Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
08/06/2024, 21:57
Static task
static1
General
-
Target
2024-06-08_ff4888de51d0bd0a20dc7a942d53e3a1_ryuk.exe
-
Size
1.9MB
-
MD5
ff4888de51d0bd0a20dc7a942d53e3a1
-
SHA1
66a8341bbb55e562524201c537231b38b19eeb9a
-
SHA256
e669dd2e17b3ce8a821c9c07784e7bf60dc4a737d4ac130d49729c45772a0561
-
SHA512
34883498ec8b2533502c6702f7631965247a1d15a1b55f10e8dfce05cb95cb59505d5c69f92fdb6f326d6e92e2094548606ef0ae3000d09346fcc09cf0fb84a8
-
SSDEEP
24576:178r8FfC3F32nUnCdAaKu++nOvRVldlnXfH9gPwCn7vOb7HHcp/CGXQp:1/fQF37CGaPwRVlbnXf9gPTTW7H1GXC
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 2428 alg.exe 3844 DiagnosticsHub.StandardCollector.Service.exe 2052 fxssvc.exe 3376 elevation_service.exe 5220 maintenanceservice.exe 3232 OSE.EXE 4784 elevation_service.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\ec02fc238beeeac9.bin alg.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-06-08_ff4888de51d0bd0a20dc7a942d53e3a1_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-06-08_ff4888de51d0bd0a20dc7a942d53e3a1_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\System32\alg.exe 2024-06-08_ff4888de51d0bd0a20dc7a942d53e3a1_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-06-08_ff4888de51d0bd0a20dc7a942d53e3a1_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-06-08_ff4888de51d0bd0a20dc7a942d53e3a1_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe alg.exe File opened for modification C:\Program Files\dotnet\dotnet.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe alg.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2024-06-08_ff4888de51d0bd0a20dc7a942d53e3a1_ryuk.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3844 DiagnosticsHub.StandardCollector.Service.exe 3844 DiagnosticsHub.StandardCollector.Service.exe 3844 DiagnosticsHub.StandardCollector.Service.exe 3844 DiagnosticsHub.StandardCollector.Service.exe 3844 DiagnosticsHub.StandardCollector.Service.exe 3844 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 656 Process not Found 656 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4416 2024-06-08_ff4888de51d0bd0a20dc7a942d53e3a1_ryuk.exe Token: SeAuditPrivilege 2052 fxssvc.exe Token: SeDebugPrivilege 2428 alg.exe Token: SeDebugPrivilege 2428 alg.exe Token: SeDebugPrivilege 2428 alg.exe Token: SeDebugPrivilege 3844 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-08_ff4888de51d0bd0a20dc7a942d53e3a1_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-08_ff4888de51d0bd0a20dc7a942d53e3a1_ryuk.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4416
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2428
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3844
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:2844
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2052
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3376
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:5220
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:3232
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4784
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD541e83324e75d92abccde47740e210f2e
SHA1b7b231f2e67c5c551b33d0c243389384a36cd592
SHA256f68a770c47c4ee0d78f6d294f0674e0ada17c3b3bbc353a2953a9b1e572ae708
SHA512b25a93c22034812bd5a64b935498318e6fc378302764fdf92799b28916eed601eb5ba2312e3712afed83736395de3312226778c2ae636f91d35e10f1d3a98de6
-
Filesize
1.8MB
MD53a7feaf2c4c5b1a2741425241054855b
SHA1d071b1487486d6addcfc32d1aefe3115a6718db9
SHA256ed5013597e7e5e14ff263f2b04bda0872ebc2c290784db16cc9082d743e9373e
SHA512f1c794a49bdd2e03d477dc01cfcb966036f5dc7e7eb09b92af0439217819ec7ef821a403d921c9a317d994f7bbb0841e690950987ddd988436604b676d311971
-
Filesize
2.1MB
MD57a0dafd92a3f18ba9b9ac5ac517e7b96
SHA1dbb96dff8c564259b8500700e3087e681aa46626
SHA256fd09eaa60e2b9218d829de985f0846df908a5539fa041f829abb8387a4efd445
SHA5123f184d288016edeb968dab02561838cb883212abf3b19f140894ff0c3d7ad34b3a59a6a34da23ccf0e375d7410744d1ceffc0fc4e025291d4f11caad59853274
-
Filesize
1.5MB
MD50b2841fdc71bf1f5712dcd92b0337ad4
SHA187a2280835eb307e9684b8d880208e8beea0344b
SHA256b6a65596db9e0a6c42697f01e0c2a4597da7e31a1d585a77e22f5e4c8d15024b
SHA512fcbf721100503fb8ea7359c54477de0b007b950f83e14f31e0e0d4101aa66dc0de158d296737788134e40719d2957e8f9849e9fe4370cc1777417e686326c6ba
-
Filesize
1.2MB
MD566d48f223a5c94c4a47a8b00856bbebe
SHA11e8c91ee1aa6dd64f97194146c412d8a33f9377f
SHA2569692f65783698ac292df3cb7c958860d54686ea4c5c62cd70c368a969e680787
SHA51230e82f9df0f1be49a45f69b19125f8e99f05e72dbde41468047171c90c8e0ae63882ecd572668634f92e90362170d27126759fb03fa42199d6c211e3475621f2
-
Filesize
1.6MB
MD508c50bb218eb3c40b0806a111842d846
SHA1d97143cda5ee24be1e88d3ff7c3a3f052951d57b
SHA25666d315f53bd818f663957f50a99801b7bf5b2dd7932b7377f38087942619c6a6
SHA512b442b1eb4278a13634f606df5b48729352eb848c39b0260819cac9e27bde28bdda922dbceebf74d86fc07016d0022d637370f6f1b1b8198c6ddd9f6251ba3629
-
Filesize
1.8MB
MD5b6391552a1d9a746e1798da4b688591f
SHA1bf750c56c7b520629cb630a92c4ab2894be14023
SHA2563522469105f2cac3cae9823f3888f4b15ed17eee1ba9b5f06370c505d50bd3e9
SHA512dc2132af3ab77aa6d4f39fe92a1f27adbe946cfb8b11e575899c3188cbaa071dcf632e3cd475345e17355645baa5a690d6d8fba48154997c3913340a705cccea
-
Filesize
4.6MB
MD5d09276d521b5b2d39fdbd5ae124fcea4
SHA1508de7bffac887ff389c8b504640cf048e833b9c
SHA256e42c80c371092ab63bc760752a99415caac329ed2d9bc4b0b27da919b333a620
SHA512f97854b740db7f3f1ca6b8e8bc7580c7f002432105385957bfc70bb762bf68e44c090c6b270cdecf8e12f341f012bc563af5ace9bd66d4fca2ae16af88145e30
-
Filesize
1.9MB
MD500f77b2c2f41a8a4b427140aaaf3411e
SHA1a93535daf6e3865de87406be5a4be75ef40b9fb5
SHA256248417bac87a41f9ec87fc02b841ce68be8b103e12d973263b62422aec7f9ba9
SHA5121cf5319b31ba8d7c0fdc2d8c0c10ca15a4fa41a19335b95988bb0c6698ebaccb4b3beee693bb81844b28e86fb9675b5b9b1e3e6eaed11c83c5adfbca618c8260
-
Filesize
24.0MB
MD5ddc0f9710b96ea18655bb0ced9f4a087
SHA113b4d5fd62c8180820f11500202e3fc48fafda0e
SHA2567b60c794d21d9c7e2aedd520524dbce9df33ab94cc12e1f686552116b84abdee
SHA5129700f23425c83349d25890c6183bb98b2ce0824f8766e21e49206175469ab7890369c668dbf38972b4e2231e8633d7b327b725bd1f49745b4e06a4a5d122a8b5
-
Filesize
2.7MB
MD5bfc051f096032d58944748375b3be344
SHA1579b9fbf9043dea92776ae0d4fd762b2acbb72d1
SHA256d78f61a217d49a376ba40f6b5fc864fdfc920b55f92c183cb2e1d4287cf0e9ad
SHA5127cabfcaa5fd3191dfedc676f74576188ad05b2d0f8dbbc93132a0cded2c60c5e693c0e4a269f20188eddaeea1fd14a644f721d79046ce07cb1a00fa0bdbd93b8
-
Filesize
1.1MB
MD54605d716b3726a0da94a38f45cc3c0b9
SHA116e1ee1f10af29449d93ff6275f8c94fa1a9ea47
SHA2563759d07c15f8865772e79ebfd1fd847bf3e34d8372c82c2ec5a5d50d2a611ab6
SHA512ffd1502a0d98e69d0bb7a933aa8099a6cbb5efa7aafd37a7b280215f39caa89e09c4290fa2890122ca46f6ce267d55d5e69b28bd229e69e9f4b7691cd8ee26bb
-
Filesize
1.8MB
MD5d66620b133b71967f4e2bda8fbd02c3c
SHA152d2939cdc730257849eacc3577d7e80f39501e1
SHA25657904d0071cb5ff4cc937353f0ad44f007370248bd2b30531b607ef0b10fa589
SHA5123d9849d655acd17a2702542ab729f7fcc426b12abd7831c26366b165488d768b316e482f3a54eb4bf550acf55e638766e8db2edda0c0dba27be175df32a08aa0
-
Filesize
1.6MB
MD52d1bdaee337cfca7e1701a1a9bcde43c
SHA1d31dd3b7d7fa88debdd4b8806587368651a02e74
SHA25656b6622942d810737cb4ab0650cf8cfde776590f345469c5e3b7f30b26736752
SHA512315070922e5240baed2d2b07320e3264c92c49c685f25218458cfa86240485769e36b7ac0aa0a2a8480240f77f217e43ec73ddee08064be6b1dde9a444be5ebf
-
Filesize
5.4MB
MD556a485ffdc6069a8eb2f6f8d5b7f7897
SHA191b992b521dfeabc1dd84823a64489cfa8c64145
SHA256bab56566180f42fc5aa1883f9ecf766f5044979a04f229f59e61590458ef338d
SHA51280d85cd3fcab12f6ca600d7fd1ab411d3f7c7c6a5e3e84e28b8d16112c01737641afdef64f9923431c5edd1f81deb059b615ef99ae15d382fb2d6609ba9c329e
-
Filesize
5.4MB
MD578c5bb1e3db0567ad31736e1d0c57a07
SHA175f985259dd2f87ec043cc2db1391c0a4e0eb647
SHA25628c8c425fbb47fe889ddc9998a06045853610e16f14caf97d1ff0d8a552cda1d
SHA51226ef1229f9eea7379d54798d5a1a8f6c74fe17fec5b695a7a854ee49fff2b4a854089ed9628b6e74d85281acba537d2ba651706c1a26f26b29c4489311968805
-
Filesize
2.0MB
MD511cfc3e1bbc615bcbab9d6566c6ec9f1
SHA151c0afe1cabed6fd82e44c099f22ee7497336547
SHA256eb9290fca13050dfd6aee7471ade57e031e427a889cd3e5ef8dea2f9bf081e5d
SHA512b881ba32a58855f7635a15dd377499ad264fab876c368a403dc5e1e8c03d3f0e924512a4b4af12993446f6fa4abd2125f8dc3b909e47de1554354f56f3201f68
-
Filesize
2.2MB
MD5c7a1d2c20ca83ca895b3661ef3415767
SHA17ea973584c5047b56b14e21a0e022a528f310d64
SHA2566be332d38bd35cf79d88171620566d1a1db0d1dfa85449a773a23cadbd345fea
SHA5128e75374e79657f4d3f6333c2710a7f6734578571d9c131d302985235214e105b434c042ae251f7dfaa1aa442cd817197174543778455d4a7fecfcccf8e783fa3
-
Filesize
1.8MB
MD5973365fa830abd76c0608dcb25f77a5d
SHA1b78cecf9439d5c720ef1687c827b02f6bc74b06f
SHA2563f1ecd3b5e9feb1e9072f7aebb88ee171c11234e7a98ec5701742bb1f75a70f4
SHA512a4ca9353d58baf352ea94a8681147a534bfbaa44ac1ab97fe6c394c924bf22ef4430de4b740543341d73e9343a9c40a2d5500d57239112b27f56d3d4b0a4a5cb
-
Filesize
1.7MB
MD59a0e45bcf3cfe113bdb9fd7280d78176
SHA1603a826087b43ad940272e78064e6a0924fb65ba
SHA2561453e073c8fe46fe98a42af57c955769d5d2bbd46edaa783134b29a9cff2ece8
SHA512527d70dc3df9f5cdcd2b4c474835d8c5d7b60298ccdb8b4e3937a2a6e85d5c819292991f3bc79740ad93c0b551b1810c47c4f4dab06ed7971183634e0b662166
-
Filesize
1.6MB
MD5e0adf52971d722aabea265d2a711b1a0
SHA1512b85eaef0cee090fedf1b50e8fe40a39e740bf
SHA2562c3fe9183988b6aaeca74d669939d7deab0cca8c461521e1a1babd40cf2b3178
SHA512d6a8ac4366e08296f1360c96d94006f1969cb034c4e27c93b70741b840447d64de878a0a87d31c4fc4ddee3a3d518f3d447522222b7fd5ce7c4b515033b352e7
-
Filesize
1.6MB
MD56fbe94e2ddae42f09879f6ea7d82b943
SHA176aa8425ca8035d855298044ab9c059fc33cdd8c
SHA256576237ff6578cbc5cf109e701d56e16708c1373ecc6a1324766ea52383fb6774
SHA5123d39edd331c733fa660c76ced12f1da87f4db3e4fe840db263c6eb6c18bb66043fe13bcaf8976425c35173613449e76d365bc696334e286b45dc6bf8c15a70fd
-
Filesize
1.6MB
MD5bb1d62fe69c7ccd956848bfa4ff719b6
SHA14c7e41b6fb6557d80ef139f1dbb9f0ffd1e06629
SHA256653664507ac61053eac061479ab932cddc5ba765963f1174efc8916d2a0b64dc
SHA5125459fbe14c04cdb27bd5234b84396c5b079092063eae7b2fde96a65d49c79baebee2e6ce671aa031a5fc9efd135aedd6597fbb00096582c9dea19e85995dfaa5
-
Filesize
1.6MB
MD5cb641a1d17e144695f288d6a64c97de9
SHA18e00ef2a03818e66f6ba2f34656878cc96504df4
SHA25661a1718c3c0755daf5c761d2c6296c301dcc174b20c9791876e1c191a0f9130b
SHA5125a649a063fc356ecb16adac073ea715ac21f0ec2414273597084556f1d780490cc735d19fc9a7204a672cb6d05075611cbba9eaacea26e0ee6809660883bef0c
-
Filesize
1.6MB
MD58d49a44533e09ddad5b77dab24332637
SHA1453e0c5e4bc0bd828d19a263d3fe77e638fb603c
SHA25602bc4d7d8d0a060c3bb38d912533e4191241f6ae741c8cca36c0c4db2cd683eb
SHA5127785e76909d67b0537d03f7c6937671f9c460e99eccb6a1db9dd2ba8d2f6d1597def4f6fdf915ed44d2953b6babd1cf8bb460119fd8a913884e67feb3283508e
-
Filesize
1.6MB
MD59b879205c7064c28decdc4db0a0d37f5
SHA1761e79e0268296c1c83a433cad64e9eaf37cf9e8
SHA256addca48ec676168567bc300f63365ec2a733e395a4415a94bcd07f9a2a78e11a
SHA512f7e43a985f29003306268395f44a6116424aa6ffb18b15251d4a3f05c0298255df267a60d68837b1b5df1d24b3d905ac9bc5eaa7c29c9d39c1e00ebf5a9a3c6b
-
Filesize
1.6MB
MD570404085e2be3930bfccb637d7a91f57
SHA14d7ea7cd4c32a8ffded017ad8606dd427f09e7f6
SHA256dc77e002d73829255df8918c542dade3833e091d8248d1158ef99e612d9b22bb
SHA512fc193883c519dad7076969d5bf470d49952e660454f667b852786d9a799931b56517a73f02d591d30d9cd12e423ebefb24c96c4c6c00a9eea197a916b3e06278
-
Filesize
1.8MB
MD5d526c341cc9b0dcd95081e74453f618d
SHA167a7701fd439604b46ef4d5544097dad8cc1d63e
SHA256b46b3d9de1020f2d2b5c61e3b4d3c535430c1d453aa318fb68cac91d297ace55
SHA5125454d0373bc9de9c2b11af7f40cbaefcfe07c0f1c534ed00e393cf711589413f642b3706bd1dbd8528583c5c7583bff3e1c637126d4af828d1e5cc470b4df17f
-
Filesize
1.6MB
MD57f749d20fdef8ba8b5a2263c67c24fd6
SHA1c246665bea7a7b1379fa02fdc81527bdcf49b19d
SHA2562ca3cdb509e17217a43fcc56a250ce5fd35e29790e6263bd22d79981ca801d43
SHA512fa3a8b26c745c1f2e6077fd7ba426deb65d50077f6fe428089ae05c941ce563e9f3f807aa3a11deefc64ee80c7cf2ceddb7428e08d9deccca149b1861ebdbfff
-
Filesize
1.6MB
MD5973a79b82c4d2958a0b457d3f3d19827
SHA1075b36281e1996ec53bf27190649d998a302e3c2
SHA2564bce98d388ced48c160ffb04bcbe7cea3a52682f0e48a7d732b385560a3c1160
SHA512f464fec562182b14168bfd294c3844c1ee6bfe52bfaa93195434aadee3e9c7faf0e607d71032f9df9929cd2257e1d7533435adbfea94b097de569b4035f858f4
-
Filesize
1.7MB
MD506126b14d65503320daf8dadfef0ee6a
SHA1e596289ba8cd77cc1abafb991cb9a82a77a4874c
SHA256b8ace25fa775c05222dd5f267f0cf1d12db404a22f1426ae8aee696ae7bd024f
SHA512230a6aa503c50bef40bb00ba03af67c9955ed4de668e242490838ed52c810c6791364dc9a52d285327a059795fdad795eabdccd722deed7088f0729c908e4199
-
Filesize
1.6MB
MD50638115e031ba3564af85c74a653359f
SHA1de01b9ef373e24c9c79e2c59696fe8a7ca2c4773
SHA25632dbb40b8d6a397fbb86b40d54c8511998e4c0a8c1b3b96e3b4235b7a27800b2
SHA51276e0172b149866293395e189fd61cfd6966ef592cf7d66ab94050a189997bb4fbfc40a8b51f6ad088dbd866e7783e5e73b5dc8c5f3acac10d874de590a1b9569
-
Filesize
1.6MB
MD51e0e8bc9402cd564e8e2c6b58dcaad86
SHA1de2e166c5c00e955c90fd0a56d3d0c74e8e115af
SHA25607fdb677b728602a5a99bd45efb142a1152d98a650ff3d1b8b9891d0e3d36803
SHA512645d3c2e54893f907ff63b72887c4729cbb00e6ca1fdfe7174fab0306eb5f30ebe282e5cf5327870ca9968928db68dae16160dd21bfb8b1b3db223e27c6a0ea7
-
Filesize
1.7MB
MD560c8d0b8acb2174c5fcd027b0d1f0a72
SHA10431a310b0f18b4361c94dd1ec75a1a84d96bd33
SHA256c7ce791715007553019bb177f868c3b2dcdfe7b9b431add824beef515996b5fd
SHA51203d3d3370a6ee339b35115dfe44fdb533295e15835fec518db784263fe3bfe922e14459f7822fcaada0e4554cd1113d6f7e9f08582dc121855edda6120ca45a9
-
Filesize
1.8MB
MD5ca4409f931b45e5e7ed975b4a32f7b08
SHA1719a64a8effed40265f377990f61c98a4b6da786
SHA2567e2e7bc31237383c75a19ad25914c6df5d19541c51dcbf5e7eadcd5cd507472e
SHA5121813b6ca1886f3c0717dfc291086014ff3e64c4ede1f069886822f49bdb98455a6bf0180884329cece67173a6c597a1e01e3bff4995dcaf4a69958f6cbb21582
-
Filesize
2.0MB
MD5253e356d8eaa1c4f4baf9328f7b4de9e
SHA1f5cbc4bcaf42b44c76b28933520f77d4e8723070
SHA256b3f7e14404ad0efc5beb589d344f5561e2b7d8744f78dbda4c224263b2747e4c
SHA512066f6364d76c7597e061527cff465398ce8a560377b6d6e91d3e8cdf467c6d980e60f7b6d865f19d0bb9a2e9ec4167f17b257cce99d3aaf9ba0c13863066e202
-
Filesize
1.6MB
MD5d3c3aef570687fa066b86e80a6539f86
SHA11d983f611f72f1d71ad8363c259de878e8a24708
SHA256d106ca0f208062f0006c21c28486b8d35dedc4893996b50ecd838c318d53ed13
SHA512d2a42b5d52c09b25734b090d27e0bf8a06d05a4709ff89937f273ae04e120a34644433c9fa0a05492fbf288999aa5b52fb93178196713c15028dbd291b89466f
-
Filesize
1.6MB
MD5f7d5e36d37efb05ac0d05665715eb2b1
SHA1ffaf643f562e7962305e1e8754e08fd2b6146141
SHA25639a1c656878a0838894cae0baa14d3fb1aed05923bf4b1f34071039f23e4c3a4
SHA51285003979effa68947cf999960fd2f8b92ef69f2ce46cfb188d394583ebde2b4ae43ea715b1552c8509917353ab238c2da126a12b07d2b759447a93b351096e7f
-
Filesize
1.6MB
MD54b3f0a8a662a5e3202e685b3a259b141
SHA16f7bd1adc6a361ce51ff2a62fa2151787fb73c7b
SHA256d702db3db5903386fd27296925c794ce75e26e950b9d13b65b4895550ef25176
SHA5125cf97c81beaeefc6f22d9baedb09073903d8c9532997c95d8e43bb9f1f4898c459b81135b4cf845d3a2241ceb7262df1902c4982271f626c43c1c0c1f4f369c6
-
Filesize
1.6MB
MD50a17598d7779bc0f466b470a1c96d51b
SHA158e70df3eabbe1afcd66b2b538222c77eb78cccf
SHA256a0bc96a11703950a1a2fa8e9500603e308e0b14cb0c73a4ef9639013ea15c0c5
SHA512e6176e53bab85baf129810a928577b5d546cbcac5b44ae6fffe589dc2e487f5aaf9bd191d09901c5c37eb636a087d125ff11dca8035db767f332e22e5bb13e9d
-
Filesize
1.6MB
MD583a455077802005d40075a58a1978bf5
SHA19fd454ef0db7ff4adf366f75024445a8f559cb66
SHA256dd1ee012ad9d11deeeea8b5d2b7a44038e5cf73f00712e22be6a6ca959339d0d
SHA5124ad97891b70f2948166704ded18aeca33c953eb6f665865e478795c2f7c9f0910675287c898d52c5880c51c34c819e0c8dfbfaca406f57ec8b43038a71c6b253
-
Filesize
1.6MB
MD595219e059dbb52d957dbde1bb7630bad
SHA1d2aaaf0d202b172e31986a0935645b83425b7965
SHA256f4606daf78628eb33948b6d8193ef269ab94e2ebdfcaa59589117286a8384d49
SHA512bc3b529957a6a552578adddced52e154fabfd80c3a9338d3d8edaf9f17d5f6355f1b85a318afed688c857a5635fbd437c79b39b424addf87dfcb0882e96ffbad
-
Filesize
1.6MB
MD5864e028a30f26843404e14081b74eb2c
SHA1d60de41f766f19a558a755531044c1967e5a54ca
SHA256032757d4f071df1743688e666ffffd9cc1a33bcf225ba5a3026d0a8d65908f68
SHA5129ab18f82cd2faca01bc7b5c430f92f7e4af0399da697316bfba5578c257a4f6028504bbad5efc45faedbfac3350d35e721f2ab6961c6abc7ae078a829474595e
-
Filesize
1.6MB
MD5c489a755ca918a198aeb7eaa9f8b5c79
SHA139139839d506a0c2cb5667fb65b35871903216c6
SHA256ffd224fd7d7b693f168326e7b42cd1f616afd06b0ab813330664b619331aa27e
SHA512f85a62bb1a76ab34368ff6e1c6198c34ff1ac24b09c22c9333d5bc5ae8eeba30cae8a86bf14a23b7c0413899f98d2ceafbc04293bc9b9580bf8cf779fb567853
-
Filesize
1.6MB
MD56dcfd4ea3f58c8821ff62053ef867da2
SHA1497db7a604a3c03af464422c7f2107697052ad8c
SHA256728e0c7722eca5055aef9e2f01da0f065f2329c50017b8b571ccd2e9cb013cd3
SHA512e4ac2f570451381772f342d82ae16e913ae83b56364ccf80bd3e314c1b0b6ffb6372302396fd8e13e6f8c3c5018e340914f2541bab054f4e1cc5df83214ac33e
-
Filesize
1.6MB
MD58ed3b233deceba19cea1fa70814aee5d
SHA1e87e2475ad545cb05696ce2866675b54bc98c79f
SHA25667906b754f0da85d286574661e96d130c037b04a1c9f5e90377737c15e45ee62
SHA5121b98f037b1a90abcaf497dc9abf1c0b35522a285e555d3679fc68183d62aa8ef553c36968f3611aa12cc4721f4b8e30f6d311476d53c8f56ae4a6ee44986c5bf
-
Filesize
1.6MB
MD59decb5ad76c2d90cea08d0030c958326
SHA1091326d89608d0912f3050c6c2e63a6d7ee0ff56
SHA256dabecd7eb0d27d2d3d3245828d828131344cf90d0193589c683af123f9de3771
SHA51203c0be9dcd3214f9e80c515fb7d45b16afbb9d3fff07c9fa0eddcb2b404ff3bb52389a3f294c8d0890e3632ccf978687a4810bc74a4454e536862b2d2c953917
-
Filesize
1.6MB
MD5a433e0f175eb1f7aa35950aaeb68d120
SHA18c7bf973fe2f4cc4d2b43b15b5100ec61b1a41ed
SHA25680527d20b5e8112e87026b6a2225c58f42a3d786002f434446c085fd0e892c6b
SHA51283210ad4b34abcdcc058a9f08a8a2d0d0d23d375796e2b94e729a6455ad63f397812596cff83e8fcc01d65e8599879b2bb1e060dc806d4a748ab5149d4ae67ba
-
Filesize
1.6MB
MD518529e840d37ad147f4e5dd0c9d77069
SHA15fb1d875de4f79bdfe796a60537bf126ac3cec6f
SHA2568a4e9bc2850e70be5b966f411b1102fc8d515bbeeb81288647274f9068b94b49
SHA5122172c845efd5f6c146ec02b1211c4240308357dea63573c90b289ad096afb6f1a9801476ca89f61e46e1f7a99bb2a57565fb0c32e5bd4678f48916e5e9fd08bc
-
Filesize
1.6MB
MD50443f5db15520346ee7b7bfa63e8f725
SHA1241347242cd3f26fe72b3ac0e075a579e1275691
SHA25614e1ee3c6725ed88f6745d4528c5457db13b697fb19a4dbcde95ce42c592c167
SHA512962adae6cc778dd73315eba450d8472192a225644bead93dfd5f8de58542d7982fc0d1a252926e617b3399d59cfc85fdd08ce849711a6e8494c4d2521d61502f
-
Filesize
1.6MB
MD5ae95259e56ab969be2155bdf1359205f
SHA131b6630a4a19c07124c2d4ae476afcd865f2ac4c
SHA2568f1eb493520d47d1c780146b52092f3623a522b3c629b6120238b1d387215ab0
SHA51284338f2bb293b0d9a8adaa2db76d2330b1241db68a41b93a3116b8e5167ecb3dcdfbc9efbfa29168c37678581d83643b5465b684ead6acef53ae02ca432c72c9
-
Filesize
1.6MB
MD52fada7742f4dcc5e963accf553ff3b8d
SHA11419e9fcb973bfd6c53f53766975c082d183d702
SHA256623e69af2d1aa3f00589816d70a7ad790996649419b8a6099d8b2ade65e5cacf
SHA5122dcaa630a5ad3c0fcd2d76408cc1111087f391fe681a340e600779000d68f0589de288666ce36a1137012beafa343014478e4366f160c77e1796f0a88f706e64
-
Filesize
1.6MB
MD5bc07ec0254b95dcf988368cbfb208528
SHA12e2d2e1e6ebb46d1ba830a788366e878cc18c85f
SHA256e6c5a7c32d87c77a4591f72c548630272e699bc87e9b7fb71893a3a7c0efb57d
SHA5123b28aa80b8958318f9a1cecad62ea4957a2b75930604092d8f5e786451bbcd013ef0aba20d2acb193224756fbfc2dee4f89744cf0a63c4cca1087bbf3df1241e
-
Filesize
1.6MB
MD5806926e014f05c4127d7f8f4fdc3c652
SHA13fbf55183077cf298d48b8ec4b0d700aad400c48
SHA256c551f640f94e6da6f18b09f125320346e4331de589a82c75936d2d88c4a8249b
SHA512cff746a7aa0dc0a6ee4d6479501c42482b09f8515e9a197d6bca1f688cfc7e59e5da8c6ace48f9180b57d532e2e66bdbe41f98f496f65e9bb1dcf126da2c7f4c
-
Filesize
1.6MB
MD5e73d829a291653b640cfbe6672719798
SHA1715a710fe05b3d7602d7686b282d18f115ed602f
SHA25603041482bad912f5e0c5c90781d222012e8491874db76bbc2f1e013eccdb1e5b
SHA5123eff39c0cd4164bd0b9de68d9cb30d0e460773491ce76219cd367cde0e6463529f3d870340ae0483c8fe66a8e8b8b2e1c4f4548143d59a9fd84bcb896b9a82c0
-
Filesize
1.6MB
MD5799a53ecf64897155937330636eac1a2
SHA12735d3ba1ac44c640c7034c73b6a205d7622a70e
SHA256886866d717bc29677bdffb308360c8afc6ce81246b6b76305c6ece4fa4db5359
SHA51228f2b1fb28b2d7713fcbd27cd003eee70e4844609a5c972f7824c6a245d72628515a8a8d45fed1ddf068ae15c16dd1541e548966b8b3d67600c30d4683072049
-
Filesize
1.6MB
MD51f0344a0adecf29178e375b580df4d25
SHA1e541ba5050fe5459560d9ce48dab4e1844bb5398
SHA256d9a4a5dbb0a6a4c676007fe05e259720eac3b11ded52d1a0681828f4a935198b
SHA51266e3fa96c417d3dadf6db600b607191c5ce8ae4650772dcc524d5ef01f7bd62cac7b29fb79ff4448874f2d909f40a277f029ec3d13033e48baab69dba1dd0c8f
-
Filesize
1.7MB
MD589bfb1a5874a94b9422188ced12fbb88
SHA1b8c915a5a556265e0eb8fdd32c5d45665ca41480
SHA256068ab79d7f14a814e1cba62b131ff350e3ddcd7cf3b313cec4b20bf28db0e29b
SHA51239e85c716bf15eb98cf1b641295893d4fa813b7ca5baefe985034de17f31b460fbd161c97d8fb38d11ac64874c75319edfa97c7de10d04f1155ba8fac9e5a6b7
-
Filesize
1.6MB
MD5fab4e0398b0434a30ef4b9717c9860cc
SHA19ad83505a68e300caaaeeaf7d63c421f78bc0981
SHA2569eba2f6b8aff82cb4c0b029241a801b7eb66b22020e82671ffcb0c5b2e39922d
SHA51208d23fa0d9f5e79f0311faa15c18ca7f311ed1097f1809ff1c077131f8ff7354d67be44ea5a5e9fc6cb792ea5b1af202733ec9ed8973947bea8c142407807a1c
-
Filesize
1.2MB
MD505819727d39d7f03b0eb18ffd3f554bc
SHA167d5ee394552424bf7db1133feac1b9c780ed0ed
SHA256650c3f740319ad4d5cf0dc0b1ec8aef02e7a151019ed67eb3f9f7d01f462914a
SHA5126131614ebfd4008571171b67cf84a049ac51e6ec3c88b83de23cfded0261b57c181ceb0145e58afd184f10487956ea637a32f762bf3b7fce9649e669176fc8f9
-
Filesize
1.6MB
MD5783eab18841d4051d61be903063359a9
SHA182085815694a44752affa4d44edcfde75ab4e05b
SHA2566acfe3718cc513dfb6c716194524801010d546fe97851ddb834610d9b24e4a90
SHA512916a3e03f9e95083e8b8f97452cc9bbe16d90a03f126dd2812d855e2ecdb3b6fdbab58aa1e8daebcfaa36a94fdb5654f0d8324891f357d0d4fe198ae383f5310
-
Filesize
1.3MB
MD598aac79b420bed17e18d45d592e4ce36
SHA1b294af45e551c1d08d462d9393251c9e58d51925
SHA25652b11a87c5d69276b62b111dd0cd31ba7182f0a76bac65ca8fab8e7c309ec4b0
SHA5126a89f9b67fbfeaaa466c6c579fc0ef80e25c09b93cb3db281c9f42212224c5a1f77902fc981f1fd65e208de70aa6960a3ce6a72f7258e1a1976c6a0d43e35fda