Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
14/05/2024, 18:11
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-14_e1ef4f4b4d378ebbee8e554cc196f815_ryuk.exe
Resource
win7-20240508-en
General
-
Target
2024-05-14_e1ef4f4b4d378ebbee8e554cc196f815_ryuk.exe
-
Size
2.2MB
-
MD5
e1ef4f4b4d378ebbee8e554cc196f815
-
SHA1
ac447d5f8e1582048cf66edd4040d714f3cae3a9
-
SHA256
2fa5a3d68d26c200f79156710b97a9841178521cc616390ed26ed34d62cc7f7c
-
SHA512
14399da785a154de95aa50d7c0882e7d9ea4afd5c7851047d62d9c9282d6597a9bb1acde442e87fb0213bb61db32a7042ffbce16f42b776f1484409bbf3de9f2
-
SSDEEP
49152:OOOh3aN4kuLbegmtGXf9Ckt7c20+9qNxUW:YU4ku/ctMfEkKK90
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 636 alg.exe 940 DiagnosticsHub.StandardCollector.Service.exe 2472 fxssvc.exe 1432 elevation_service.exe 1684 elevation_service.exe 220 maintenanceservice.exe 4260 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 11 IoCs
description ioc Process File opened for modification C:\Windows\System32\alg.exe 2024-05-14_e1ef4f4b4d378ebbee8e554cc196f815_ryuk.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-05-14_e1ef4f4b4d378ebbee8e554cc196f815_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-05-14_e1ef4f4b4d378ebbee8e554cc196f815_ryuk.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\5015f2a9bb5459c0.bin alg.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-05-14_e1ef4f4b4d378ebbee8e554cc196f815_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-05-14_e1ef4f4b4d378ebbee8e554cc196f815_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_97390\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe alg.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 940 DiagnosticsHub.StandardCollector.Service.exe 940 DiagnosticsHub.StandardCollector.Service.exe 940 DiagnosticsHub.StandardCollector.Service.exe 940 DiagnosticsHub.StandardCollector.Service.exe 940 DiagnosticsHub.StandardCollector.Service.exe 940 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 656 Process not Found 656 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3740 2024-05-14_e1ef4f4b4d378ebbee8e554cc196f815_ryuk.exe Token: SeAuditPrivilege 2472 fxssvc.exe Token: SeDebugPrivilege 636 alg.exe Token: SeDebugPrivilege 636 alg.exe Token: SeDebugPrivilege 636 alg.exe Token: SeDebugPrivilege 940 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-14_e1ef4f4b4d378ebbee8e554cc196f815_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-14_e1ef4f4b4d378ebbee8e554cc196f815_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3740
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:636
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:940
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:840
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2472
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1432
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1684
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:220
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4260
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD551eb4abfa97ae882d65eefba83dce217
SHA172d6de481156b3215a12006af4bfd5cf23c98450
SHA256189b61d8274d7b14e2b5ab451758ad837b23c0f98538e88447e75bed3d09e280
SHA512bec631f7b57373c97c4cb9d44efebcb8043f7b6ebedc66959a7eca0e65789fb66abc0d1eb3ef961d68b1cf724793db439342bf8958aadda558916db326032f59
-
Filesize
1.7MB
MD5b43b781d00c5be76977a1dec1796a0f1
SHA1b7d0a03f6321acc590d94772f32d561a92fb19de
SHA2566343c3ae0b1a8710c7cc023ca2527ad3d59aadb28d23688432473889b886e84b
SHA512ded4387c1a271054ac562c19ae8eb20b9033f1d03602d9d6875ddf2e4a50363bcf060cd5e97dd5179715fd1b936991db466a4fc19618f05f984192d96c228467
-
Filesize
2.0MB
MD5603412e67cb69e3cabcdd06344da73b8
SHA19d3ff9227254e3fc38d05da0ff2d186d3766ab30
SHA25629c021bd50fae90bd4ee3b5fa6f48b596ce62a7e987916cf5216390edcaf4591
SHA512e44806577dc947c86191f6bab615a1ea177acf89d20e2485d9e03b9e5f73cdf2d494327bbc9494c7770c230a7753fadfefcc28dcf73b56ae447071d441f356d7
-
Filesize
1.5MB
MD56373c280b92bd38641857e8b49ca1b43
SHA1407948918aa8456cd63db4ee24f2f2200f00a21a
SHA2563bed6ceffba02f2e02ed89d70f4bae71fa5331c38b421e28a68b3b513ea3afc6
SHA512dbbc2a5d8ec55fff9972b61f08da42588f0b37839ff81b2cd3970d641c2940dd7e4128a02c343cd78c6e7e6a6d3459bf0ba1e6aff8089c54698e7612c6d805f6
-
Filesize
1.2MB
MD5464e26d8e93cfe575c2b224b220eddd7
SHA18627cd0747c799573b6417cd86110e43322e9459
SHA2568aa55511adc0aeef9196b9a7780d63da1e5e26a63df19a5e3978ae8b24db1489
SHA51228ef41af8ceeb336497cf2ee8d9d24d7bd211579264ea228b93c1d1f0b2b29ad189dde2f2f6f4a4e64974402211537ce5beee35e24a35b974e1ccda213b3ebea
-
Filesize
1.4MB
MD5edb98c81ff9e653c25d940d385fa4650
SHA18da5928509c31d7b63fe78d356d77d797f3f8027
SHA25642f22ade4a3f0520193706cbf60a127c04d4727a3514e297c45c25b472461717
SHA5128100c4b0025ac72915ff36447e575b0b2041701397ca96193aeb1f030f6fbafdec90cc2f2cac03f7be78cb1cec35735a8de71ff317316d55a90046080b59dfd9
-
Filesize
1.7MB
MD5272a18fd520a5742aad8ba7d943d374b
SHA15f2ab122144137dd2ab183120db1d006cab0e1fe
SHA256e48da3d3e327bc48c883034f5bbd9febccc36b91a972384527121c605194bd8e
SHA512a465da8f9124e048df1c7bcdf71edb57dd5491f9b4d5f141a43207e7420982f1e3e3a55ee4da146e5af5f64ee15d9cef2f8b506b732c84b16863a4b84eec89cf
-
Filesize
4.6MB
MD5aee1552617714d8bf022be13a17ea431
SHA1e9338d0a699346351a62e135c5a7918e1240e19e
SHA256ae11413f624806098a7657be7a9c354e06895f618e3a4c527d97d56fe0db0db6
SHA51257637efb3f2c68b5b8190ca33a1311f7444faf7a30e50b1e3fb892e849b06f0721750f2aaf277b7f62a5e5f4ad3c4f3f7b182f9e01f584a1ba8176b9e63b189c
-
Filesize
1.8MB
MD5db87747c933efd1d8d426a590a249649
SHA1dd34b126e967625b00171f291ec1bdea964d209a
SHA25690d40d672a7ca97aa1a762694bf437d0e3620d421d0cebc3d35ae9591668e5d9
SHA512b75686aa0f7dd00e990cec34a05b627e3cdd93aba4f307b1fa04632ab3e0a2730010ef625d96ce0b9fc3121ccca11a1fcef962ed0dce78282c9064fb04ebad0b
-
Filesize
24.0MB
MD5b68991c9b7dda27423fb981fafb1ae49
SHA192b545c5d5cd6089231af2ed06a20072b296a796
SHA256df4a1228e9ff9308bb4c0657f4e4fa69c26af4945d75c12170ba60df9ee8aff5
SHA51275cc2b96cab9253fb64c186fa89ac81b5436268df68bca7ecf4932cfcf6fe10deaf40f2aa471bf5878d2071baee5e94fe594ab243fa971cc39b47c5c6a9ca597
-
Filesize
2.7MB
MD5a3baab49c943dcfd02f8093144e04008
SHA1eaf3f4185fb5d7715bbf2acbae59be59067d32e8
SHA2568ace24794805dfc1c7d7d7350d9044c6e1b78b437f50cc843616d547508b29c2
SHA512eb48add276b69deb15e383190a3a3efe0070b1e3a76fd2f6181bce40f6e6c06c8ba038333e0ed00da466edb54adcc7001071960d61e903ee86d3b300acfea190
-
Filesize
1.1MB
MD5656c021337fef2adb9c62033c0b38f5f
SHA197e6e45e45bbc33b3c49adb4a1dfad3d08b9d0f1
SHA2562a8a641c12a7a3351f718491b8e293abfa9d3101e8bcf895948dd22f72d1a90a
SHA512fa74fca36a9d0e715993f0f08798821f8888f94b6ed8c546752e72b399a72f834a1720a8a87c09b9401f4bd14955620b09095965e89423fb7e0135939f81e22c
-
Filesize
1.7MB
MD55f5b8ac01b81d5830a56d0a5fca23413
SHA1b6b2c4fb18f4f820fc91a2e7ff828a46397dceba
SHA25611a2109e8fca0e1b19703282b686a6411adc6f71e374c00dba2dc6ebff2de100
SHA512c9e58cb49ef8e723d0062e117110d9925bc8586abb7c7312589952021b7d744a83c2b7192306be10855eb668e2be81e33eaec0efab8b9da10ac59e5ebb7f489e
-
Filesize
1.5MB
MD57cfef1ef1e09cefc4392ab07ecf921ea
SHA161a2a48047f65e4590f746117e306198d697c036
SHA2563f43ee4c6f840edfbffbca1925527a3fc917eda6d4ae863538566c2168a2c24b
SHA512f6326f33a3115329cdbee82a4df995d23903ad75e6a2d006d2fae2be5ea0c2dfc4c3228671cb6028fb2d814d4e2b8fe37ca4f45d3455fdce77f5312616ccf514
-
Filesize
5.4MB
MD56f93f5e5ca9863ccfe7c397a190a9c1b
SHA1b1169cb2493ab221ea656a6a5852e170def74cf6
SHA256de6104958e7290ee4a3410b2dc66da07d6ea96352e59b41cd397bfa264ffccf3
SHA5122e08821676ab13cdf0d8cd8f7b274a73f8588f5563163a42350d4ea26b4381538c906d1a4536769371e167c22e98cba484d0470d08ec790976814399fbf0cfb8
-
Filesize
5.4MB
MD51a046a209afb177e35ac23496d734f2a
SHA1c3cb5e0e7a277239af5f5ece7d927f87fd161eae
SHA25632d227d3df17cbb62765d50989bc30a339b25b075932a105b5e1e42ce0a4825e
SHA51222c29edd6c6f587eec8892e06a29cfdeeabf87ba74e3c0329251be1a497113adacdb69dde6f38b628765e367056493144543f2d04f50e1eed4f3ebd640cbf9ea
-
Filesize
2.0MB
MD57abd93249f2acaea1a7c052be4b779f3
SHA17333e343144b4020a80f64896fdf7d9d9e1b70df
SHA256bba4af632bfe82ed5101f1c2c9a8f6eb1af32a66466f3ecff11b9aa1e689ca94
SHA512d871945c0d555352ca904a4ee1787325be7a4a4c8d6a6bb62f6f9ba6c86a066f241b29cc81196b6df6e177e0e4ecf04afc6caa20324712e499457c405fd24bac
-
Filesize
2.2MB
MD5bd6f9c83a448cba11aefd1f1db72926e
SHA133f41341ddb3e0be88a3acece28ff47e5be94b96
SHA25642b439c47d39316ea435004bc263824c801948cf5e161954830663704a7bc14c
SHA51262beebd4c3e4d153ae322f84373db93d22374ea046bfa89c8ba9a1c308d54211e0b1b4894ff156e7331c798249a571f0f75961a8ab0c3365ab166197746b5415
-
Filesize
1.8MB
MD5f68f4b1b4197b0b28f7e8239fe2f67a5
SHA123f62cedb4fc93a5b99ce479273ddcb9386aaed0
SHA256a22d178a34c7e40d7277dad6b5d3359ee9153b240e248103862678ed6de21ba0
SHA51277c41a3a435e0c8980a19f8829230d8218a2f75afe20b70476884b76e3d1fc67da52f109ece4c112eb25d92f8ef6b49db565ab297d377042c06c887abb0d6dee
-
Filesize
1.7MB
MD5826f3dc5f2a6b7d8e2dec9ac301cd063
SHA1c76b339ef584000effe9f8d7d793c8e8d9fc60b0
SHA256c8aedd42b7f6d903a20c90cbb25224f775e50d83d6770849610922b9a1fdd20a
SHA5124483a49d705d9f66e63fa3146899f345ded67893f346f84ec1b82af2db674457fcebaa213b54929c9ca0d41479a436ff4ba2fc6be9d9afab3e629f0def2ea4af
-
Filesize
1.4MB
MD55639c826309185aa0cdd9b28bf536f9f
SHA16ef6d4a63662a1b3d5f6100209b1269d9675a65c
SHA256a25893b932d95d40f0ce5ae9b4092518a04eef3b18bdddf73110474501ad0c66
SHA512d3bc307a3f1d957db7817169da4ede29e318f3c85f7dd1f35ca0b1f47ea44dc69e0a58c2f06f1e6732175d6c4cf4798f4aa063447568424df413df1c44dab72d
-
Filesize
1.4MB
MD5e9f91a3e879a5f4e7c8aeb5779065cf9
SHA1266cea03da304fe70d8c760eccb07365183e8a2a
SHA256a90ea93ddb7c64a40292f1164f554db80fa706d75e182c2a6e799137379c0d98
SHA512cd576e98d0b95d4a75e4744810e9c5b60774376eee7cdde89278885e1828b9e62b548f1136417e522d58cb4f59abec6c2079d71b9adf4f224d439f5bf79fe643
-
Filesize
1.4MB
MD587f7e779aba5da48097124799591dabf
SHA1cec69ad57d8d366e92e698a268e062018b0554d9
SHA256665837e635a3f807bff33e11218a7acbc7e951e6c2728b2a153b3efe97b98f69
SHA512b026d66ba2e0e237a51f9ed1dfe4b344f86c9065144349c13ec688c40884bdba36b418be309ae5266ecea3f5f21252655f80227dd4da0d649c11300fe27e5842
-
Filesize
1.5MB
MD524f807e7a7607a965512233b92ff2c71
SHA160248108e48d29971e0be9ba4db27c16279e1be7
SHA2561d454fb22127443762bae01b44eee5ac66d199bce796664eb6d37dfa51fde137
SHA5124439b9fded9756730c2954c00c8f914ec3024ae42a738cddf860ae7bbc8be441a97134894018d041dd51e34f2f8564ca92764926f83eb453d19e96bbd6d86605
-
Filesize
1.4MB
MD54ae55dbf9e05d6f2ecf634683f2799aa
SHA1056084f1c0ad9e2b79a6d482b4b4b0d5863a4838
SHA2562c5d3c9857ca13870234f536a08fefd71d5b8dc053474fa7c72c99736af7818b
SHA51255f47773d1def13d730bfb717be5ace3eb879d753279237a8114f8b60ecfdbe5dfc9c68ec375c369b1ed2e0210c7adf75aae0decd96e42d50ef24f7f2cc386a7
-
Filesize
1.4MB
MD527afbfc17a852b3b5a2609d2221cf3e2
SHA1db2de93bd7c5c6ba6d6f3b11f5fc53aa1d6e76b3
SHA2562649a3f6d61504d886bcca7e8611ce7b9d651c08b8567f288303e8ec82496390
SHA5126104a194d987295768aeafe22b70acad3b3d6ada8dad16bfd85986abdf9a2b5d9e3a2814f2e10823f6d6aec421e7ef69dee3472fa16195d0c24982c262bd067d
-
Filesize
1.4MB
MD5c17ace0da567a3cbe33b18b0c0532647
SHA14d7e8214d9534c18fb5295bef1cc3513b67d70f0
SHA2569322c45633ac960aa2bdbbb7e72aeea919ff638129e5bd45b1d0fa92e4432a4a
SHA512ac9be3f214f8bce13b34d394b558eb2f8c79bdde08cd9d80c9bb7fa59a149f526318de5868e4efd3369c007f81f544796284a72337c40ed2af7fde0f91312a2c
-
Filesize
1.7MB
MD57720f5dedbb11f8e85056a6b11aca9ab
SHA16973ae4791e816b7b7dddd35433a88e6200292ae
SHA25691ac398f7981808457e057294d957ed6ac0b26740f48c95f3e0e1a24f32cded9
SHA51244a50579b638f91da445262a1072eb24ed265b084480e0cb855a42b8a5bc7132a55eed0a44c787ac90bf292a2bc26b64ed52c8d022caf222137e49bddda1470d
-
Filesize
1.4MB
MD5b9dbe20afa46cf5c6d88c7f5f1fc3543
SHA1fbef7719834beb84e395f862079433ebab0ec352
SHA25633aa2288e2065f1193e62312b534ce50dd38dd6ec89e715cfb4f134aba4de3ae
SHA5120b90727ba97b8147345c098ad0757506b2f8e9b6402ab547034f390ce213a755ea0ea19d86dd667b7c16fc58ef235dfd20084ca22fecd9806ee73a7766312661
-
Filesize
1.4MB
MD5698dc86efcb5891c777ae30a58402326
SHA17616773dae018124b37e956254542d2352f0cdbd
SHA2561f86b426696c22aa57ef0ee341f56eadcb24470abe3c6f3ef7f23098080b27f4
SHA5126a8959ccdd556760f44d2111de517d13558289be9d922b74be9f4e183ceef08aada40885663a667881d74962bce602bb2abe23a9a95844b99809a4afbcc7c30c
-
Filesize
1.6MB
MD5e1794067576fd6d0d1d8cc534719393b
SHA1552a3d145da8487203fd12fcd58558def626739a
SHA2568ae55428cc8afa9a2bdd07c83b0357ed9eefe10b7fe057df7dfde320a098e1c3
SHA512dc77287d260ff28f1372f74396474d95d0e6a8707894a64b776b96b9c830f112d035a8da7a1972f2389a969f239dc4c615bb6ef39f31766a30b2c3b6cb1b18b7
-
Filesize
1.4MB
MD592d954743ee69a003a229d4eabfdd0b1
SHA14d08e98b7cafbb377925623cec6b109cba61f502
SHA25665cc2137b6338a3ed8999574515a3a807850667e900bc090d036cc3eb425b57a
SHA5127976563f7685b21afa85582d449284c7a6cef00e245fe37a441de29020035dfc30ad3b0c1d63c5b729f5fdf815b3b2e63d5e8bc378cb357a9bebe2f06d174a67
-
Filesize
1.4MB
MD5b7a386835f928778f84a432a993a4de7
SHA15f8f69d1f58350fc218ed8f80dec39b324ab0918
SHA25670bef8f4c79a789f8998c8834d41aa80dd6615266937c366a0643593878d3524
SHA512b9701981d30026c1d903c4140996c36c1b38970c71840e1b15ed56a5ebcf9b91d44333aec279f8f354152fe33f536e5f0d83c773ba839303bf3135feb50d6574
-
Filesize
1.6MB
MD56b991db2c4a43f8fce8dc05ed4ddb110
SHA16d90d3467c13efadabecc0d992f62d6d5074aeb2
SHA2560587800f4c5f795dd8675df921c2968488e738c358a593bd3612e5c5ae35cb02
SHA5126285582bb3aee55a8b760b8e8a3594e32d7c8f7eaaa007037b61db079a8d70899db1b1270b34168ffb6267d374872d2a2de65933d9c3b107be268b52e171ee7d
-
Filesize
1.7MB
MD5bba33c5ac5726d602bd979eaa054c72b
SHA11e143538d30293a906951ad36d33d0b03562b414
SHA25612023a574a9d2464629bc4f885e64c0f5e5dce15c9b4c00156a205904e729bdb
SHA5122f3c894d8b41220ce4da8b452a35a3f0cc5d514f31b7ed5483f3c57de749ee1eaf130e16fcae9f3fc0fe79a1d6434d4d710484151d9ca8dab5a951210692a0f4
-
Filesize
1.9MB
MD5fa8a9bceebc60ec27d0effa4c63274a7
SHA1e8f5023715aa0a0da4f6145f9a4c91ae4456684a
SHA2569830a49d0a83c74b150ca785a4cdf3ac85098b76076b2b18b31344e2a9c4d3ec
SHA51210bd8335b754b49afd5ab05f0a588ae517bce45aa7c1c63bb056a7f3d0d6f66141ae27197995443255eb71e00c0a9b5fa6edfbfd4b125f80eb3a3311226deffe
-
Filesize
1.4MB
MD5fd69f042b47d9170fea01ccdd112345b
SHA1d11c795a4813ae1dc352110d651503995bc2d6af
SHA256e315023649e5f1bf5ef6f749bb7ec55c042d23d7bd94d201cf24cec1f5c3237e
SHA512c29db1899e8772ca4d78c906641cc1d175e45aed70e50ac8f1326a0aff26349ba620bb1e6c13f866c8294c5817f5d23e50dbb24175f599394bc2d37f4f55d577
-
Filesize
1.4MB
MD5f2f88d75a952d23449496267b3e9cf4d
SHA17f534aae086f960197615ea14a415368f3f390a5
SHA256999bd030cbcc3892aadfdddade61dcb1ad53c4ac5b0aa42f0dc9cf63817cd167
SHA5122f2b9d2a953c2a041e0fd1d002e41338e46a65a6fb27fadb909f16c8c44902199b7c0ddc8f792e4395ab29f6ae5e6cca9fad2943b9a96d1f8c94df30d03b4598
-
Filesize
1.4MB
MD5e949c56d8451ae34c7d2fb5bb8cf8459
SHA19232ddbfa38f1626727915388b948b5d25a93990
SHA256d3e61c73d32edce9cd366384e10cf0f4713dabaa19a32f30e38ee4eda48f3889
SHA5120c066d120b99f695eaac56f524fc3f828e1e066573fd449fc5f8e9d6539c32962f5a1c5e79977416e64dfe35a3e8704653718ec9e3a592bd44de7b40a3955f1e
-
Filesize
1.4MB
MD574faffc62e05694ed919920f54b9b254
SHA133cfa6afd9d18067ac402963c0389b6f7bb8fd3c
SHA256ce7a79a17c93eb1a110bb0abd63ef0ba9dd1393ce6bd28208d94e36ec8e32e9d
SHA5121f640f9f52c95241274770cfe545bdd71e421a584306af63788cb4cbef30b9552eb1cb75bbbf574cd7bbcca90d18817dc77d413c4eff7609457043bfce733793
-
Filesize
1.4MB
MD53ebcb5f39d284a14bd49a3a0cc9ad53c
SHA1eeef56c9fe4d648f094ed9880463141682bbb01c
SHA25631c82b3aa7a04021e1534cc1b99d8ce663b1f7868d79525c9d47357b3f550614
SHA51273952ff76fbc3a1cfb296865f675dbadd4d55493b2880a3c7f2d043b6cae80ec672f736f99ba6974d5d604d121e8fce7acbe242b08939b6fb7c9c8e8eff4211b
-
Filesize
1.4MB
MD5fbcc88109243c22805e61ee41c679ded
SHA138b080593c93f0415ef11ac3b44567c1d56f4bff
SHA256496c345018e392714b3c2008180cd42c60cbe64a2d6ca1c660fedc2bb3fb2d5f
SHA512b36175060c5c1c926d5a4f9a994e78d487ba22a7c123903569be1f8fd239a6cbc3f9ca741d546d0ba4b512743e2a211fadbf658824006b5ba2348cfa30784338
-
Filesize
1.4MB
MD5e5184701343689bb8d6395ac997c7820
SHA145e407d8d218f388b4883f853bd6f3d66b0098ad
SHA2567785300bc8a294ce6967ca6fb333788758d4b81da879398fbc45c6f54f74ef91
SHA5126294ab3e517a6b2ab0f6266707231b634d86f9253f89fc4098af76a8dc29c910b0c2e4e83be8bd6530fa49b544f1600745962fa358d1404394dce019fccfa4bc
-
Filesize
1.4MB
MD5d0dd8ea74e5592916ea2c94e259ce4c1
SHA19dba704f60cb01cbf82e73c8e6af168e0067268e
SHA2568f8d4ed9cb69b3af7d7fff6f2bba74c266762f48efc59f53f84c2d1fff8cfd1f
SHA5122a4fec7260e8e648ad452ab28bcaf2b5f3428f74ba1ad68498ad91c6ffb09eaecf743cce23b5347f479768afb563d834c76dff8da5e770e749e3007543bf78e4
-
Filesize
1.4MB
MD5b32c3538792bf35ca3e893d208a56afc
SHA1c1ef945b7ac59e58a3f802767062d107b085ce0c
SHA256521f8649a388e13659251660ed2b03082a8c5acc12e0ee4bbd0f71bbf35770ec
SHA5122c2928ba0322bf686c215edd79a78f283294fcd979fc0abc7e8e67854be88c21365865148fee2ee2384f63639cc422208e92f4d6e7b8dccfaf5e0b54050a4326
-
Filesize
1.4MB
MD5708a68b23195f9c6a997273fa0a92f4c
SHA1f7e62087479c8abe800499f7fc201bdc4f4cf320
SHA256a672208613329ddcd693f5be2e8ab9fc868351f1488cb37192fa2fd0bc5bda35
SHA512d161a73773009d936ba8d4d171b0f85596f1fc366a8aefb757ba72e8fdc68c6863305675e9eaa1052d5fa16597423e7bcf558303add4c4deb676cd7b152c5aef
-
Filesize
1.4MB
MD5176bd18e3efde6c7ab463802eec3861a
SHA1ccf1a2bcbe6e1e66fad6cf7a23982041dffaa9f8
SHA2564ebdfde9f8eb87a4a842c6e14a32f38e469c411870181c86e757f5dbbee98592
SHA512ee3161e5cfcd6bf98283d69c289a823fd0e0fb879ca6c6dac54edc1725180fff06c56b7f856fb958bc48fb8ba963e3613b467d9e73c9dad3d9053003e3e4a8ed
-
Filesize
1.4MB
MD56d6d945205ecbb075d4b55f8e050c9ee
SHA1c3269c2de338752681f8d358f960c9f80c7f101c
SHA256436d67c0226a368eecd920873ea6c3e4f21e1c8d86b65882953309a9c6eeb895
SHA5122da87fa62f76c6e313b0e3d100c2cf90805a3d1965b12b143cbb623c9085ff35f63512e611bc25333942056b574d07c8406a76a0bebb2312fa119245b9984ed7
-
Filesize
1.4MB
MD5b58203ad59dc089f69d36918975f28e9
SHA10767dba202c15c92ee0c66fc64f775b9015fe673
SHA25619ab001d6e1d77269f695b2aaa60f48ba5923adc6f1dd3168082efa488b8273f
SHA5129d5e8a82e72d2214358bcf5cbb613ecd01bcbf5df45dc2217d388bb904a91fcf42b5c5a9d5c674d7dccb324f5295ff69b5010612d2ced4b90e01211e2ffb3398
-
Filesize
1.4MB
MD5ee1b6d4f0bacf58caa6fc4899c1268ff
SHA1d020f3222dbda050895250d674087473e74990c3
SHA256ce782ea78e9d1bde89fff38b52e097b4a7bc314824c52b0c4efe7973cf5a35e5
SHA5128d8fc0a4d70b103f53a1fbd35d743b6e04fe8eaed23e2e1bad7ba5a5102afff56d27690718bddde321438f9b7debb9634b20afed33ed529e254e4034f38ed970
-
Filesize
1.4MB
MD5241523636733974ad2e158a832db287a
SHA105757ae92d602775112b18851ea41f9352f27fb8
SHA2561a138b0991fd64a76354ef59f9b4abcd07da6fe5b44e3407640cd8e741807a43
SHA512326021702bb527bca3c557b44499fd84046d6881566ce358029ec6e1dcfcc090dcc322b5855a6b7ac57fd6ff50d3ab2aaa44826e1443b2fd446d95ecd114122e
-
Filesize
1.4MB
MD59e92dee69a2d80cc4e5dc27f1f66730b
SHA109c39efb58a0ccc010d1df8c0c42a6aa1164dc2d
SHA25696e3a71b564a1b5043d0a6d8d2432e3a22ea48a0c3c477e73d8ebda1d5b5ba68
SHA512fbb1b00730e88123f55854a57580009835e3dc52bf0dc4e688cca8f64e121e9a95099adde27a2e92989cb4514459aad2efd42bd2dac4291ba72c95a7fd58e870
-
Filesize
1.4MB
MD5434a62579c0169d4db8962db02ab294d
SHA18f0ecbe1c783a0c1c23a194a813f802c95866862
SHA2567acaee42a329528e68d35721f55088fc052b61ced353b8375422ab167526f460
SHA512b5540d206206fffa63a9d9fd3346bdd042f5ed6963c218c94ef4358b03eaf6babe903027e37068f4a4a4717e55f581f9cfaa0ae936a01b0e48376903f7dc0ca2
-
Filesize
1.4MB
MD550ec5b2bb5f63e11649abec4d553ed5d
SHA15c15e55c02cf3d4019bbe3f1829aa983581ebb54
SHA256a17662dd331ad4beb845d9630ba6823cd8f3593585263aff05d07da05144cbd9
SHA51284f065b58ed0043ed6005d3a80d6a6a80add0bec3a33968af5b7d5d2857e6cf16297a0c6d50e9768c1ceff64722e67810c9422889bc61cd376137cbd67f3f4f1
-
Filesize
1.4MB
MD5fa7d282fb0f584430de2adfe894a490a
SHA1344cac842dc17243103e02954648db0ca52b7c78
SHA256d8d4382151070da4dfd4d88bc94b4a8f92e833a7e955cd4987f9a7912f565865
SHA512458a4692f66449314c4a8b34e536029298f455d4a4569b0707261831a23859048e68270844eb27b6ac72534f25e8359f5dc3025e98b65a39100cd91db4cc235e
-
Filesize
1.4MB
MD5deb4e85a0502b2cd5164661f8f07af81
SHA1ba6265276a356198269a6c969d678e90e6b49659
SHA256fa74d4c7b9f13dc902fa6431dcc1b10728a90616867494755239a5f7fcd2b068
SHA512dd44c5dceb7310456615e17db5d314e78d2728d0e5ce8859cef13a55d18665a5b1d13670e5b750e441d733dd5fbcd424db7f161d436aa084ddb4fac1eb5d8796
-
Filesize
1.4MB
MD5828f284864c7b4555da822e251d4d3eb
SHA1548b94dd8a502ddcd1994b36c06b2af79278fcc1
SHA256b0ecc971ac5d33723fb3cb219ee9d1e3ed9f68944151c44449fec95e6fd2091a
SHA512e1c409b684bcb24e59d21422f994804a8b101c9d378bed23c9893554fed020e75a3fa679723162070686d3ba14c663f1c76cbddcd9217e012fc8c2fc233c299f
-
Filesize
1.6MB
MD5252227913e76d5ce91643400c5ed5808
SHA1b982420e72cbbd5cfe65387b3aaca88c6c3946da
SHA256f844749a6e72326da5295ee43bba02e9b227d042285b07ab5bbd5e273270c639
SHA5122d005d498822095c0bd4774f48664c5dedb81fbb274dd57d1b67e0816ab2ebe6c6a2d2627d1805576f573c0dde5ea3f0cb91802a141a0d1705e534591b460a4b
-
Filesize
1.5MB
MD5ec3aca508624f7e558f76b4879142a61
SHA1d9bd6f3615866ccbe64dbd764c74449aa9e248e4
SHA25607901a5cd10ae8506bf3d05487a120b59893eba7d510e16d7d711fa8f2b2c8cf
SHA51297e0d7a641fd6899b6ddc3efe9a0e314e0851dc0afcf0c7217d44ee5486b76a89c4d03f64b793b082cb70bf9fc0eae514a2fe255738b6cff62dc404f8fc3898b
-
Filesize
1.2MB
MD5ab4fec32c9eda54f82a91d6406527efb
SHA112348a0e2c3caf38b13adf26ed3fc60a568cebb0
SHA2567ec8d4272cbcbb8c89a025809fe89e992e7ed301fbeafbf846e51db88a6067e2
SHA5127f2c672ca647faf9c2eb04c67cfa5610952ad345e0562979d86d3a367c9a441f73d8cd32e19911915aa89ec8c0c59c872f7a07af142e34f3ed85dbee6b07b348
-
Filesize
1.5MB
MD50083062a10a41ed9fbe0242063373f43
SHA1cba8241fc939935a14f6145d500e2763a7ce60f4
SHA25615e50db71be65aa5346a8e3adce57427bf47b420593622cdb66a883f9187da67
SHA51250d03a8a0d3d997ba1443455a9801c49edab553eabc52bbc3df98dc11482db63fb0794986521d8174a297bc9640f010bd8b52ddb8fc57323c09cc172fd1f69a8
-
Filesize
1.3MB
MD555ee8d35db6b70a812e7b15aa66d21bd
SHA1a8626d6422787eb70c085bff7f742c907d488206
SHA25633ddc1ad626bbde38dfc541cc89abe281803126dc6d1492485de07fb047c74db
SHA5120aff9763d38332efd17ca6b44cb49c4cbe23dd7acc6ef7bbdecb76f1e6df6a7bc9280ca90a122c305270b58ba78152a53798ef98c04eaad9a41502ecd75be2d8