Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
27/05/2024, 13:00
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-27_832d0dd98fec7fd8fe117229c5e7b44a_ryuk.exe
Resource
win7-20240215-en
General
-
Target
2024-05-27_832d0dd98fec7fd8fe117229c5e7b44a_ryuk.exe
-
Size
2.2MB
-
MD5
832d0dd98fec7fd8fe117229c5e7b44a
-
SHA1
b3a76825f1d7db705f2bd7c96096368363842317
-
SHA256
bde097d26757e9540b918b328478bb9885140117bd0cff9c2048dfecbcded64a
-
SHA512
2cab5fcd347fed2c4e8b2dd1f7847a6106254cad2e22d5ec239fc3a62098c7f6174b2a7bb3b8ceb7963dbfa635d3b7385050a9ba8270cfaaec1cc0f35a136493
-
SSDEEP
24576:YOObVw4TaN1wdFukCba4oXtgLhU3wEdmh58IMdIuwe3zfIe7xmvH/:YOOh3aN4FuLbegmtGTMdFrIe78vH/
Malware Config
Signatures
-
Executes dropped EXE 8 IoCs
pid Process 4092 alg.exe 2516 DiagnosticsHub.StandardCollector.Service.exe 2684 fxssvc.exe 756 elevation_service.exe 2172 elevation_service.exe 2956 maintenanceservice.exe 3832 msdtc.exe 2312 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 14 IoCs
description ioc Process File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-05-27_832d0dd98fec7fd8fe117229c5e7b44a_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\8716e0d892be0f3e.bin alg.exe File opened for modification C:\Windows\System32\msdtc.exe 2024-05-27_832d0dd98fec7fd8fe117229c5e7b44a_ryuk.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-05-27_832d0dd98fec7fd8fe117229c5e7b44a_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-05-27_832d0dd98fec7fd8fe117229c5e7b44a_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-05-27_832d0dd98fec7fd8fe117229c5e7b44a_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-05-27_832d0dd98fec7fd8fe117229c5e7b44a_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_91015\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log maintenanceservice.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE alg.exe File opened for modification C:\Program Files\7-Zip\7z.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_91015\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe alg.exe File opened for modification C:\Program Files\dotnet\dotnet.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe alg.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2024-05-27_832d0dd98fec7fd8fe117229c5e7b44a_ryuk.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2516 DiagnosticsHub.StandardCollector.Service.exe 2516 DiagnosticsHub.StandardCollector.Service.exe 2516 DiagnosticsHub.StandardCollector.Service.exe 2516 DiagnosticsHub.StandardCollector.Service.exe 2516 DiagnosticsHub.StandardCollector.Service.exe 2516 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 652 Process not Found 652 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3544 2024-05-27_832d0dd98fec7fd8fe117229c5e7b44a_ryuk.exe Token: SeAuditPrivilege 2684 fxssvc.exe Token: SeDebugPrivilege 4092 alg.exe Token: SeDebugPrivilege 4092 alg.exe Token: SeDebugPrivilege 4092 alg.exe Token: SeDebugPrivilege 2516 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-27_832d0dd98fec7fd8fe117229c5e7b44a_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-27_832d0dd98fec7fd8fe117229c5e7b44a_ryuk.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3544
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4092
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2516
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:1196
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2684
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:756
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2172
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2956
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3832
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2312
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5c68ac4b014e9b999a08f6fb733a64ea9
SHA1d6d0b6f8bd312644a47971f3d884bddc2baeb734
SHA25661c464cde3dd96cd094dd7c27c04427af2e95fb6050372e5fdd3b21c363b7775
SHA5120c882e137535d6ed28efcad85d6c5ed95e0b4762d92b292d1dc249ed3861960d73cc8c9b0648de3045d79ca6804fb3b21d7ecb24037174777e69fa7aeecbc297
-
Filesize
1.4MB
MD54839d8391ced8c83abdd289314702868
SHA1e13e2b49c99ed0db1fc36ea03adabc594f1feafd
SHA2563791fb2d13e8b56bf95577015e71b9e325caf07ed54c9d62cad0bad22ff61e70
SHA512e4dafa284271694bcee8462a086fcf3d1aaff1e878d699d03ab15d049617629ae619379a23f2fe1d2e0cd6cac713ecebece7a04cb0809948f7a08ecc6c16eb7b
-
Filesize
1.7MB
MD51f67eeb8ab0415ae08c0a474a44a4b09
SHA1c8042dca0a9f9641cc15dd6de9dbe8647ba1a61b
SHA25653f4d635cb4309a3b246e6419d7e08361412ff72e4425647b9c3ac8557c3a62e
SHA512d0f63b5e3a72a8955a462342796d1ce8e09d7045f1184933d7daf4860aeebb8c271da7bdbbfefa56e090cd961d42ca545a320c3e3d89e329cb11e442510f1ed8
-
Filesize
1.5MB
MD5d8edf57f75a13d8e1b9a8a4780732887
SHA1d5a3421f83953619c75783343f06bea7eb262dea
SHA25618730d1faf67b5358b057485839ee10971ca679df7ab3d851ce013e6f5358ded
SHA51271ea4b3295dac152272ac1c63c1ed1f57f538e0c3d75a4630cc2fcbb9dc620fbaad7b394f151823e19964d1ebeae691bb78e83c037d95c2ca55b7dfda4ef408b
-
Filesize
1.2MB
MD5dadfbd70e61fadd9356b85a173a4257a
SHA1a7c8b8bb9485b61189934be03ed93a0fc18c2bab
SHA25607b227189c30a621cc4ec7ecc8d418478d3a4302110668546af39300fe984aa8
SHA512950f476379d8afc083753af651e8e884f7cfa8722dacbfbf7213a42d3f6fb7d9b7429a59fdb36c8180f3cde9357dfe1ea2e6910fa8597dd813aec2fd031ebf09
-
Filesize
1.2MB
MD5604d54e46129c27cd650356cd6db23a3
SHA1a8f7877cbb60fb8cacfa73d418784440651ffbe5
SHA256697286fbe4b83b8e4e6f4a07ced8bdf08edcf85d7a9758360f3c582f0f9c01dd
SHA512e5529b0d92da7ec9777d51feacc19d4e95cb26a00f100ada502eed1465e7f1521a39e561f97a0f4cde29c855feefe97a7f7788d1f4b8a075f06628e447c34c8b
-
Filesize
1.4MB
MD58e5ece4e9900c46c47ccd9a123d3fa88
SHA16e7ad5fe966f6024199d2170ed419b11a6e371c3
SHA256bf3a292baa4551c09bc19b10a222c71d004320587000c51df1689184aa5b8557
SHA512faddcdeb47da06d6f934fc122678499c44766d485ebdd197b8f894c83e0870b1b65d27c68008e1983d4e7e6fb10b5e1d93d45eea1195e4609224883cf0312705
-
Filesize
4.6MB
MD55add586977a9416a4af9a4d2bca66915
SHA1325fa397fe410eaafe64b49f26307dd62f9473ba
SHA256944c4102174329ad18ea6544739112b9f2c6cdd321198190c61f45d33eeca013
SHA51275ee1c7f38b1e289b65f3e1d77dc319a6e9a31df0997a49626f96c4392bc3aea171b570d25c7436464d9ba753bc29388757c63b82e8a2762d545f67be003b58e
-
Filesize
1.5MB
MD55c444cbd573077ec2a07f785d5272457
SHA192ac26bda4ed3152a76d8dc9f2d4d70200e8e7e0
SHA2567f63b3488b527a0b71e5cd46bd5223735e75472f221118fa1f353ebc46198807
SHA5127443121385e96ef8adde37200994b157121ebfd828c5a8a13647d0a6d568bed29cf172a642dd972845edcd98ee277e1f3151a6da6534784f6b65f27419cae18d
-
Filesize
24.0MB
MD58c7b90aec880976791fd87887fc48364
SHA16fc2bfae2fc9fb17f67f9ce8ab6150f06cc45089
SHA256a33c07ba6e080fd7b7fb475bb024aa820642b7f8bc2b4ae59401779c3b1c636a
SHA512da6fe8c27e5cf33a83a47db7fc9719a82449f05d3a01d7ff2e326f87c979ce885c60d519c803adff2d182bc252744c3118c31c24b8b21253b0e41537ca686689
-
Filesize
2.7MB
MD5bdf572e44b8dcefb6712b01d50d293e9
SHA16849f8c8c261ec9dc7036736fc828022a62f1ce8
SHA256969e9e74344524982249fdb16c5d07bc77af2730e36d21ffc5eb5ca60551b016
SHA512b2d824b2b947c1e205faeef41867155533d2f4dfe0776e53d25d9d7d2c40440dcffe74f500e97f4092d4221ef6b38be7b5800fc67cc66b6a9d52a6514c5c009a
-
Filesize
1.1MB
MD57c46e69785b693a9c720f869a02102c2
SHA1395eb264b3995b16d56d288e4efd9d6f2bd6d549
SHA256d48921f0d50b8f20d17c327e30092a5565eb691d0e0f61dad6f318fff417b4df
SHA512713b23ebf43312d0a9280c99742126846b446a2bcb62c425ca0fab2337e275f28a96d735b0572c4d33806ac593f619d433d9a3703e73cff33590f46134504736
-
Filesize
1.4MB
MD5de61c7a959d84912d234e9d4ce952adc
SHA10ac78c99bfdcbb38a355c49fe7d6eece3b7d9bc4
SHA25688b306f8197c974dcbb71278149408c356244c353df280983b8296335fb21fc0
SHA5123c64484c9523ba2d9fe3882fe42715e2bdf15b3ee646f8b51f8e16e8aa630e45dbc824145bfcac0befec52f5ecf19dc4d5f872f01618a0f03c18d0b177356681
-
Filesize
1.3MB
MD50c6c86001117ea06822ab1935cac2c60
SHA1468b2e1d01c6291bdec9ed434c483c741a53bd59
SHA256a2bcf6765c5b47eff38184af25e9a5baf7c44aa9383b04ac65ce65f953ee2c89
SHA51281fcecc3c630aedb720c6480d413b1cedbec499afdc8b575bd7195bc5c92ae35abad411b27cdacf6c72e1397ea75a358c4fd63b884bf46a8761abe36a1aae317
-
Filesize
5.4MB
MD5c7ed8f1bdad13cf1057983d67bc3adc9
SHA1786a256311c5df59029d04d1f04d7c8a35500cd5
SHA2569635c38d09db0d3b6820ba648381c82cd7a1fa0e084db65855c9555cf8eaabdd
SHA51236700ca7c8a9138903cb344215b18140060c631e10a46138bce1d8d9840d9f3a527e22f926b456c445069a54175c66c920495c55505fd6a4b1017be8fab009d9
-
Filesize
5.4MB
MD52d37b01fbc08f8552e637612e22a353d
SHA1e6c7ae074402ca4e204844a115b928b63c7f0e2d
SHA25665691d55124233bf2eedda634cfaae6b52c63e79f3c1e9b21c1411b8871d450c
SHA512e70dbfd0bbdc99d8d9edb1d88e79576e14d1340201eb81eb3ea0ee1a544a874c4d028771a3a2a3515c8a2c104f816f86fdc5f74c33368dc5b1deddde7980aec5
-
Filesize
2.0MB
MD59e324fb46873c845285ead6e8e007852
SHA1e6b79b68bece81f758111b6ea6f7d04b452269a9
SHA25680338f61cb4b77c7470c9089a5fbbeb6b9f464a2e7005f38a2294f3d1202ac87
SHA512267cde1e37f491f4818d27e855eaf554b515f0f6824cb2b8ebe4e763e50a01bab943f158152f228a498e9fcd23780aaca8ec6e40776fe59025b3b564aff2662e
-
Filesize
2.2MB
MD5cfdff350e18b38176c85b8370b949ebf
SHA11c3d8ba41deee1432bb9f98836116b528ff0b792
SHA256edb197e96b9850180fa75d7cb033aed466c8463babc0cf28b82a9aa662224165
SHA5126f4e40b8ecd3fddce12e515f1d8aa380408c4c0fe6199edb32e67596de89b11576699bf91ba180db151f668b6062012333b2fc838714f46e3df2a61659ec8852
-
Filesize
1.8MB
MD5d1be806be49cddb1fe0b6f1a8735d044
SHA1ec5d5ad75460dabbc457cfa2ff0c010defabb087
SHA2569797581dc8b20b1fa5fa1aac18dbdaba86d8674c6e4ed2f5255c851745d17600
SHA5123ceb529be8ab0f9c23fb1caffb423e1059befb649fa855fb5053492b2b3e7b5742a11f07f872e2763717970a87f8e49b1c078600562a83d3519e693ea909b660
-
Filesize
1.7MB
MD5cb9eb8fca0cdd5c7b1427efdcdcdee39
SHA100a0e347ef1920e70f0e39fe05c17a7d7334ba33
SHA256a75cc7101c269f6bb0fc42acccf08ab4ebe1afcac42edc7d1ee7fef9d33a478b
SHA512b91b005ca9107cb19278d5360a1ab3c8b15ed7f09e2fce137e64b27c08e8df9c34209189034103346d333f2e0084fbaa876b89b035c389c3fe5c13e44494c1c4
-
Filesize
1.2MB
MD5a4ee62cdb82a40a5fb5aeb804feb5cd0
SHA1f599f17a22c1455023f2bcedd79c95c1ecd6e7b1
SHA2567937f2b26c7a96e5370ffba32202726f6dc8f1105bf4118212014d9c40cd98f9
SHA51236080fd6aca51c4b3fd84be94c9f74dded51cb0415ff304f6ace32b884ab09cd6bf57b854bec812a8522832ee0dd06e03ac647ccf3e23422eedafd82aa78f1e3
-
Filesize
1.2MB
MD5e735255e7b59dd2fb3184c196f226d93
SHA181ac26432fdc81f0b21cbdb669ebab073bcfb2d6
SHA2567caebb8f3e886b841bfdac9d52eac77d487dd8925127e816f17ac3a19152c786
SHA512d7e7be2d895d0a2a38ba2bf74bcbab3c1205117be9d4027884342ad172f8bebaf40e1c49787bf42037efc48c7164072118e6cd233dcfbd5630ff3e42d55cc075
-
Filesize
1.2MB
MD5c923aff521d828607211f07f9f866790
SHA17d9667d8f1d0500abaa6489a04fae1f68ab93e81
SHA25609094f1c09b8c180fe5c1f62931fcf1142470bb3bcb5377d56119cde36293466
SHA512a55fca9d8e7f823297285c41787aa9603da5f04d0917088110be7a5329c6c6cb91c7e9a1c01b776c7c37a212c25907102cbcf5313d617ccd65b961555e9e99ea
-
Filesize
1.2MB
MD5d6d809d1adafadeae0d05a1455f38e17
SHA11b6123fe896e19cc0f3b60f60e412977a8b2156e
SHA256257396321db86f6a5d21962860b08e275f138eae02f606067ab04e25f57a5b5c
SHA5125e52ed47069e416de196673888604605db3eeafa311f796cf21a6099d6500cab89d4c2e35e6e0223f94e53bc4f4a0e266fb2591ff6d898bfb984e6218f212972
-
Filesize
1.2MB
MD561078f2e51e15928f15bc95d75a8d615
SHA18e8648c436ed3f9ed7a8d66b0d95bdd8d97417a4
SHA256dab9082484be7a9732c646298cae380b8d85aa5d352298e4f7a5d8aa1af90827
SHA512648248ae08b228b1d5b33c8aca339af52c6af089b9c582b71649df4fedd5dc387edd4abab517fcb82e52643a26f7d00739d7c2e1cf0a1a5bca5bc3c05717ec01
-
Filesize
1.2MB
MD5112507e0fc9d2d8d44f097d66cd929fb
SHA16dbf4e74e4bfb40b6b2b534bc046a2d41cce05ff
SHA256db936feff584a8b6fc8ed72a4820191f119224e77425fa069148d9aa9b110e34
SHA512ec3f159094d3476fd0164f4a1b68aa565d64639a4cfbdd31b9600d861d3d6c9e3489b307aa230dbf59b79fa3237ed503bbf293fa64a61ff462837126c19167bf
-
Filesize
1.2MB
MD511c29ad11ffdc3d0f350c341eeddd54f
SHA1a4fe345cb2268d91321e41a867345c199c846969
SHA256924c2225efcf8bb1c75a805be34ea1b24450b2372952ce562cfe7b2e8686b907
SHA512df3e46f4abd2b85057b83706e84affab03611503209546335dcf9b718c4765f26bafe0bb1587cb2159aa8ba54dddc5c8500bea09257d3d6fb929cd54bd8362a3
-
Filesize
1.4MB
MD5a4510c13bbd704614e661d67b83b4499
SHA113336ddfabe5af68473e96fdfa92f555c83c07e9
SHA256e5fe610aacead82ff1667f68dbb07303f756ded75f00f4d69bf7e76adc4af1fa
SHA5123badede930bb1a3291aeb3ea462b83aca7609250cb2826401cc3ca684fa942285662ddded3abdc613fdd23352c5259e97f55747b9b33f904174992410356c67b
-
Filesize
1.2MB
MD52a879c9980ac99fa3ac857399edc8f42
SHA1254bbbb3aa0a62bae5647c7a1ea6e94e66f459a4
SHA256c53e9e0efc0fc65d4b7d65d7f2c697d38208141a9c803d954b3b03cd24b78f28
SHA512fb1e4c783213d61941c0235fcec10d133ae005e4dddd0c51ac122babcbff98c8e823ce1ebb9ce0dba6c2d5b7631e32d0499c5192699084fca03b186a2899fc4c
-
Filesize
1.2MB
MD5d316a559e3268ce4b040960b91be7947
SHA19e9ad9786841b75f64f1411f66088229d90519e6
SHA256f8e101f13c9603ac9ba36ef36f1c3aa6aac8def1f16a30c2943d24722eea11d2
SHA5122422793b3899396541875d95fb59e278696658ae022ce16620407fff02bb64244076ff8d5599bbd9e78df6aed397135103bdbb2f264d22524bc3aa38de3fba49
-
Filesize
1.3MB
MD5a8358bfec92bad3ea2497f16fd407cea
SHA1f916821c5306f3ab03396242e8d15b67e54206ef
SHA256f8585925a5f009cceda5d009a0f185595dddea1cf7f33fb494a5a05566126052
SHA5127cd97eb3b81abd3bcdaaecfefe4050ff41c359faa6a915b190f6b2a1c5df6c06c99c1695ccde6bd3759164e61249ce5259652c9601caa1e6eed3483168ca0366
-
Filesize
1.2MB
MD51219f35db0eaec3ec71e27432cf2af40
SHA11ee5647a1935248349e1c7ec47852f7603ce478b
SHA25639cd3bf43eb0c1e2955959ac7944a84d12fe93e9b6a03eddde178280ee9aade7
SHA51268c3115d61d168176915f8ea53da2047629d28c94bade9e24bb74e419c2ffb082bf5d9e32d78adff8c061f6f1add04366d994dbfaf375b98e50c400cb5a7f7e2
-
Filesize
1.2MB
MD5e7fd4cccf4760e30fa7e3d5ee7b2aafe
SHA1f9117d11a123ca4fa0ad5cf21654569073fd28e9
SHA256900ed5f68ddd248fb3960651fa225f8da9f164807c4d4e7dd0d565ce83ba99ab
SHA5124b2fa3be51058d51b5d14dd8a535d8d81bd1c4b44a2b17babb73cac073791b4e7f69debc9e2bc3acbb4b68780a776dbf8bf8246507a98b3bd92a5eb8f52b28bc
-
Filesize
1.3MB
MD52bbaa5e321dde259390355359e4aa266
SHA1df384aaff66ee2d0514d28b49e2d0db17badfff9
SHA2564c8aed94445b79f5bd539bed8544732ff1b1ea9465806311b143ec40d051d09c
SHA5125bd1b0f0c2fd5cba0ed6d5e72b8f4cf1c60289ad0a733112d0085c5c0a16878fbcb15fcd956e779367162b7a8261ddee6c7a15a180c382dea72c3f57bb263ae3
-
Filesize
1.4MB
MD5b0427d6619e683a6c02945e2d80e9f5d
SHA127760a4bf38deba64c4ebbcbd00633abe5a20260
SHA25615d9642e460e9eaf5e3f41a29c0fce3ab2b3e2002b51c19318644f50222cf1ac
SHA51231228f32df5906274a57595a1840372bfbe17034d95b97fe461120ea02c012211c984d22f2ad77c7df012010aec083ca46f051fee2041c287b5f99b11cafe4cf
-
Filesize
1.6MB
MD5897684f0d0c63fbe686ffcf6012360ac
SHA126b0eb21d2f7f139180f705b9c9faa477c909869
SHA256bdf8bca87d6b5c0d5aadd20ae42615375b11cd01f02e59cb6b383d3dca4db535
SHA512ef56e038b06591a4cc25fbcf1dd09802216dd1baa08c16d5f6b9475a99c6ca1f0d6ea8fb7c508c5581e5661c3ea9252f7f7cb2de49871480e900835ce09bee76
-
Filesize
1.2MB
MD5b5d342b3f5a2f8f2ba0825214d23c449
SHA1f53f91573afa083390a406a12182f95a11489025
SHA256ec1da3fec5cef37bef762843ecedba7b217b23db6508bac29a1123ac48dd15f5
SHA5125a6f16fca9eeead799833e4eac403d35ea99ff7f5e7f5638ad31956f6d36faaeccf750d25d9cc98a3f1bbfc148a0f2430a329af21da1ac595f751a968a93929b
-
Filesize
1.2MB
MD5fc2abb0cfc99094e82db6d45bf46f0c4
SHA16af2692a1581968a8abc2874ff459e1986002a4b
SHA256d2228147c59efa3a0986b606bbc26b16fc47148f157ea21e2dd2445a56d133c9
SHA512a66321ce3d3279cac4ae4267a38f2addafb4619d1ea1d0ba171fdce694bd7bc5f6ae0bf06adf54f3179a0ff4a1d22b7a09ae9965864fc83018535be4b1e01e44
-
Filesize
1.2MB
MD5d3a9988c145d9792efbf3c5b9cfa8fdf
SHA1503962049410034681f9721e86cc90531488e833
SHA2563ad1330bddc54edf2ea4bdcc6a4546b4472b9c0b7a3f75054490486a3bbc896d
SHA5124f09b113d811898bad033f9fff53b6eb436b4cfda0706e38bf1217a949a19e6ed04e2ae17b3ab261ad37efa89cd134b050fb1af913287f23cd8ca479b77e14af
-
Filesize
1.2MB
MD5ffbdf8e1de4ffc80cd124d608890463d
SHA1de6950bc5e984a774239691f85cd7c2ac61ba4e8
SHA256a23bc2da1f23cf944b8b48de5c972cf0d44a20d513391e5f3e13162bad974471
SHA512e48f3628285d6949065454799f12821ef03119397c7d8912ec5ebf97ebc535b350775e96cc9dd71770b6004b4a9bdbb2e5a3134c5f68dddaab2e86817ef0ac7b
-
Filesize
1.2MB
MD5ed34968a883fa244c47887e3a4cf7e60
SHA1678687f90aaf29bc9bc6cfbc3239bb6e15b5f8ee
SHA2564c276f713dd034a1319c82daed3dd58e1b625a00cb405737fe1c1a6cc23babfd
SHA512bc294b64c8d38ea3c2a73d828bdd1d9cf59ec82cf41e81b08f4a980c507ea9aed87e872221c0d4fa5fb211eacb1d8318721cba21c83be79fc8b5ed42fe368452
-
Filesize
1.2MB
MD5377036c88e7548922ff4f5e5fd760396
SHA1c8de7ceb28f616946e070dbabcf51f99f4ac925a
SHA256bcbfd70ab07090d6dccf3a3919eeeeb721ca08eefeeb1b479e3358782c3e1ad4
SHA512908654f117fb60266797b8a90eb7cf30dce78e68ceb80980653a55d3a54d34f917ec5b6b6f59a33d51084c5c4cdec9a23ad7f2ed8bd8b320cc7391a1d1b9fff0
-
Filesize
1.2MB
MD543df9b5898e53ed6087d7419da9bf94a
SHA15141d07449d2a01a519d746afb4a4aa8c66f9b88
SHA256afe2118ee27f14b92d2f3f7fa73c1cfe23eff5e0358f376462756ec84e6fc2e6
SHA5121827667dbf274590d17da0b2bf6d624e3055ad39ef41aa53e20aa52b1b8dc1836ee6353c684f110a03d39c2a58895043f3fa6f358fc057731e0ca097a8fecdb5
-
Filesize
1.2MB
MD52e48e269a1b9c87a0e7f013fac344840
SHA12d1fcfb650e96fa3d16f1d4d1867473e7d281335
SHA2562b6c49c15ccfc83127488523b4b2b536883e7db73bcad23ace093d4d86d5fa37
SHA51256012acd5cf8760e0c5aa8b68e5b924381c2b94fc0edc773b1de0d12ec1a2a6bfe9a9228829e7ca8bf2d81dadb33ca1b226515287e66a9d2ca35b9fd70a958ec
-
Filesize
1.2MB
MD59398ecb527252807430efbc7ec58f820
SHA1024e8c463b62181db4a644a835e1713b432ced35
SHA2562571f19dfb84a89ef349203b456041f8ff88bdd2adeb494a4a0f6b5d9bf10754
SHA512ac304fc8a2e9f39b074cb2801965bd9a0e3fd0ab9d99cb8e45c6e4fa915e2dca6e758887ee888f834547906e8eb9eb0c7170dd5c2c0e9924cd837ed15470ca68
-
Filesize
1.2MB
MD50f588d0a4ed176c1f2869399763226d5
SHA1327fc7c922f028bc70ba7130fceaf9fd2b1a16a3
SHA2560e0addb95862e5d780996cbc2f43a74f9d89fb7e5a2e958e4aeff4e786ea4b44
SHA5124ffa2e71bba6f8b95f3dcdf6a662ac004abe755280d287c70a242f6c9052db2cf6808a0f4ceb409e34a4d9a251e34888024ceb3a2d65b797353aa0cc70af6b76
-
Filesize
1.2MB
MD5a4f3e5dd5bfcd3e8ca8473ac1c96a211
SHA1222aae98edac309cdd9a17e9133d4a2501f267dd
SHA2564a5b7cf68db399e62b41dfa4a0d5c640a13912aeb7a1aed1cb7986b33c29977a
SHA512bc13e606ff27f7a95c2187e30c5dec8188b5115eaa307cdec0da193cb1d8eb58abe5026b279f3dcbc0daa059ebd14abea0459893077e2f2d69464d957eaf1234
-
Filesize
1.2MB
MD5b5e7b75ef736807f395f724f7e0a2aa9
SHA1d39d8c06aa36b9edef3ef49bdee5aa7bdb5f7ae3
SHA25605e8086ba821d4f990dc73286e577a2d3b0b9ae2228f3f851dbddb91f11cc97f
SHA51288d8330ac61cc495e51ce88f980386deff74a179a80cce8e90442e3e4e62539b34a3cc3295e2f3b2fb32b06d4877cb3f95b2ae4709f8edda6976017d8936951e
-
Filesize
1.2MB
MD55b767d6b0fc3f5800eb27c89699cedba
SHA16e96027f3beeffc881159df2424840cf2d3e1fa6
SHA2560ee43daf121578994399c3a6edbec6a2a2b25c5b0f61b4f7386b2ddd860c6db0
SHA512d13f70ae65545c3740c5fa2e42492990dcd3fddf7d7bc88c88976df5ba78c90db641e20093d45d125ed78643131dd3046009c5d235850a4078c49a79dabb22c5
-
Filesize
1.2MB
MD5171ff7177cee80ae76f2e6dcf877cd9d
SHA1c79c134893a0d764c20f794dbbe12364940ad44a
SHA2567a6c6aaf2b2bb2068f93e916201418bb5ddc5fe7582b7ac83c66b8ee083aca66
SHA512fbee78f2b9b7710f153e2a9838f7947dd366e2651552d1b8ee89fa1039dbea0265005fc302d84829404ad4026fd6e45331520d6b08a282617b8ef215c379ca7a
-
Filesize
1.2MB
MD58af8f0606385f70aa39ccc47a49151a0
SHA13b62742036ad1fb891650a1e15b902b5419ff6e3
SHA2567bcdd997ea694050985c21eea3832eeef4d9fbc70551fcdfeaa954daf41d36bf
SHA5129a4d4734f713d563a4d707900667e95cbf3d306f19694fcea851e838ee3116fa1c290985ca6b66e7309b24bf11daa4728e658621043743b16e88b53161c3859b
-
Filesize
1.2MB
MD5fd62a78f18ae97609f80a25a15f92690
SHA1f5b6595d619abccaaec28ec2aeac84018837b809
SHA256b57294adf8ad8a22e1a3a59b2c7112e86d2fddcc9ae733ab615904c93d34ae69
SHA51218fc7d6ed3e1d6093e16e76194b855572e797278a9333f37f5a6624e4dc59f87271bc8cad81f48e15d7c4aaa24d2799e58cdf840d2553797da562aed3e4c02d3
-
Filesize
1.2MB
MD5a4d8c81e19ecc8c057a9bf2a28245061
SHA1e69f003cd1648fe9fc95feb4a363ab7042bdc139
SHA2569b470be1295f7b1623830dced96c6c45c4c68d4720c63d2872179a505a4abcae
SHA512f85aa7df28278e408f70f3a1cbeff597aefdd18e2761244f058a3c98f262068d54d01814c2664dcd022d10d4df13f09277e39978eaf65ea5eeb522bfa1020699
-
Filesize
1.2MB
MD5584531daf1f9574a9bb1a35695d23988
SHA1ef05a94e608bba12c0bff96113e29c56fb86278f
SHA25683d261d042d41606b8bc42720024153f9601b2e94dae5c1c7f89d0f99d918aeb
SHA512a24f5236481e754e05686d56e2bbf00792251d1d186582b7cbc9bbe9fac6d7f233e687e5a8ffe8ef92373ea14e6f24f0f6632ddc035a6e04b5875853a4699de4
-
Filesize
1.2MB
MD586acb2d3b5c990c5a63bdf96fa6414b8
SHA1af74667fc536e95f2d20cd6e893e4bb2e7f25887
SHA2564d18d7e0cf8453df006016d4c8948db2398331944b48262b12c68d06f310833a
SHA5122772c82d061ca558fdfcbba3969c40c7060b5c8715b990726c99e43b7342e3e7dd16736a51d63b5766d330f7e026a3a74fc290d603bdca0f538c50c83806ab0a
-
Filesize
1.2MB
MD591d682ac40844d90dfa3b471abec0e30
SHA1be319b32f656b88d655ab8e157eab527fa1c00b3
SHA2568c0b4058a8b999313bf4ca42b473068374a58c425d4bf34753ca2d6f6cd6359e
SHA5120a92b53d11a9e7f4b00b23c0844a6fcadbc0c5d372a09030de3a31a13869494fef01bad061d16bf9f6039aeea17ab6b7d58ff8d80d678d560139f07343983f98
-
Filesize
1.3MB
MD53e477b2a82f3f9770316381cedca61de
SHA1b0a39b6ab0f109f695c1b0655559102725bc29a3
SHA2566d518d30f8ae763c8e3ec0db7ae022634d77d97c59033ec3dae2574df7464d90
SHA5124d6f037248ff642464d921f500b9861cfcb425845c7611e493fdd0895279a3bea1ba8ef45c8c89f2cfc79d1c1ba8959892f2fc55c1861c21183eac7e2d2e29af
-
Filesize
1.3MB
MD5a7a6840fba470d6354277e5c41e6086e
SHA146b65f98aa32357a36c5d481a8ff70b6f54db8b2
SHA256103676c80430e6f3544ce64745ca548cee02eaa4ca180b0c87a55945558b11d6
SHA51287ee4a1168bdc1365ebdb01ec0e85b2326760ba1ffc5fd8deec166eeae4851da62c8730a2ca1b6e6e136b3b95a9f63162e75438ae8a104a75873df6f142a9a16
-
Filesize
1.3MB
MD5be46f7cb69138ea685c2a9d83b6c459c
SHA1d024d0efdbb35fd00a0e1dd4a291c52901ed1939
SHA256b77ed627214ea41a3f8f7adf4b238bf344ff1b7ac88db8283d7796f84f60b7e8
SHA512a9cecd8adca4f7eb9dd2c1f38438c15eb0ea7f99d4443ababc2d0f0fadbbde5f6f9108741f3a04a22496640dea46e2b6508815df5b07498532447da02feac674
-
Filesize
1.3MB
MD54bbd9798997024d375a3628f05fe1849
SHA1c0000fe69addab79b499503325d8f966ac37c1ff
SHA2565a529282e82442b465ea3a8827a115a24c4b9e7396abdea47b9433a4ca8c757f
SHA512dd98c5294a1ee97959d5e7a6cd12ef563654204cdbc227a096d845f765c957ea2aead18b7e0c301fdd64633a8be4846519888150b8a5223925c75629cec9bb6d
-
Filesize
1.3MB
MD5758550b14865f477f48cc4eb78506ca1
SHA1389ffd0f1aef0a5c1bf1a5c5590878761c444db2
SHA25680fdf119ed246c4f80fc160a22723db1f64003c0a9e7b8a9f0a9798120abae8c
SHA512bdd0a61faf1406adc5aa6ea2c6ec750aa86d5060aa36c7d264de19265e865c0a3c5fc9b00ff85e1d4503ee8221706dd8bd9e926961bbfe140662b235da60016e
-
Filesize
1.2MB
MD51bb002aab1900979a328104acba3e617
SHA1c481dcfa755e6d6ba9a85ccc238fa88e4184d7d1
SHA2564b011daccb2bcaee1c7423660d011aaca02af4ec3e2ff87f1db25cdea34d0bd0
SHA5127c46262cda299012bef2147f1b7558ff8007ee85b0aee7785e0a0ec1358f1ac1cfb5f39d3ee95bbdabf8eab36b58f1cbd8e540feec5306927ee05c8e2fd99811