Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
28/05/2024, 17:07
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-28_7f89e6807dc7f8a4a7afadb278dc2cf9_ryuk.exe
Resource
win7-20240220-en
General
-
Target
2024-05-28_7f89e6807dc7f8a4a7afadb278dc2cf9_ryuk.exe
-
Size
2.2MB
-
MD5
7f89e6807dc7f8a4a7afadb278dc2cf9
-
SHA1
8f0a56d59b643e2599576f3d24b1925823cb8e22
-
SHA256
225b776dac201a08370b0e80e7a69a43eaad7d4c17a232f2dfe38135ccd51c81
-
SHA512
6b520204302669a794dff45be9b85fb77dba1483df77c6d2d539d1f4103ca318a2d2f0e9f8a6896e9b739b99848d04b93232e2f892da3a4d85d549327427001e
-
SSDEEP
49152:WOOh3aN4kuLbegmtG/gDUYmvFur31yAipQCtXxc0H:gU4ku/ctRU7dG1yfpVBlH
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 2028 alg.exe 888 DiagnosticsHub.StandardCollector.Service.exe 1808 elevation_service.exe 2924 elevation_service.exe 4392 maintenanceservice.exe 5060 OSE.EXE 4468 fxssvc.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\system32\AppVClient.exe 2024-05-28_7f89e6807dc7f8a4a7afadb278dc2cf9_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-05-28_7f89e6807dc7f8a4a7afadb278dc2cf9_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-05-28_7f89e6807dc7f8a4a7afadb278dc2cf9_ryuk.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\d948872d4a48edc7.bin alg.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-05-28_7f89e6807dc7f8a4a7afadb278dc2cf9_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-05-28_7f89e6807dc7f8a4a7afadb278dc2cf9_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe alg.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_95203\javaws.exe alg.exe File opened for modification C:\Program Files\7-Zip\7z.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe DiagnosticsHub.StandardCollector.Service.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 888 DiagnosticsHub.StandardCollector.Service.exe 888 DiagnosticsHub.StandardCollector.Service.exe 888 DiagnosticsHub.StandardCollector.Service.exe 888 DiagnosticsHub.StandardCollector.Service.exe 888 DiagnosticsHub.StandardCollector.Service.exe 888 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 656 Process not Found 656 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1320 2024-05-28_7f89e6807dc7f8a4a7afadb278dc2cf9_ryuk.exe Token: SeDebugPrivilege 2028 alg.exe Token: SeDebugPrivilege 2028 alg.exe Token: SeDebugPrivilege 2028 alg.exe Token: SeAuditPrivilege 4468 fxssvc.exe Token: SeDebugPrivilege 888 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-28_7f89e6807dc7f8a4a7afadb278dc2cf9_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-28_7f89e6807dc7f8a4a7afadb278dc2cf9_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1320
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2028
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:888
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1808
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2924
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4392
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:5060
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:3400
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4468
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD50f69ee3e02b6757e993028cbe9390f61
SHA15bdb18a263daa84d30b36f95e84f85b36c4c367c
SHA256290d93513b4c1d4d070d3510833b43b3b042df84bbf90419cdeae8897bc7db32
SHA5129e3f3a3e9d2e730626d8f5f398c5528e88c91ab6a5227712d6968d7debf3dba4ec970d9bc72abe61824d2a2a9b2c5fa75c58a7e56f2128a4ca1cf4753caf5b97
-
Filesize
797KB
MD54ea28b90d61aa736df3b76f371868819
SHA19dd06a4ae69bfe24712126cd9bc42ac83a74e75d
SHA25605f684a95f7412dd1416e06792a77fbefa3cb6a34579fbace8dbabe189fd32ac
SHA512c574b51ac6ae0244bc40bbcf1abb8d1a1fdc04aa364d9aec7637ed5e6e618824e0d3bca2e420cf8538ac7adfe9dd05fb78aa69dd968b6db7b1f80a32398cd96a
-
Filesize
1.1MB
MD5500a48f555df70d4d25ef35cbba295ee
SHA1db57678bbc2ae9bc10fccce92c4f17d50d6228d2
SHA2561c6e3add2108d43b65033a45ddd7d3b782a9a7f21e9d7f708c5213456707e629
SHA512d2795f1255a0059e2cd19ed33fb95bc0bf29c4fd0d436bc665cfa445d917e269614d966c4ecf978300508d3009fd503ad844cdd3491c5576d80423398e7144d8
-
Filesize
1.5MB
MD5e2938eb087979071c7502c34b0227c15
SHA15bd099add297425d8c142d9dafcf439931f8085b
SHA25628154de6aa56575dbc9fb8af1919d4da2e7ea09136bac1e3066a2ca142ec8876
SHA512572632bbb486bce455daf3c51ce65a42db96b415066d47af06f5c9c8e78409898846e1d518e72536fba93aba0662f7daa29c88ae6122c0f1844aa02a2f7464c8
-
Filesize
1.2MB
MD5d6356a0197f89a4ba89e076bf12a213b
SHA1e9266b5bfaf29840ab7cf3a562b78813430e60cf
SHA2569f8422dcdda452fe4e17e471d2ecf274d4eb8850b44092528acd16d14a97299a
SHA5126ae85e8ba46b5bd46eaee2feedb8d2a349b09630a86c9c78ec531b8b0401b73c85dc5bc9bdb2f6ed10c38d245fb044c420c9a36f17de38cee5360963c23f1155
-
Filesize
582KB
MD56a4c9020e5df4f2d74503587b2e85969
SHA1a27bdba0c4295bedeb3b97c6d4564ce89ca2e420
SHA256f7cfd1d1ce3fe2075268b8947871d1999138976b6681a652bb0a1f1d05fe103c
SHA51255c65d99b025717f28d243c3d7633f6b30f096c1dfd300f2fb818721f14a5724e2cdb86124e256e6d8fd7418092d3ddac9dd47f548029a160e2e3074d3cb26db
-
Filesize
840KB
MD51fc8aab78bd5d40bcc49e2297df901a1
SHA14ba074fae2cd8cb366b5c4291f5aab42bea7de20
SHA256be358bdc24fd1a070e9ed417b82c5525341861a0a00b32ec63f73199d8f5f880
SHA512f5ece8403abd49740a0f0ba6eeff03e10f7041049aece2e577802646052586b4a647c7319b0816217be7a3ff1160db5367fde6aa4b754638b4a204644b0cf85e
-
Filesize
4.6MB
MD5138640c215cb2133c5a5573cb59009ef
SHA184223678964433e66083cb604a3dfa2daa36ef00
SHA25647a0e33a4dc13b80b3077ef69c3f4ce139bfaa6a4400a33ed050e9ad1710972e
SHA51266fe052d02c085b84e5dd56e5d3c2c38ea235a040f18cea35a3502a25a77cdb579c5f8c93a5d9e2501513429abdc27ab1a1d78015f1c961649b57f272b1196ad
-
Filesize
910KB
MD56516516f437e48a5f88497dcd88333a6
SHA177f6ebcdbd5f85cc0d76bc8c87903ac72b0eea8f
SHA256e1bae8be07ed76c7a28dc0bb3bf1f07c05c937e29d116fdded69b71cd507329f
SHA512022c58bbe6c75a35f3da1b6b447b8a7d2d7edd66c3d7f109c508465b3b9076b2917d951cb88746712b1a7b0ef95a24843e5b4c0d5f31baf75135c13f53b01536
-
Filesize
24.0MB
MD56cd3fe4c9b8e7ecca05267a89d4283a8
SHA1a818aa09cab09775928f18633a5aab92507ec45f
SHA256c773e544ab143f839776d6ae8318bb6fd361859f850ad01e3f4a6bb9c5b6a791
SHA5125100bd32c3df3475e2a8fc7cc4dcfc602683eb307289174abb07e44c72f9118a0c3eb6cbe1cf2d0bb3da881dd34790452882152b80cbeccb143234dedda55b14
-
Filesize
2.7MB
MD5a42eda003fa3e937e1e4228ace1a41cd
SHA16e481d544ce6498895d6f42a673842ba220019b8
SHA2565302ea739966b18154dd08f0fee6568cc72cf20d3be24f10cea727e4308c10b5
SHA512ddd1ec69141673ca065d172eef827ae9ba8d5236ae8a4c771244144c115ba61fad85c1c648ac3af49845c4f4b3ae89a380cbc02c97059219d73c70654734ff37
-
Filesize
1.1MB
MD55e376e7100e20b7c19d34e3347fa12c0
SHA1a32173c091cdde067b154f88e25e9b8b37c78f90
SHA25627589112b13e9e24c49b33384cac1e9a02f6938050fe09c74b31f4a860102eca
SHA512b8548307fc6e8f80c5ca3b164cfbe3e4ed7f308b3f1cb45141539651863aeb5c7ee152aca7a5d0d05a40042bd78849e569b001a34164962cfea2ebf822c17a81
-
Filesize
805KB
MD537bc9f813dca03c8957c8e5908f94150
SHA116c709240e61cdbcd28e47c7cd89475d66ded2af
SHA256b62116f10907499e3c3f4c32922646e4353f302078130b0a82746a663a270250
SHA512b2cdaf23907b9fba4b5a777ec1df8bc22babc4b2ef6ec406c67b545f886af7d6fda1af6d400a25028febd1f8058fc28d69a5ab49a0f21f40eb4bacd006ebc108
-
Filesize
656KB
MD59b6264d178f1db44347b6de75d26b024
SHA14c5f756fa849ce8196836eb3ab12de5e2064362f
SHA25655e9096d5543bc91129ca98ab71979d992541760b865c6281a1448f471147375
SHA5123ece3cc7e6c8b9e3ecf318dc6f58e30834b02e9b3e281a4227be0eb9f494cd7a3d10bbc63bc4df004ea4cf46dc6713f83c650d39a2c5b2e18b3ef5631bed2e70
-
Filesize
5.4MB
MD55779fa3300cbf2350997824e32b488e4
SHA1220346ac3b9afb39d6a8886da0790a12ec1c70ba
SHA2564ddc0c2e622f4ab04cff6f003e29cf69ba45859e1e9c6512d8a130c8082b18e8
SHA512d976bf54c5c1b92d4a2da88e8079090cf503616dcca80efe2ad6ee618c8c796f32629066b3b51cbee2c75facedfbe67b76bd3770c00acae41fe80f4f6b19b403
-
Filesize
5.4MB
MD579093517bc4d8259a5cf00faee6553d3
SHA11e06e09a1e9883e5b3f233692ebf602f1342434e
SHA256f9af062c27ae0bcb2d38bab64707c45855d63e8e834ad93dec56a53a5a4fc560
SHA51252852abeeab010be68aa2619237713161abee885420d834119039a8ef26f310f3967a8cc2de945ef7b2a289857fab90bcc4e23341013e47437300e417069d90b
-
Filesize
2.0MB
MD561d045af5fd9af469eae4c40da7e2a35
SHA17e36b5b13a9b27762c9d7f97945b60ca4bbcf0ac
SHA256434f095c5a0fc0fe90dd965e5235b859d7cfc4a0f364a20227de3cbdcf8439b3
SHA512c515886e6c8232218e3904c18e07a9db066e01598a76a4a7397d3971d2ac596a7ee3e8c8383e471f95a2090af8fa400d2c8a8ff7d250eeab470261c38baa815b
-
Filesize
2.2MB
MD5d0e423ae97d34c70add05e9fc1e37e26
SHA1388798cd576902d03b5135ca7cf0cf000f783e87
SHA2560df77b5a7f535096d9578a5e686fc92ca001ad110945fae283306dbe6274678f
SHA512f4452b12292a2292dfcc85f73e226103f7b266b92cd9a424f8008c70c4e791359d527526be4837c0ddbfd8f1da3c2289c461af44de7034a7a1fd54375c4e5a6e
-
Filesize
1.8MB
MD5180a5b66b547ca59b32b2a782ea2f3cb
SHA10b65059345676095b101d7d699ea792a60897249
SHA256ff800699bffca538ae1cf6c609f2fa42152e664ab3653baf06fe7c1fefd56778
SHA51224f8d6c386e229afc4a4091edc7d5d76111200e6a4ad42e81d623b0d29d9959cee0c03bd50b4567a0406ac0858efbef783d362c5ceb34f22bf53cdc7a48084e2
-
Filesize
1.7MB
MD51bb5d786a778f39fc1fc5d11dc5d06b0
SHA1e6fc68cc38d15b84dd0adc5bf075d4d1ed8f0852
SHA256bfa6d72697eb7a51c233799cb6ff3552e3393b78437f69998c94e06b723314d5
SHA5124aba276bd1ef8c851bfbd9fceedf75aa287274dedf9be57fbfc6b7d336be669f64f919cfe7e108fec9e2c2818bc94acac3f7655b14e5e33b3b2961bb3f44db77
-
Filesize
581KB
MD5fcbc8e5b3d6e5173c7b4bb781753513d
SHA1aee48b1e6fd2a6d015396626152c79b9e5b0ebcf
SHA2562f8a14e78be51ad1ab3482a6ebd8a677d0cae05a62f1eebe853d0ff2a5b87e9c
SHA51249ef47e43d6351e14b988e16916602557b3e7041d3c8024f680354f0ba2a2bc945aec95670783554af29b3a1ddd1239c60a88029d5ee0be392a35fe2f77f8158
-
Filesize
581KB
MD5ca7f902a0b2c72cf008677e60bab2b75
SHA10768c7645da70c79d8256e40765f5d501f65b48d
SHA2566366ca9e39f3b7387ac5a8dc62741c90229c08937909ae4ede793f2b2a23948d
SHA5120353221ab98e0d8858a88bf0285ec66cf910d12fc17e1fdac30e5f40d180486963e86bc49a9c527d293b3f6beee556421f3e96f8a5e9a3fed7d2fa4701b4d3f6
-
Filesize
581KB
MD530c7c368da6b965ba1e0b415f5dde8e8
SHA1f9189b24206c4bd2e46aaa20d30ed1c717432a1f
SHA2569927202948277595da6cda9a3542ec831e249ad49d2f2029c79fef92bc2c8ac2
SHA512f14a6f9a156cdc11a875b2fd300bf2432a065cf5cd0832f14e6cb1b6e790713ba453f40972052e49dc2bf2eddc331fbef7cb003f28b784b0906bfc80d0aab514
-
Filesize
601KB
MD542ed58265cd8278ca3fec5bfdf89fb21
SHA17b8954590f22bed32fe13d1bc5f702c0fcb78e76
SHA2568ec95c645098ac687c1a205db552b146b7debcc74a67e7f4f5e10bc78c5aa43c
SHA512be17d59a2fcf730fa19bb2ba6bebd0bd9a2ea6023243eb52dfe900c93ab749250334d0c2fc370dfa2f25575fc92613cfcb4f0f6cc3859dcc9e008513bcea0bac
-
Filesize
581KB
MD5f8be865d942706556b9a50912dd239a7
SHA1e8c328ed0f164c3cd30b1a238874caf1a169c24b
SHA2564084f4c9790ae40c47ef77298288a536044daa17d33ec8b185a9e3ac8f31e9e6
SHA51281951266962f28fdc9a24abb4cd26053fcd232f1655d54f2a086e8121b325fae99bc5fb38af92ffbd8fcdb10ff4214d8e38bbacf442bda586daffbdc129c1c49
-
Filesize
581KB
MD52f1efc0bb3d66fc117858ccfb39d13dc
SHA1786068019d76d00cb984eb43993f0a185ff3f297
SHA256affabb22efc58270210db4fb512b270cba28f870efbed057a47ed16c37d8ecfb
SHA51270f9b281dac87c9a2f4e95daf65ffc6903b4a29b970430facb2f31504aa3be3f2c5bb2c7410ad8d93e488499453afad79c8343b6337afdb2556d9c57a2eca048
-
Filesize
581KB
MD51466a1dfff33bba36984486d7c4a3d2b
SHA1b40151af0121aca928a0e769a3d561836e5bd52d
SHA256e0bdc85f60cb0084fa950d5d1c9f4a65d115ba22ea3094d0db9324d4c5549e59
SHA512b62af26c153b59b5fc639bf24d29c0e150ad440170bed4f8723100b69c45ee527ab4da7c9b6b3a044083cdec1be5d91383fe9d685deafe798f3679b2ba5d4680
-
Filesize
841KB
MD51a3bcc2271584b6641e61b92e2a5894b
SHA123a72c68d8022a459dba587bcd1ac1808e8fb76e
SHA256efba5604885247bb93c2a429fbe088ec76141fbc5fafea814faa89267519dea4
SHA512f68645253198394793ab62aae2f7c9517663a0641d406046bcf543a417883a6371ac87cce866a1c2df97ea039978bbcd7e4be7868868a4b3d52c08ca5d5b3217
-
Filesize
581KB
MD5d9cff36b296e0fdcf900e2b37a25233c
SHA11bb72ccac3319bb8604e91b66506e98a80129e1f
SHA256d33320c3f13192f97b62f698b1fe361ea3076c88eeeb8977917a7e1ab6a6b2fa
SHA512212a64ab51d4095c4fa102bbe4f64425f041825e7b45bee18fc399ba2fcd31a114de63094ddf335b21d2499ee39c941ed9495bdd78c891db7afee6c1bcec970e
-
Filesize
581KB
MD55c565bd52da8eaff27c4b8fc283311aa
SHA13da53a0226ed630bcddf294d9311887eefb5f79d
SHA256cd58b408b1ea49169e77f8646a5adf99f55a0d038ad6dcfbcd92aa46e66b92a3
SHA512e7bca424bf0b1de43d589bd4f34d8010fb743d8ccc2c617e3c6534ef933f8afde33a794e7dd8908f798ca422c83f86e79ef613fb0cc6b1140693e6b7747758ca
-
Filesize
581KB
MD54dc6d4a5491a6c7f97c640f9006b8e53
SHA1bba421c68c02bdac25858e02146671907a2edb26
SHA256495d8c857e47575813b1aaed28fb3b7d86b4920cd0b530bfc2f5d1b78b479054
SHA512d2f86d227cc06dffaf9471395e807a02e732225d89d1f79507e9ef78f9eef4a06f421bc5ed4b518756b6838d4f680a577106b78104a6052f4bb39afc63abf03f
-
Filesize
581KB
MD59e8c1124f4aa4028f50e3444ae2f97b3
SHA112c5ebb9ee59139e3cb5d754ecd818fce0afa081
SHA25617ed85f9dd2472c7df8cc34775fc65c0df27f8b8b495b56fc960a9a6543ec410
SHA5124c05d0af2192a44bd25406f16800d8f20f38083a9cafd488892b7fa81fd19ac2577b60e0058893670932c35bda3aeacf186637ec5ac3e7186a20056dd1d0f3b2
-
Filesize
717KB
MD58c22bee51c2e77bb4e96473a396435ab
SHA1cf84232480cb7acdc2660e2d9701687151d01426
SHA256a6381710a8d172756bd29eb8841244dbc98d07f7a6b67989514a3116562a9267
SHA5120349aa274d247aac5b36e3c6d5dd2bf052db2718f2c7463378ab7930d53000035d9ebfa012fe0ccf9dd3023d3fdc1dba3063902e6b755575198d678324d3bbca
-
Filesize
841KB
MD5e592ef6b0a69876487cdfdb50bbd59cf
SHA1875b855c519ad07bf27c083e408b233138d9f31f
SHA256e3a544fc5aad88f297896ee675c878b688fdc0f98e6e64f32421f3cd14c1ac76
SHA5123053dd3b92c1fefdf844a01308c690d7c28bc886b10448fcda046a9881e7b9da89546eb942e21df2e76c7d4f5f48f0d9b2c3334d712a0b7e620614f8a2713945
-
Filesize
1020KB
MD506d20fce7188e8cbe633b7b87afb5f4c
SHA1b16da770e23be08d20dd67f7deec151fec6495d1
SHA25696332e102ae82a55a58984d63595aafc33cb0433cdfe5582c71918c769783c56
SHA5125d212c2eb8bcdb87f81546a1f6d647c3b071e4228e2c7e34891fc06a8464f2cd8e25b895dbc8622a7f6eca24096dd36c6ce8064c285d682408208a0b592853ce
-
Filesize
581KB
MD56b836469ac1e7b4b77cf064f5af79777
SHA1d57c2e5a0592b827b7931506f18dde215d55217f
SHA256b815725f7793e77fb28af663a3eff6825fca5c2e0dbcfd307e224ceb5135ebdc
SHA512e9e0ff346adae3753d8acdc1c6d4482e76ca060785eece241bb2217005c02f3a865bdd1c1436b127a20e19ce096f8e720b34f4800784c2c21048aa8f3065f655
-
Filesize
581KB
MD581ad3556f0fc810d986689898648373a
SHA130ceddc90f2ca2c7145c35408652b27d80b3b0a6
SHA2565983c43206c136a24823c342c9f22304774e2935feff28fe38adc2bebd281f1a
SHA51223adae3fc652e2a85558a792126b8a3836692617b0bdc34ba73113220fe1a69db6f09c2498c56fb9fd1e4ed0e63426aee082bc860d9794cf38518fb1b34a719b
-
Filesize
581KB
MD51779b4f9b8060afc3029c6248adbcc83
SHA13964de1d12a7212daeb9194d35ef5756295a77ea
SHA256275ffd8631134067942358e900ec036b9cd669b88288dbd6b714d42e258e48cf
SHA512565f43114eb1050f40292a19765dfaef8d8a4cb96263d1f4ecaaf28b3fec99f1ee7c00a719a32db8c4d41cd024ebe29b7818d49d68fdd6b7239356f1b15c6aed
-
Filesize
581KB
MD5919802f6379934b6b3b70ffd04bfa739
SHA1cab1d51dce67fbff09517bcf4766e56405c736fc
SHA25600d326ccf3a244e329899e4864ac18783395b4de60225580823baceaef6fba7a
SHA5127d7947401df3087186235eff8db00a5a3b9b4601e0f41ee024672624380ef24c6322c5980f3d8b22514d6171b4f64d70cc28d35293b13c0412ca214f96eba5f1
-
Filesize
581KB
MD57ad4155b2ecda858da3368548c8be29b
SHA10d0eb97c942884ac59100ed7d252c685b7aa860d
SHA256f0ab711acc520cfe821539112df2322d3625942b5f6a275a336c555d2c2c4341
SHA512d331d1f2c991449f8aaa386609e575333656011fe099a1bbb37b8122530e4ee91ee3f6600fe8561cc88fe6540086b2109ba05b6c3ad9928f729d18d6e8328bd5
-
Filesize
581KB
MD53461d1c0514d367b1c5709edf03124cb
SHA176986a5260d3a0c43d64675565c630aae5404d4b
SHA256020cf519dd3ebf1c10c7c629985fc00350dd261a66dd763a3d3d4dba4188a3e2
SHA51295388a34cf1f50a5c8fe4fe926a82a8043ba2fe1b16e59187f6e565a53de47c7d53e52666671f3e3148a2501148402e1c4cf162a44fb829b65fc6e7473cef886
-
Filesize
581KB
MD552f4eda1c3457250cbfb80e638a021e8
SHA158ff862aa0214f2c4bbb7cfb684227e2c9428117
SHA256ceb1ddac0cee7177458c19433a4a1475d13beee0f1e7c644cb01027a705ec218
SHA51280ad8500837fa7d0f02e6fd093ff56d3006b24017d72e409d4a684888861afb81dcdff8eb4b66f0df8e92578e2a2f9efa6be9ddff6a405323acaa3d27e98637a
-
Filesize
581KB
MD5bfb20af2dc5d6d54c2ed7df7a1557f93
SHA157ecfb5c854824f975316b643ce16c210b784c22
SHA25690907ad59019d5d476f708652f85780f5241c9edb223fa2236270e8cd2794f64
SHA512261b7315d057159ee32bfa021acbfa4a7924fe227d61ca4f56db000dda846aa7c1e03865b6ebb371758d6d338c6f4fbd8c705a3a4c32f2c0406db620777a68ac
-
Filesize
581KB
MD567c766dc26d96140f4f204dbbd042b7f
SHA1d7a268c05d0bdaf767391278a0b7407665c39436
SHA2561fe9cfdfa31342454700c9752968c4020611adb113d69f5138eb3aba4c32a49e
SHA512ade0a567c4e58ac00e62b6e7af84ddce120533699f54aa8e7afcb2e3de2908a98143e287642ad6ab07d9eeec84b242e8353e3980fe87bc7eacdad057d1dd121b
-
Filesize
581KB
MD57f5bbe4db365ca195dc3a6d3932c0e71
SHA1354a790dadd5f43c8ec3b85cb3dc3a3ca112c9e2
SHA256486ffb3dff2889a2ec2f55b911fc8366ff06b409411cbc1249a782e18c231691
SHA5124c4d86e9400d0ec6d8dd6c865d4d2d5d9f65b6bd7fa1603eb37d9e2f840afd2d49e56149d540ca91f495113c74a402a4d1de33274c057943e4a51a06ef7086fb
-
Filesize
581KB
MD53c706279616361cb421718b4103e8f4c
SHA1e00f8b6107d0382a7719d5d8ee27e606b4ca62b0
SHA256c854f009759bf91bd6583fdf8113245e017c2aa03e1c96a154726c46a9980aea
SHA512550632e2a636ec5eaa2bb9f7b864a8a3c38da67c8e7d16293689e4fc68ccb7d5c0ad45150766d5af1d30eeda55f53954bd910bc148bcdfdd64a1fa9a68dad517
-
Filesize
581KB
MD5d733865246ed98fd750f488e3fee8ce3
SHA135b1f51107a0d5bc5889cc452ac16b99d77f86db
SHA25628ca36246dd8b06504202f96ca7bee663fe67f71c4b0454bae803bdbfac4a78d
SHA5124aec4edacf55e6deb7cab63b40e9113cb5b8ec34de978c7ee7c6efa979c4d743c66174aaccc97770d3ab8ff836f21b869c2aa66b5e6606fc67520cbc7a2b237a
-
Filesize
581KB
MD5396df2608ac9f9b5df68ff915e0719bf
SHA1c9c79fcc4af2de877f40e69a9bd48ae442cfdd2c
SHA256ad3a6e117938d80621ba51e2367ce4c76ba5e1d96e92c1be075b1cceb6196e1e
SHA5128bd295bfec8d1a81e02fdf8faea7f0a0d0a49a833f2d0b23c8967af21e0a596eb41d3938af9d0da987c479eea6bfd516a5280b9d41fdbf7f4892d91a849ecc25
-
Filesize
581KB
MD505268237e53e4ead7efcd2493632c441
SHA18658dfb10678fdd1944a0fd323caa8fe1b5471cb
SHA256eab076633522227a331fadde4b25de0ea4629b2c02d809b51f31667a8f453dce
SHA5122199f5a0e97530d40da73aa990185ad709a07aaf8dafbe56ed78e33673f61243fcd562b7d4dd4170fa77d361bc8990a4dfcfc2b2d1386b621fba0ef257c85cfe
-
Filesize
581KB
MD5d2df3db05a0f4f298fa51a87f0879247
SHA1f4be14d8ea80fc32b0e89a6ad22aae31003044b6
SHA256d608489b03e3cc46d1df65f413fb48b9d6dfaf74ab5ae473e46a0b6ba1835a96
SHA512cc42f62ecbc64aa47dc8744a10025befd574b1184d3a598ce137b195fc8f834c65be378b368376fe818745a3338be2533e53d285c8ae74d26d96c4b4e101438e
-
Filesize
581KB
MD5a87d5f9978effe79b9dd7672229178b8
SHA191a0e0d662b58bca4cb3ab52045494965e8999a8
SHA256b0f2b7f8a84c558d4110910c2b3da2490f651e9dfe9c750ac4da0adbea0843b1
SHA512eadb63c7efe167998370e0dcbe89875d4ae88766391d13cb1c9f461dd366b82df47b7540c64cab9b5f85365a7e990cbb987551871e9bde361ffcb1621070cbb1
-
Filesize
581KB
MD530c4bbeb6034463083d40215d45860a0
SHA145af135119aa233db45f49b60bb6f7597f8be706
SHA2560479c0793344d3c1149e19748e1084c60c330bca8a465820f70f27ea55368905
SHA5120ec246a4d5e8e023c8b552735768e6d28116e591b31b62609286020c9a57fb26a56875e738baa57238b94071890a50159822e640a0fb2d403af2d942f0793200
-
Filesize
581KB
MD5bc9baeb4ea73d7eba16f9371e78f0386
SHA1d03005776e96d04ce78c81790ccb10c78832d9b9
SHA256425c97cc4a4640ac9a65f8113d7ec98e203d0bd485a7d8584e245cf8a44394f4
SHA512ad58330c5a05bb8e7788fb98529e3e2698011c256cf87007a7218c9bf0fdb93dcbe326852f29726efcaba0f22b195800985c51d306a17f392a07de4c26e7f32f
-
Filesize
581KB
MD5d32e4790b8f723abebb8d9c9b5ba8b51
SHA1a3527d9b0062279ac2012f8a7adc53e5bcf1bdc6
SHA2567a3a289b3e90eb73ad86af19ab245fb989a731d952eb980c5304d74b57095036
SHA51264ccd0d35c09153b419a6f23531f2aa7507f32a30dfc8a0e5c6741ca9cfb9d603f422bb48ea08090e8ac209087a60a4c2e5901038ef6a85642c6d06dc5234750
-
Filesize
581KB
MD52c7b943083273081772e4dc524ad0e95
SHA148a14ea1fbc6b3690200909260dd861d73dd6fa7
SHA256fa588df50228c1e75aa8cb063bb70253198eafbf0e33da2c9ad46c708f49e3bb
SHA512dea38625625dd840647d6731b741c9eebb19b6931dd6189e792023db7dbcd331078c29e231b69a7e64afe70c5b9e26b5e385eb7ea080277870f462f45c307bd7
-
Filesize
581KB
MD5e3fe86763751e529f8021e97aa06f48f
SHA1bed861d29ddb2fb669082dacfb259bbc54ed35af
SHA256812ca2bebbcb9958caddfa851822216e2f0957306a58c5b3428e3a7daff9bc7e
SHA5120191739f999ef772ac722ee17ea1db1dab8f2e8a33836ba7ce8d547f77d080063d0f3908d21a425864011306f09c57ab001830b9262a72da92fa735b4912b099
-
Filesize
581KB
MD56a9f02344576f0ec6db01e5d0bb9a871
SHA1f9b58012685082aaa97006d022bd532c56e3539d
SHA256bc077f3570f706a8e0d79df0ff51a7b8cac95d15fedfa59823f002764dd371d6
SHA512919a58a22e6634cd05e6d7a1f6a698e8644d096ae8bf09e5561d5df7a6d024a8bd800b336181f6e61da3249066f65e632c355b84923a7ea4f2396a220194abce
-
Filesize
701KB
MD54ef7579e66aa1330ee76decf87d43b44
SHA12883a07ce29ea2cabcce00629097937f6dea585c
SHA256cfd02f4810a9a8ba21ee25c54d9546dea717fc4818e1b4941f5b12c3c405dbec
SHA512fe51a2388e55cb602058128acc96507973c3f0f61787d30526ead6522bbaa3b0a52ae85d3a043bd2104018691dbc4bbc7d36e80baed6f3e3918d5c7630a68967
-
Filesize
659KB
MD5cabd54f7f5c5a259d5c4d03fe6ae7481
SHA125e2850eccf3f18eb4fc9573e5b57b15577cdbd8
SHA25673ecfbe36176a94047686da7c8e8ca3b57c7ecfc355c99db46b3f6c5107d3e90
SHA512a380082404a1751845c42cbce161133287708a8faf939a90ffea65b198358a80e941d94a93b9cb9dd5c742596942a49922794062991866caddafeaca0291e0d1
-
Filesize
1.2MB
MD5c83d43a0268143f54b4c708e52f3fbd7
SHA197a0853002bee2045a3b91a961d65b936ab4c4e0
SHA2564d747f994c5180dcaa04da72c9a557a74521fab0f69eba9f3f7fa095125dfe88
SHA5126336d3eb66ee42c474185f623bf376b3f4af8470c8e17c1ec7f816cd1099f5f432e89ad248648a0bd6e2d2347da340fdf58534843e05d4ce0a023908f333cb98
-
Filesize
661KB
MD5736466e0ca8d77aa6f251113f765d20c
SHA1760450d3156670c6b3743fbad30e09213c760773
SHA256e69412de08ca03d3a6ee101fad7110f3faed0b0e6a51f234e82ff30b9408971a
SHA5120d45dbca547201d8ae4cb1e31a6be64bb8181c33a9098e97ddded60a3f1519d39a1e92697c3c72167fa340b8168bfa2b189c747333a2b41c5f9e520e1d208159
-
Filesize
1.3MB
MD58ec512ee62e54944dcbc0c9fc152cd73
SHA1b45d0c174ce6ae81b12bf8227e4c4233ba49e484
SHA2569887b7904a19cdbd2d0aa917ade5932aec9fe0f729909378d716e2377b717cdd
SHA5123b1a26e4c5f5e97b663e459d2ac8f27e614305a25cb346554469a1d5715cf43a1bf42342de4edc7bf7cb960f9fce13cf3a5a50f62df64e45a3741f01fd1879c9