Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
05/06/2024, 17:51
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-05_29439ca1339d14aa3951a023cc4b332e_ryuk.exe
Resource
win7-20240508-en
General
-
Target
2024-06-05_29439ca1339d14aa3951a023cc4b332e_ryuk.exe
-
Size
2.2MB
-
MD5
29439ca1339d14aa3951a023cc4b332e
-
SHA1
b689e8acf9448c78c795873339a103aaa22aa07f
-
SHA256
fc011a67befec0f2c51dea65f1a6efd7fbad87c59df01c5c45e9744bbe94d34a
-
SHA512
c335dc7491ace0ed61be5c138dd61074f7d933cccc527710066aee62901b9a459df7f42528581d10cdd275d47210416227832bf6b534d8a49241077ccded53e4
-
SSDEEP
49152:COOh3aN4kuLbegmtGef9Ckt7c20+9qNxUW:kU4ku/cthfEkKK90
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 2852 alg.exe 2132 DiagnosticsHub.StandardCollector.Service.exe 5020 fxssvc.exe 4824 elevation_service.exe 2136 elevation_service.exe 3084 maintenanceservice.exe 656 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 11 IoCs
description ioc Process File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-06-05_29439ca1339d14aa3951a023cc4b332e_ryuk.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\bf8630c4293b476c.bin alg.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-06-05_29439ca1339d14aa3951a023cc4b332e_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-06-05_29439ca1339d14aa3951a023cc4b332e_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-06-05_29439ca1339d14aa3951a023cc4b332e_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-06-05_29439ca1339d14aa3951a023cc4b332e_ryuk.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe alg.exe File opened for modification C:\Program Files\7-Zip\7zG.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe alg.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2132 DiagnosticsHub.StandardCollector.Service.exe 2132 DiagnosticsHub.StandardCollector.Service.exe 2132 DiagnosticsHub.StandardCollector.Service.exe 2132 DiagnosticsHub.StandardCollector.Service.exe 2132 DiagnosticsHub.StandardCollector.Service.exe 2132 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 676 Process not Found 676 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4252 2024-06-05_29439ca1339d14aa3951a023cc4b332e_ryuk.exe Token: SeAuditPrivilege 5020 fxssvc.exe Token: SeDebugPrivilege 2852 alg.exe Token: SeDebugPrivilege 2852 alg.exe Token: SeDebugPrivilege 2852 alg.exe Token: SeDebugPrivilege 2132 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-05_29439ca1339d14aa3951a023cc4b332e_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-05_29439ca1339d14aa3951a023cc4b332e_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4252
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2852
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2132
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:2408
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5020
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4824
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2136
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:3084
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:656
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD509531bf90c51009b6c8fcb37c5387e4c
SHA10d7667b906a6114e2c594ec8275f900dd2ad6013
SHA256101584a21bc71b66baf01c2997f414eb15c486b5ca48115f684c79879423c0be
SHA512a5a5577de6427303f0a70ebc47cbf9bdbef0cca5ceedd0ce0c6203c3f955874d35e42a7742a771a499359d55436451e280ffee0ae040ce7595a4b8e4f6c34ab1
-
Filesize
1.4MB
MD551802e3ed99c390666d02810a174087c
SHA180f9d2642f3ead263fffbe294cf57385bd0ae53c
SHA2566b9a2e847ce0c2bec2b52161dd6dcabe0cfc6bbd84ff1891e9711df167af0a4f
SHA512323ba587ba580574520649f4ecc4bfa929c15f13c48324888bafa1309f2a5885ce02c0837ededebb1c6d76c4b77998fe6ace91ee36bd9a9f5ed2a6008d7b6586
-
Filesize
1.7MB
MD51d3702f24b0ba55fe13795696ef7fcd8
SHA1d20d61d60ac9240b6dae726c08a8f46f64ee18bd
SHA256a97499be828176f9250c315b8e92952166b8179c55361ecc5e25501e3d90d67b
SHA5122c259d5d104e5a4627e4d0707c6a18e6eaa57e648a36a8fd5ffb24261177e7d98e59e7998d306eb057699628d172a8e0a92e1b4e4188b11867da13ac4bbd8261
-
Filesize
1.5MB
MD5cd237628a1475e30ab13da9559580ec6
SHA17bbf0280521b6760260a154e7a7dfaa29a8020be
SHA25693db49d4a6aef157dc93989fb3b3d9b132aaf23368ad11a6ecc271b6200f45ca
SHA5126e326ef65844d18fa3ff4ca3e3b6886771b18cb39ebf0338262117b84f134cd4f606399e72e8d7d4870de19d7255f3fc16ece86f0c45cc4ad4d7690fc7881db9
-
Filesize
1.2MB
MD5ecb0ec37455a75993aea545ba8d94286
SHA1acaee162ff14693f96912c34a3f736ffe437615f
SHA2566f79fa4b9ab53f2e4a9a7c0f49f64175a08ced2414a53f676e9fa762c0423393
SHA512a48443495758ccfa3f20870361d43ab4310824543e2696936fa5f84a05a5b87443dc3600d13c965c333c3484ed40030ea2b06410949a93a87ea59ade24dcc23f
-
Filesize
1.2MB
MD58ca69228fa48ce7c1eb22c473eb37c03
SHA13faa9a6c1f2f392c48909d562c8f8fdf1c307dae
SHA2560f8c8660d130c31e77204646bf6c171d2e0e38321169d12eea545d55163bdd04
SHA51236f020107e76ea1265ce524fe0ec56b5bb436f44c8aaa075a77e8c6813cb8f64cde2a21d0343e0ae2583dd3bb7d0a58a56e3b0a5630e63cc24df8d409ea6b92d
-
Filesize
1.4MB
MD5e6e1fd94cc9c63533b431108cbca8b4e
SHA1364cdaeadc3ff0e55465f02d27a1292a463054aa
SHA2568082e213c4b34d40d2de81296e38b6f949081c89445e7f64ec51acdd93b5e31e
SHA512443d033419bc45315c52438cd99e4e9ecdbca2adad32ebff0f23acb90619993898b59dae2ee8e192fdb8823cda6ad78bf02c27d19db38ad384d140950b98b979
-
Filesize
4.6MB
MD57d4e1e89296cdc232de27e5b1e3c0800
SHA148c92710e9d016d035205a571ea70fe95fd11482
SHA256367ad361259a82193a1180e79f43116ba9e0bc1085cd425c46e11d77612062dd
SHA51201f208a657e0fb14b09490449a080559bb6b35cd002465b10ae0108f95cec7df392331e1b7bdf0779496636280a595113d119e11df2a00bf0e5e464655ca6066
-
Filesize
1.5MB
MD5a4af66ba6aa3224e4ad04b056a9fb01b
SHA1bf92bd5a6bc75b08de9acff847a485b9a72f8d59
SHA256cac8edc70ad1a609e5ef1c49dc5ea14d0fea0e89303fe1b7c3cd0f3a984e1655
SHA512088513c6760f0c92970802f15f552b43a0e6289149c640cf5d1f8b49ea2551260e4c2a65bffdba0d04cd1ed64a1eb2d1447becf59c228678e8188a4cd9287faf
-
Filesize
24.0MB
MD51b8f20d5f9cdc21e88a5b827ffc6a635
SHA17552165c7f103b312a6bde3d6aba289969a03c46
SHA2560ecd6f812a38f358b0893b0018e70513e0d0dd45050e47b71e975b3d4ba7900e
SHA51206b07f4838b9be6f3610ebc27293cf21d3c73ccdc5d295ebde1e8c96530536d904db1328965e706bec75e613fa94e0a1632fec6e9602ad095508376eeabf40d3
-
Filesize
2.7MB
MD5121a9da571a5e50ad6617014242d01eb
SHA1bb694196bb478b3218d7f9b4d3f2283b66e1bcc1
SHA25616879a0bbaa817f1114a0a64076476c096e189068b7208c3d1e7e563d6556e44
SHA51206450dcdbe7d71b9e55a748628d2cc95838facbe200a46cfbe50bc2de8bd94f716e85efaeff4f033a852650b4cd78cba6ef043794a59f7a46497b5782270f12c
-
Filesize
1.1MB
MD5112dee7edfb87fa7af544f13bf0b47a7
SHA1537b1f0553782380fb7eff9eff4b6fd9d898d613
SHA2565caae33009dce2a1742a3032980a6fb643e588be584050d6710eb30072072c86
SHA5121d35696c0fec9a6d51b0b126f64854d35900e4a2349d85dcbe186600912d9898358b5b888d3389fad91a54820d037963f68416ffcc107b52637b9f0a613fdb45
-
Filesize
1.4MB
MD5ce643c3604fd5028d1c4bb7db7a2b394
SHA16581fdd0c74a42882a73f81d188af207e5b5c96d
SHA2567a580b36deceae599b13cb2d632a965242e328f928a0b1af79f25d4b25d17252
SHA5123d254555fbafb49bf6eb8a0b47189e0018ba910a810f7217a1716a6540b5cc62232b15fc94441adb947f2e9b492c4b12bc5c5aa31e22fa5a1dde90fa80273d7a
-
Filesize
1.3MB
MD5b97bb20521a8dd9ed0528b5235938184
SHA11edd943713dadcdc9b5266140b1ec1f6f0cad6f4
SHA256c78f949ee8ed1653073d9e48249dc932c2353a95e4d67bb9b6f8e83cbf403f74
SHA5126a9c00ccc6534d70b93c5afa1d07f5daa16323c0ea336840408c2df901c20e78d330a014be3e8727d609d59aacf1a2f638636404601e775da8cb5aff0e7a0439
-
Filesize
5.4MB
MD5e39dbc2ec104ad9ec386d9ef2c9b40fc
SHA17e3fef65a016813756cc1588505223e349e7dafe
SHA2564794d7ce8132eba78133a2d9de1a314fef4b96610b3729f0a868f95266cf69dd
SHA512635d4630e2a796eeb62ceb91832731bcd0070b91fb93aa0227712833f3b1bf6657c06c4f144e0724aa35ae35ba643bd4f2075f96d538cb903254a63598466291
-
Filesize
5.4MB
MD5d80f417f5bae408a9490275d55934cc8
SHA1387fd2f1b232add517ce3ec6aba51a3a5f8b8e08
SHA256d7303cedcb45cdc0e3919186f13b2081dbfe7057eddc46c60f823e521f2b7929
SHA512724a867a9a899f44d47878ca34e0700a151f2f5ffaa06fb3bf98f1bbb6d0194eb6722c632c62279f661f3479a96f1c5487451675761786c4b9826d35f60560ef
-
Filesize
2.0MB
MD52ae08c24a81854ca6a99a7a1787e7683
SHA13eddbc786025ff9755e2a9725b97158339a9d775
SHA25668df19e31af0aae8e044565d0e8c3739f2bc81590aabb43eb730f28745367df7
SHA512381635de48e2c0cfd204f82c60c2fdaeef2784f2b92b4755fb9e9dd828206b0cee0163380ef6eace12f10413daf92b063f5078192f76a991ead0a7b73d48349b
-
Filesize
2.2MB
MD56b9cec83b59b0978db5ad6660e21040d
SHA1fbcdc29c44cc2d9c3517ae085e4c1937a87db646
SHA2561b5d6806dd62d993a6e6d4b50e05c94c2154073c5e69b667b60ab18fbe3a66b0
SHA512569566da51027843310d27bc2843335144c427a3adc36ced3c8ae83c43c7c3443799f0cbce00da9571d3bfce76e69ec07cd73e55478f3d903cb417e805d9dc5e
-
Filesize
1.8MB
MD56107ec17aafc48abd2e452a98afa8ae5
SHA189c3d3c5e7aa0f17de3be994fe62c1b7752a3773
SHA2567b8083c27c966f8d8248afad7cbaed671e959276880d4c7e30912395719150f9
SHA5127c094da307ad4f5472bbf5834f50e9198021caace7095bbe1f1fc71572767f1a6976373a7b7ef54377310777cd13efd846a2fbe7ed412ec7b4fba8f3434495d0
-
Filesize
1.7MB
MD57f5c4668ec348e783500fa5f864f29c4
SHA1207eeb29655fcf706441d7349a34df7c110735f8
SHA25689c65fb6c2a542f386097eb8e7f55a5b1a89650bcb49314016856125e10ede27
SHA512c89492af65977147e5850ae5404278aebe4044a6544e65be3d98959f2940c09d21b696c13ddd931a5dbfcc6d2a32b6d7a1ec997b60a1854e76540316b3223be0
-
Filesize
1.2MB
MD594a43e4e2e643c2308bb0cb212105e65
SHA18093505ecee176c8c5f961d9d61e15cbe418b03f
SHA256d74a30a14b8133e4dcc0920b0df9659aa3a5b1b32bab6c2a4f69ff59b0a9d5fc
SHA5123869ed069b4d24618f732892ac63bed1eda890c77f62769a11752de97d73bfbcd67481f2f48b4d2dbb48407bf909e1fb9c698bb2c87b3d2ca66a986551c1e0fc
-
Filesize
1.2MB
MD5f213087ec8f4f9c1283c5c67637d74c6
SHA1700219da3a50ffa029bbef8e4637b58ed9b5dd11
SHA2562b6687669ab3eb689eb913c2ae65a51d29a208da8eea5f1f93fcc37bae7a73f5
SHA51235e2b4467091990e90e4ee1015cb1f3c5d719789d200e4fca1df3fde2fd81b747e6102da5bb5cdd28e6e8a1a3f6064bea272b1b9564889a2dc824024c933b749
-
Filesize
1.2MB
MD51da68f14c66c52079fd53bf6312070a5
SHA1f5b03964c2a2f6f5be5d489317ffea58f3005387
SHA256e85bac46f6d141e7fb0fe92be01a6ad30403aaf3978b1bd18bdcaae1d4e79847
SHA51296017824cac05ae23c433a23515f5932b6f48bc75f5f427a1d2de1c4f27c9a276419042bbacd1f32b30357d3d26caa55d2da732656657699817e1b15a23cf5d8
-
Filesize
1.2MB
MD52b181a8b5cd28198645ad238529d2649
SHA18ec6eec083841750e4da82af61b95f639cb8e496
SHA256f916dac688a215c96ee4ee747949a48badad36f65812a3f63203b5a4c3666389
SHA51266cb23500f838e538ce6027d610fbb5055b958328e09235cadb95117f12d7f55904f55584019bf430c8cc77bda9025a54863e50af0d48fc24f0a642616a25f37
-
Filesize
1.2MB
MD578e0b8c2f5a746bb1b59850e94878ebd
SHA1af494ec9e98723b4f059a3e4d4c4bbf6e1919a37
SHA256fb4bab31159d3a6f2f3b2b6c4112c020718177581eac0d2022c30272aa34ff7d
SHA51211fd7603187d25d24a9fdcbf63b275459702c5cf8b53d9c39ff97192961323c78d8ac9675e890cf9986c912a2fa5925c34adcb8a6d4622d6481d96f62c51ab38
-
Filesize
1.2MB
MD5dcf03cd0d573604dde471c65dc253bd2
SHA15874dad2a711e7c71ce367ddd3438822a3347d18
SHA2567bfaa3542312e24613cca981c1a593fda4b913b1c4a4601c77b37d8216152398
SHA512f2c1ae6d8dc148113694ccdfa510d1ccf13bff1bd51b813e30136e301483949f1003286cefd6989a3de8c2f4423b70a8a7439bddad82db76a19f635bd3730e8e
-
Filesize
1.2MB
MD5d20d5cd718a63c5c7308bc86c2cadb48
SHA13968181d7e3a7cc5691c42c98f49991a0217f457
SHA256e64dd7bdcbed5a06c77afd47652ac23682386288cf2c29c50c3d0cc5c04aed87
SHA512804796f7d15208b3217784a1c4d866d7bdd4ae509a3b600f2dd9f70d412f914d80ea6fe4b101d7bd1f5fb8b4fe1bba69b9966970a7fc8574225ba01ec892007e
-
Filesize
1.4MB
MD5260a869cbac779c0612d42513d2b20ab
SHA1604f0800a3e4dca09e851e6b9a41167f0b691783
SHA256e106e4f20eab96f12bd678f4b62e5901c610e48fdd5708634b08cd7f4e9df0ef
SHA512882068d6791aebbcbbbc5f5b7b6c176f21a9fa14e9076d1da4c96fde51a872a69aefc206e17334c3c7d5638d91f6d07f214761ca3b38f1f5d2355eb2ffaf9643
-
Filesize
1.2MB
MD5e161a61cdd2458d3e20ea4ffdb7f297a
SHA1b7925a4ad379897e3e17b1fd9bddca70397cde3e
SHA256baf7e85ff5536c96daa13fde7eac405b5aec22721948d1da744ec325297213e9
SHA512dfbcb4867e9e48d60e1e559e9d1b6afefe6275733afe565437f37f90d4b8f53da11ec26e0ad0501eb3a4309ca62a887a22bf26fc1ac47d8b9218540e128ab0ba
-
Filesize
1.2MB
MD5851df92d93009438ed86eebcc58f94b4
SHA1836471ea27cdd4beef8cb40578663ce6c9f72797
SHA2563147f4afa7db66b32d3eb011604fd71aa555c98b925067cfc590072169572927
SHA512aaebc9078ee5053079e8eac943116fae2486e6f134588bc6cada6af48e6d7dae2bf89ac6eee0e8506ed8d7b26ad1829565c6a0908a634852092a2a8dd621976b
-
Filesize
1.3MB
MD57730a32c7cf1b288dcc6491e4b9435e0
SHA1246722d3b0a3cd749db992a7aafb979be8b160bc
SHA256061bf74febc93fdc78b7ec7b82f1382466037d823a4625a875fce9ea6875ccd0
SHA512546786c35ed8c8982357ed00bb0cae9d89895e4320146baaa4d76403c23aef018364c9f875ab8e5d3286ac3d23eba30cf81753566e981a9264ed17300c3372ba
-
Filesize
1.2MB
MD50bc85fe06bc8c220ed05f1d338f2f4c2
SHA1f6242d3ca6321a400623306d9c50c6524460f49c
SHA256a878fede65deb14cb8fd26212bfffd23ca07deb58afca267fdcc271aa581e166
SHA5121af64f79a47dcd75ca72109fb0f71bb473211503c6c7c5d597c1b0e12382b7b2ff014d8c3c34217494f538352068752aa02f465b2ec2bf401cff8bb433258254
-
Filesize
1.2MB
MD5e79d6483103f85fe504e411eb9d4928b
SHA1ad6260348630bb63b714811e2d85246c91a72dda
SHA25673ce17aa4583c98385b069be4eb6cb11f36c04d38b1069f4c7e67ccfec3fb374
SHA512b5874467e9dc5f160073ce1b26df055e466bc17095ec0ca4aba7c42338daad35f46baa97bf9195040012d524db79f70518a4ca58fc4737ecf7640bbde09fde3b
-
Filesize
1.3MB
MD5e70026a9f34c42468d777cc4d8d19de4
SHA1e7c22eb38fa40d43ab10e5befd91662ae99f09cf
SHA25660b6c797a5d1ee81d0d355f5aa6744327cb8a22d2836de331cd0175b72b42f96
SHA5127b04e31caddb5895c26f4b900b817332ea1f105368ec2ea2669c1504b0b0f5d796d81e91c56be13099a3a4c2038e01906f8c212751a5491ad1fdcea2ad9e5b6f
-
Filesize
1.4MB
MD5ebf4914184b61f4a28f22fd8f3feb9e1
SHA1045413a6be98554e4fc7c29fa8e8d2972062a842
SHA256664cc9e3798ae07b47f6e057d4418acf359fdbc566a685a5ca7f06d0c34bee8b
SHA5125010202d9a5fd9c3966354a2420757f46563dff79358e5eb71759478f0383efab027ca39fa43bfbf919dce3d7ce868cbe77b704db3e8aecbd88e41ace7baa925
-
Filesize
1.6MB
MD50f428ce37e5cf1d6b838a592b4e4dab7
SHA177aeca254ce7919173be811577df3b07b2f460dd
SHA256f77fbd515f3dd6c7923b6228442f529ab8784ecd335241021e8eb05b0d54c14a
SHA51210af5bdb15f9cb9cb2b3c9152beaf7b916ae507c1749aa285da1fea31f06e3113d05037c9d0a9bb949d84289a81a46e34c0145e07eb2f9eaa7df5fc003ccaa2f
-
Filesize
1.2MB
MD5454503bfc68d1ccb1f2c95d410b33698
SHA181d62384ea6d07d708a77d62ba79e97cd69de6af
SHA256b1f7f526917747b88f91389535787f78f5f58c429a69fe0d056f975be2efde08
SHA512044aac33cf000dd79a4917546dbb65c1cc44a435a2887609ccca6d0d442ca5a206c62193318d896863cfcee65accf29c08f32de44dc000a6e72dbcf67832a7cb
-
Filesize
1.2MB
MD56f1eafb874f2291de5f8dee2c8221630
SHA14bea051d22dde9b5c043d5f2e83003c11a5340b3
SHA2562f03e2de4a4d3eced5f14d04dcfe13d2a9a538c723b792f831ab9aacc1eba038
SHA5128ab85943d4873936c3c47880e29684a1f1947eb69ae5fcb0bdb3d964d4d569a19f071f6362f8c7fc822e79ef98a74e07294eab7a100c77cde5835a21f1de60b4
-
Filesize
1.2MB
MD58444d5b60daf61f5745e6c74fdce077a
SHA10bba0a69d0cc252ed3bde2ea5473113cbdc9a0fd
SHA256a8fbb874647e0b288a773b54a3a70dcd8e2639d94cf36b0f83b5e113ea15a756
SHA51206a3ba725a0dc5bea90d76651d730a28af39ad907434dd07c3a4f4e1bf859b7eb878cec8f420bb5b2632ea6049bf59dad36dcd02fafba51639c11b91b82ba0d7
-
Filesize
1.2MB
MD580da2e93724f015d16df62812d0132e5
SHA1c12d64873faee17b591d4c756b97700e563ac9af
SHA256dead76fbc551ea6be0b1ec831ba0217709dcf151fdbf493a882ac0b038b460f1
SHA512124dbcabd505063e2ec794ef6260b46490219bbb5985be18bd0d63da3ffe64821d949edc54af415a47dad935dec343e0db4f788dbb98dba019b03083e578612d
-
Filesize
1.2MB
MD5550d61952c41df11cfe223dcf65a56c6
SHA1cb70a11505660ae469af9af07caf925e4d3644ef
SHA256d7b201719190b10bf24d04cdbd0564ce2e9704456bd32edb63b92792f60bcaf7
SHA512ae00ca4cac89be30d352e10682d16f7b3d3efbe9788dd61000613fc2291f9d8144dba0c8242bd2682c503f3a064a2ce3c7528a560f58ae0be3565603fde8780b
-
Filesize
1.2MB
MD5d33fb5473ae633b6e645010f7d028844
SHA1f114a181c087919e5a3e7eafc842333ef93bb6dc
SHA256b9f5ca596b0c4270de3e7189dcd79d10ea4c28bdce36143ef1cfad447d42d7d0
SHA5121a0ffc933d539867f7d86b340dca41b4c9ee4ce09830089ee55b5fc500f326545c2db6c52846b9cb42f082b5ed85584bba54857bdc136c1fe8df40beac66a547
-
Filesize
1.2MB
MD56953da268b500334cecaa4b4b3be5a7c
SHA1593078f3098e8d5409f2e99f48c6ba05e6d06f0d
SHA2567868cbc495f8812b708566723dfd7c927445b058f9aeef17ffc351664a702ae6
SHA5123df0055766628759e3c558a6f0ea1204a7da43bc6d2490abd9f25fe2bce52e0ba96ffabaac0967f3e009804f9681fff31b80ef6d2c7b4a4eb41004ad45aed1a8
-
Filesize
1.2MB
MD559313d0056f9336cd189d33abee08b5a
SHA1934594e29fca14e53a285747e8f9bceb03752ab4
SHA256eaf5ba1f3563d4b9dacc8f16d80ddad04632f4debe1dc42b9e0c9e6aa876fab8
SHA5120d2348b16b8fcd4d389a0c6bc2b526d64f7cef98bc12ee0ddd51f8296ab423582b8c461bf062dfd95d5656ab94244cca8f6058b44b155844f401f3f9bdcdb90a
-
Filesize
1.2MB
MD51508056acf32977d314b02af71a8798d
SHA12dc5d4c2b415dedc3bd461b61a454745ee9053e0
SHA2567475c1be1439a1272898c14c9c5a3f911a42bc0a2acc4b70164002c7c6c4a9bc
SHA512a5696fd8138011978de05d1b7633fd69d56fe7b6f7c23382d205f1d7b1e780378c364308c48b88322e2f7602a0f90e93ab9b73da098d3ff91708856ceca51b4a
-
Filesize
1.2MB
MD54d4e1cc8d1a6d001cc089f80ad9e84e8
SHA18a1f23356b4ebf4ea475aa5cad8cd952219e799d
SHA25637639fa69415a74869eec9515a6b9cb060df91e901da356d3790159ff52426b6
SHA5129ed7c06454a911d0f524a97c0b81f34164d29eea48577b6bd5cdc931bee820ba6a17072e8362fd8ff0112ae4b835f258224b4228b88ede94232cdb992ebf5a3f
-
Filesize
1.2MB
MD5430082c6f3bd9f369ebb130fded93aa3
SHA1764232de37aa097925aaff0d69ee90911f161bfd
SHA25670b903bb635f46df6cbc26f1ab703a410f294aff802fc740cf7dfb2be6674722
SHA5129970e08bfb5904e4dccd05afbcc8031253f3e231f77728fe9aa9a968f8d80fb7a8b847e8cbbb858cd5f7aa74c8dece04aa5baa9592d2d8966fdd31a5f6780e13
-
Filesize
1.2MB
MD52bcb1b7700d44c71ad0552eadbc16aae
SHA120a6cdc199f5c30023bd414df922c5ce5906f535
SHA256e354788dd5a44eb664033cb016e3aad6d590eb65bc27e8218699bb6ce8aa39ca
SHA5128dedd9bf4c8bf5ad543e3fd842bbb8a2d7c3cf25b24f20cff10f5408d3719554565e611084439522a7de7b39867dab41c002c902fe8f1e890c07179199138aaf
-
Filesize
1.2MB
MD5d98e02707b3b9113af672b643e487bbb
SHA12c01abc0ff25db81f8c846a3a4988f22b54ecb68
SHA256112ec68ea4f34965df41ee0434d4aa18ae0984c9fcaf67e05ae6e3b8229f7560
SHA512f3e06cbd13d30963c4d2fdcabe6a5cd2765952daafc6311c62f60327a83ffb1c9c67562277916f9bfe31039badfa96cdb6fbfc06298a933121e79e3b5e6e0fb5
-
Filesize
1.2MB
MD57ffe4405e3d9956007300486eecd7fd2
SHA18981a8448cb86e06303adf6ea085c242ca8438c3
SHA256a85384775668e980d5f654f9a9366d6c06e06e275b8f5e79c4bcb28cf7a1677a
SHA512a3f83c56a294a40ffcbcea9d1d03c43420242fdec2e33fd1fe66057c5cc3e0d0110f1401a4b5f6416f371d00b92e70ed15415365183badff9c5c4aaa12c6def9
-
Filesize
1.2MB
MD5340c65ed07dc37c2125e8619402f3794
SHA12000500a53eb3afb2b9523abf06fe9b85cb282d3
SHA25684f4a3bd8484b1c7e43dfb9140fbd586b9a694c6bfd19bc4b6cca71af2110cc5
SHA512122ef2f89d36d4ad9def20f54f8c47acb81ad376c14696eca312b1be930aa12aaf0793d5e3d478b14ee5c2a3ba294dda969731290f46d3f086b6d4c2d980eff5
-
Filesize
1.2MB
MD506b8e2721fca7ee85cec22e6fff1980e
SHA1dca23bffe5c4b7e0d34673d8224e7a049c3fae06
SHA2566702e74d1fa68c1527c79332a0c4a7618a8f8d51dae6787296372905376d30f3
SHA512829064c987378b2198e70983f6f6dd768008ae9f609c688c7d5cdcb0221a2cde6d522d509a869376694334b1cd8e39fad734fc2ad54e87ab6bb3127bf80bea2f
-
Filesize
1.2MB
MD5885d6d760b6c9b06001fa7be0dde8f9c
SHA1d7e5b3196984cec4a9837a823afb34309c31684f
SHA25657a71f7374222a6e9a53838d3cba779f20a5fa7f2d166faf811e0e939f533166
SHA5125cebb6067fb4b0c1ac0ea710a50f631f1aeb8065e713b54b0606cd94dca1bc56f2a8eea50f060ce528c68f175dc5b280e0d9eea28f200930bdcab3be35757a51
-
Filesize
1.2MB
MD5c967230c7bd3c361b6e4b3171710a6d5
SHA15ce18fc9ca1e28c95651044178b0ca53b3cd9410
SHA25668b1d8bb7558ac54284c14db2717985b69ba46c46088c5bca9657d0beb243157
SHA512d34aa784dc786a306f9b7544b8b2625403ad73ab71d29615b285de14ed78c1e85e7aab5eb4b2a31faec59738b2c6a9b1f8b6761ca77ca24deca2d125c1aa708e
-
Filesize
1.2MB
MD52db41d73bd3ea05cc43ba99988192422
SHA14e58a704874d6f5aa0895ec666bbf088c9ba2cb9
SHA256fd94c872853e1f37762e6f0c15719cd85597c26daa40ffa2bcc623d063f71a8b
SHA512d375b7a374715baa66448a018e5b656dcb5daa83e28a711137fc0fff16b6ac932b1c6029e236d8cf3ecaa47c07d56ed2ae36d62daf6c7c2ed821e09fbfa758ef
-
Filesize
1.2MB
MD5e4e8aa7b53bd9c417280c2a47059b31f
SHA15d2c076203665b861d5a3177fed046f9a11908e9
SHA256741c48c4ad1e77c8c08677368840cbd7b970e96fc4e1ebc3053817756f944eb9
SHA51209a8401c0f4b16ccf2a3af9095b328f5fad554567dac64973c3dda93bfe348cbb9a77aae4beba5e8e1b7f0b71eb99931bca6ed9cb6945a82717945cffe7d4594
-
Filesize
1.2MB
MD5640dcd8cc5b1509b620659514b828519
SHA186b74924f2ed661cad8e918942b359d952cbd967
SHA256640c82815c4e9e1f222e21d86ed289e80a4517ed48cfb002d89d9265d66a6923
SHA5120650b2bb2c2713cde5154c41a63df4416a6c923fc7ca2d05e517c679b09b4d80f1c77ce7ddf9e5ab375e29d01ef967d8ee9ad7519c9bab52cdcc3eec697ba3a8
-
Filesize
1.3MB
MD5a86c4d4596c49b96f2fb91aab528d3eb
SHA110194421dd1265878968da9fa41c5af16192c684
SHA256d5849e1c046efd199bfe92fa36f923faaa359d883bf7440911b5e365224ba5dd
SHA5127dabf51a5ce90e252a1daab3164f0da159840d64510b3fcd4b9b87876eeb4d310f4cea10a39929c388c4d841d8f8eb99b43bfd91be4ee89fb4a69ec8efc316d6
-
Filesize
1.3MB
MD56855b530830ea942fc70f6e9e6ec968f
SHA14f6d33ff8c2aa59b13ed1e9ceb2a17dbf331e59f
SHA256dca0e2274a57c0cd2bb5a22179cf2817199ffbb0dd8da3cf4f1091a6eca465f5
SHA512bad4cf5e60507296dca7dc896d1b24a99f81d2e3e9b01472445209bb3ecf3b400752df8b1d79ed4b8e4f4188da51a517d93948f4f3e586fbe735afcb48d12e1a
-
Filesize
1.2MB
MD5d97631886e424ca212ff29445f2cdcde
SHA11250ccaf9709182a835cbb0be0bd290325b08f32
SHA256f60157f5c4c3450d3e8672b667581cfb75e47a752962584d8b33f63c83d8d546
SHA512b61d1dee2026642a12a6fc8488f36ffc84ded61d4c49d4170d02047aa684c2967442cdf15211c07272d33b4c17786d6a69705611f9968064ef8bce8b2e9a22b9
-
Filesize
1.3MB
MD5c94827694364a2a43640880c61afae34
SHA17c83ab27c3a1b304c82c42e6a6bb64e1f6e16fe4
SHA256f643845eeb9ebd98a796144e371d03c66d4336f6072f0bc59254101e7cdb3627
SHA512012018369fc713c1bd8b86e16a729a9ede5f165f58e14ac6385a5539ee5a448d6d70749cdb528a235b6c485ff2d3b3ce003644ed3909a671d4b8d05b70d12dc5
-
Filesize
1.3MB
MD5c197faa17a06956d3b9dc5c1b3be687a
SHA199e4d8f93ca050a7397931da02254ef324c2e97e
SHA25678f12f2aad22758ab40ab7a1325d7ade6186083aa6baf74f3f58f757c5ffd8fe
SHA5120bcb0da613ded2fd448ba8f08edc9316436231bb40d49785dd7c1cd3c186930cfee4824c87003f61dd9e954d55a72b9ff85a277411b88277862e61c75d9f997c