42a7a8b615b037cbff1e7b24f7cc25fed91c3e255684a8b52fa3291c2cdf8c163036e15508bb3f1a5569807ab19eafe6a6f46c2131589497ef1a456296c
-
Filesize
1.4MB
MD52dca19a9e6b4c7a0edd3f7086ee08c72
SHA1246c1169150baf83b2ee2588f4aa9c4b2dbf0fef
SHA256438d21e10442a52ea1a97cb489d526a52b0995e17bbee48da4284e84779997fa
SHA5121f4c5872b8e7fac8e97f528f60e34d9ccb42db06229415b28c917f45c70b3c6e42426487436483eb04e9077baa2067df08ab442840bdd8d8ee7dbe858cda1adb
-
Filesize
1.4MB
MD52d9874d97833c5310ea56f143235d9b5
SHA174f4bbfaf3c39bdf0ba3e17b644895e73de4067a
SHA2568c55dad13cae8f24b7c51d54b7855ca0879c1d1f04371b6695c570ccbb2d6c42
SHA5123734b61e6adcda58a395130511b7954f67456db4665617e08d3f548491d4ac495566ef4368a4a3e88f24c422b7cfe9fe3c3cedb6b7aa9b8d4e8ab40b6a27f944
-
Filesize
1.4MB
MD5a24bfead13a99df8a552db6c399982de
SHA1901a76572238b92c079d7b94f733ecc455ba9ae3
SHA25607b59ca0a7f9246be5d1e8733ac02ba5ba46ca3a4af5ff3f3139e5263e37f867
SHA512a68cf200e59ee6e5150fb5e73be1df158ec6e258e871d90eb338cf95e1ca2a1ca4baca03ba6a63813947f760dc255db90e7d91de514e3ff6085821f52d86f755
-
Filesize
1.4MB
MD5e104c535806ba90db73d7e6a781edf38
SHA1fe3bb33a47a1922ad83cc2096af98b5985a394f7
SHA256faf1c3ad270146ff242e5f41a1b91bf4bdb9cc2bdb86ed04ff3fcb2a9b57637c
SHA5122aa8d0f61cfeb7407162fb4d2c765d62a685c5c9166b1245c753fdf5a6d43cd8319b0fc161a9a24d910583780168a1e3842e7524afd3a024a26d6ed229919949
-
Filesize
1.4MB
MD570ec9c4bf0a70e1be2c3e40d833294cc
SHA1331fc6a59fe90092b843a9d3a96c2132bd4af389
SHA2568ea9375abe5762fa2f4619c91ff204fdcd03adefcea79c2f12066ecf2abbb2b5
SHA512107978023985528a841b08537ae5237b2f77df1e7e0a856de7b752145e42414f2c300c47c1ca349f23ffe31d3dbafc2c424f962313cb461580ae129ddd0c7335
-
Filesize
1.4MB
MD5c988e4ac406a01e49c3738208e4c77bf
SHA1df139bc421c6405958081360c3a602778f9c9dee
SHA256ea8d70e6e1b7d03f9afaaa724e6e725ed1a527efd0f011c09ca622ba17cafe2a
SHA512d33bdb820f413ce4b1d7d9518b9eda7273b29a2b27605c67478b2201610eb24cb9a62a64d98451bfa8f6b54134b93a39acabd56996e504a865127270e28ce045
-
Filesize
1.4MB
MD54eb2115a587d2d98f8f6ae73ed2da7ae
SHA1dd59271244676d5a078a54bfeee838fa54f2b442
SHA256f1cecc0f3b470fd391956bc0664b273f542a8160e18c93ff3d93867337ea46ea
SHA5121ffe58bb084ea45521878a0c5156fe9888f37af73ccd0151b383a6760e3dff3ddd207f285ebbc032fa7ecc8572d167d0bc58ef4192d75aa3faee314238c03c88
-
Filesize
1.4MB
MD59d104f8360d41295368462d114f6f41f
SHA1e454158ff22d83aadc08a9fbae0a5c02df9a3748
SHA256a09895d0b57b3cf86d66eaf291796afb6a8e408c642605c75d8254d1a71c0b89
SHA512248ccac67f134631cee1b320d41a4fc9315c1fbce9ba1687827f8631c5bef1f437ca651ec887a3ba27afb17f82c7d05ee31b35032776708d5ddaf5e559d80300
-
Filesize
1.4MB
MD54c304dbb2c5020b99ff8dac7adcc50c8
SHA1013f9aa40a9ac257fb3e979a9db1ed1797db9196
SHA25651f5b253e4f0a919d846b6034099bde3d95bfba0871e6c9b489e247506621feb
SHA5127c66522840362065e8e02a6614b7d3ac40343951c2710c859b6d612cccd81122bba5d062dabf18b239e8aafd5418ccae03d9d009bfebc9c70d3eb4d88f7d3e8f
-
Filesize
1.4MB
MD51ecc2e28f750ead1de10738dba23ebce
SHA1ab1f9993fcd962a3607db4efa0cde2c2176871d0
SHA256cc62d76de3259f72d8c6214493fa9e0550c25bbd1bf13b2d6ebfacb843118405
SHA512e96ee7acebdd3304dbca10b3abee1c9d08567edb36555c03275cb706a42e54255d4d81fd33596542526b8f107c2125ff78b022525550447b41cd3dbed9752d2e
-
Filesize
1.4MB
MD5432a8d090d2bbbb861677e704cb4470f
SHA142dd27c392d70ebf51f29388dbfb4ea219338e4e
SHA25618f7f9fa38ef1eef3806c67ce775177d0980ab052ab9b2cf2776ff75453e4bbe
SHA512368dc5d8751b1f3b0192b869fb32f7e304b0a87bbe2fb432bbed189ad04667038c94287475ecb5709a44e4da1eed13fc671eb152fd50bd562cf00c0cc7e16189
-
Filesize
1.4MB
MD5f69366ca9c854d7a8ced2f913bd36456
SHA14687a0e138946c4f7ce8758f0fb963a44fb67c58
SHA2560743f6bdc419ab19b76a3de0acc5a232d52284b8609f25702d2e62e07a72bba7
SHA512bd8946ef0cc3fc13b7c8ae8c7f67ef225cf864e7355788973ac75897789b9a9d0eaca9506f8b2414bd74593e55cc17155009b5b371ed660fc77573f50f630f25
-
Filesize
1.4MB
MD5ad6e958e36062cd79e93502f73fac5ca
SHA1ba89e7b6f2399efc956a9e5bcb36f901d954933a
SHA256a738d91a5aba99242b09062cab68ddce153dececfaab5c4b2e8ed21083002c5d
SHA5128902741d31be162be1bc9a37c9e4e6e71fbc23890607407ff62c1d23cdd6385a8570e9442c1d7b20f6e9a79f3fc26ca2b58283dda69bf37ccda8c3df35df25cc
-
Filesize
1.4MB
MD52b71678eb6011f009fc25761bb7e4776
SHA1425f5b4bb6956367b9c826f788ed4ca164eb028c
SHA25660152256325ad821e4754e0bff345eb7a4ca3a6490f188e1ddb2524acdf6f3f4
SHA512b3d681631d2875c52ecd242db92d0ea86d1bec8f763f1059a3a4e97855ca6aef25e9cba47d4c6fb6f2ccaf9c302ee15f56ca1e44235d0dbefa85e66d11d1d5a3
-
Filesize
1.4MB
MD53a2be9b4fef2156690a65be63f9b3a14
SHA19e5e3cc0b3fe2ac975f4e0f744c0b45658e2c3e2
SHA2563a435b6eb4407e51c3f5d1fb1b1beba25070527fc6e193ea99cd06a85a242970
SHA512fac5df48711f767a8a7befaa8d8bdf072392c983f2035923da50b0704d57700f70fb6f2e7034d6e73f9588a263027e4a757342bf35b5fbd7d0aabaf2fadc297e
-
Filesize
1.4MB
MD5e33fe42b56bea84cd1cf813f7f5d4463
SHA1b6840944d2a04dfde92de7569295dfb3a7fcd37a
SHA25630b98dcec1f91a673106d3f16a21028ced2d241a118f8cda0ddbbcc1db3e9c06
SHA512711f43bf5cf458541a10505020cabc161324d7dbab31cd1b086de9e247e86bd6b9b4f75829f941fae70fd16fadcf8b26f68771780f0c23b660b5de88d53d6862
-
Filesize
1.4MB
MD5a8944f4f3f2f7f7419542cde1e75df5a
SHA175559158ba8001c24384d888776ed38ccfb5660a
SHA256f6a23ee828c1a869abead9a94ef2217d168de39282537515431c5d0c0622667e
SHA51226dc61868bd6ed38d4e93a380771fe1f1ff32ee69878fb531456c6b42bcfa7bc419879ca9bf8723e043c6f21264d629a8ce0da73f647b3d4c39738fea561806f
-
Filesize
1.4MB
MD5dcadcd6b42c595144643e8fbebde40c9
SHA1bb37b48f861e0347967bd25a73bf3ff4864ebecb
SHA25687745d77f7645b11235b1c39bb3c210c82af1cfdcf473fafdf30f6aa7f828b02
SHA512469ca9ed699cf0491e7b037cc119456a962fc1e921165117599e07d02b235d65b66006540e73d6cc5f9570619cff4e3f9b1ada0b181a5a1e3983c3b4767d14df
-
Filesize
1.4MB
MD5fbec85ded3babe6972080b5706212385
SHA14ac6116e9f7e11128be339b28b68b36156e0e380
SHA256df93f4c8808719cb59f9e73fc3c7a005877f334706df6788457ffd32a2fe9cc0
SHA512dcdbbd312d1fc86a5dad9ed5b2094e8d0ef9e5c5bdb2d8c0d636aae8ae916b34bab2dcd65d3c211a1187aca0921bd2ea2760c75c93ed1d60376a3fcaf17206f5
-
Filesize
1.5MB
MD5d7892e1a9e6c25a985ddc3e3ffe18135
SHA12196217179e2698ea5fb1ed97c4dc831e3865144
SHA256ff0e191716cfc3ba19c602490732a5f31587f6d88edbc7c5b4c0b9263d9f5d3d
SHA5122ba690bdb8dc30d5f6ee2ee1c8f8fbcb7080c9e1b25bfc9369243c0e099e4f7da0f0966054b66361e7a9986262be1e126af28689a31dfbb3b715d7a64e6596db
-
Filesize
1.5MB
MD527678640f7a05003319ab576f231c7f9
SHA1a3e172811f62ed54cac3cdf275338ccf159ca166
SHA25625dcf013d852a1823b44c72ba9d1bc84916d0087cb6fc4a119fe1214e2c02f46
SHA512162dbe35572a51e26600844f0d94a418b48a62681116536aff20b2323fadda43867d9b78afb47ca457cb3b0a52784cbf47f4db5b2a84b9997bdbcba525450bff
-
Filesize
1.2MB
MD5004a26be7b497cc79d229fc7dd4d3982
SHA19dea9b71a7fc43a6d7cca2d8633724810b19f522
SHA25613fdf2fa657dcf91f5662e0e0127ce956ca950a7e8b8aee92d338b475d6780f1
SHA5121311069205861790031cc9526e18205e49617e02f97de818884a1bb867234eacb2e52defead60e45b295d1ccf50e3b69bdb3544389af6682d0212ffb071b209b
-
Filesize
1.5MB
MD5bef547bf8b2359963cfe8bc78f4aaee6
SHA145bd8b9bf355ac30fcfa272268d0dd7e11149a6b
SHA256f174c121f9a85e802f41d161e1de64bd47f1e8a960d0ccb63ea2ce73bbea0cd0
SHA512845d0e36b3dc0de6beb73ff47ba860bfee998b911f17bd4b4c70bf38b7fa6c41379a0f9df4bc703d77dc7046cf3a5bfe2e9f1492d0d9b44ec5127c07f7c8f49c
-
Filesize
1.3MB
MD51e7075bb846929edac305309f2dbd324
SHA1729d763bc247be7bb7d193e2ab3e172323ca11cd
SHA256bf8cd3d5159ec81f8943d5dd0e9cbe96ea6729d95b6992a1b4fbe672754d2463
SHA5128c04d69120e64e14e00ea6df5e78f0742b12a854660e34d589d7e227758a19ebd261fe23005d6e5d3a4f82859e6f2305dda904bfc2095e8e032fd1cbec2c2ff6