Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
08/06/2024, 04:48
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-08_b5c98846455cb5ec5acd7513e7a3a155_ryuk.exe
Resource
win7-20240220-en
General
-
Target
2024-06-08_b5c98846455cb5ec5acd7513e7a3a155_ryuk.exe
-
Size
2.2MB
-
MD5
b5c98846455cb5ec5acd7513e7a3a155
-
SHA1
98a3b5f616304f28e80815e9a067a9145a4fbf93
-
SHA256
c84773b302f5a2cf7fa6874d6a39bee5490d159013bff3f0070f5eb9d17eaf76
-
SHA512
e7c107c8703495627b1055d8409f328a749a37f64bd2322f50bfe6ec9333ab33e156bbb3b1b33ed471d434fed5b7d4239c18ccdb56d7a22fae0d25ed2535f02b
-
SSDEEP
24576:sOObVw4TaN1wdkukCba4oXtgLhU3wEdmh58Pt/sBlDqgZQd6XKtiMJYiPU:sOOh3aN4kuLbegmtGi/snji6attJM
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 4892 alg.exe 3628 DiagnosticsHub.StandardCollector.Service.exe 3168 fxssvc.exe 880 elevation_service.exe 3592 elevation_service.exe 3624 maintenanceservice.exe 4404 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-06-08_b5c98846455cb5ec5acd7513e7a3a155_ryuk.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\79cb06c8bb5459c0.bin alg.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-06-08_b5c98846455cb5ec5acd7513e7a3a155_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-06-08_b5c98846455cb5ec5acd7513e7a3a155_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-06-08_b5c98846455cb5ec5acd7513e7a3a155_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-06-08_b5c98846455cb5ec5acd7513e7a3a155_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7zG.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_97390\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7z.exe alg.exe File opened for modification C:\Program Files\dotnet\dotnet.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe alg.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2024-06-08_b5c98846455cb5ec5acd7513e7a3a155_ryuk.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3628 DiagnosticsHub.StandardCollector.Service.exe 3628 DiagnosticsHub.StandardCollector.Service.exe 3628 DiagnosticsHub.StandardCollector.Service.exe 3628 DiagnosticsHub.StandardCollector.Service.exe 3628 DiagnosticsHub.StandardCollector.Service.exe 3628 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 648 Process not Found 648 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3872 2024-06-08_b5c98846455cb5ec5acd7513e7a3a155_ryuk.exe Token: SeAuditPrivilege 3168 fxssvc.exe Token: SeDebugPrivilege 4892 alg.exe Token: SeDebugPrivilege 4892 alg.exe Token: SeDebugPrivilege 4892 alg.exe Token: SeDebugPrivilege 3628 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-08_b5c98846455cb5ec5acd7513e7a3a155_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-08_b5c98846455cb5ec5acd7513e7a3a155_ryuk.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3872
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4892
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3628
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:1888
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3168
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:880
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3592
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:3624
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4404
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD55410833e3635c4f4803cf73176ad18b4
SHA10963ac1658555e6783d3eaba81b2f1e6a3d8fe0a
SHA256fc2a450e34c1b48a4e5970dac1413ef06aa1a724f3208613e8afa375647ce82e
SHA5120c66eda11ee56df59d6e97a885c28c07660c14cc0c04fb995fd1d8b35934e86dfdf9303620fa887666d834ddb08ced6c848762c84c22fecf66fbc3eb5e71bcbd
-
Filesize
797KB
MD523ef1ffe202286a54bf287ac3a828d29
SHA1f5c8d2609f1be374a852c6624cda28fb94473f5c
SHA256e6f9e37e46b5949844074f51e6c66233383d2be1be11287993c4675ee53b76e4
SHA5129d2065e53cef2ebc772c8db0744db695e39f58701583d94fc080b5b75f607c35f827292b7a2b451fd8667a2f6d01c97f8cee9ac11ce8ae8a3331f0c995f66800
-
Filesize
1.1MB
MD54adf521fef23ec7a4e79d5b0d62459f3
SHA16273e23721bed81f3c05a881ffc7c33cff700dff
SHA2561d60951a1e1004022df118b7b585dfe450ef76315f0eb6e315ba31d2efa47e63
SHA512c441433782b8d8dfef726fa6bbd4da311dfd2265ce55fed5da92d1b5330e4832c6e4a3c8a6c370c686ebd79bcdb4fb7cb484099d6362cf2c627f56e03fac21f4
-
Filesize
1.5MB
MD50f29a174c5f1b2a0fd7e33a939229c8b
SHA12682e13a1bc5dc712c7a5d8315e0d989e865e097
SHA2561a17d2056087e6cc4e078b5f05f0021ebbb549c837b3ab91bb52ca35c460f64e
SHA512bc177b59abd56c7a1539fc61b9883440abbb6b920f0af481ce2bc0f382a17f25319508cfedef36ee337f0bc20898a8cf7151e8fe959fdbf6f36458432cc99efc
-
Filesize
1.2MB
MD550b1a682a32ce2da7188c869fd71dc7f
SHA17ade930199b8013147595e8ea07fe1f935820ce8
SHA25667228e7efc3bdca2918e58b0f7ec9eab6b56c9537557d2207c19b8b0a90e6012
SHA5125f447cc5b3f3a28d52a1865893e7bcd74f1663fac3bc7c9b583e90870c9a22fda6a6c24ae7625517b13fda40a8e5ce74bb06c22069f175f47ff051304c281054
-
Filesize
582KB
MD547e0062906ed71fa1075b8f5fb71898b
SHA15e5016e51d3c5056d3c75afc78a9ef0b7ff5600e
SHA2563e212c35a1ccc5867a3d0e454f2ce14cf80d60cbce82ec5cbb77b1127981b4e3
SHA512122bdc859a0f71f3619cd6199dde9385c272a6f3171d41c5038a2dc5e2c2f3c245780e9aaf82dfe2b1014cd792e25f53672fee803f614ff79bfa7b9f803c75c7
-
Filesize
840KB
MD5dc3a4a881cb477f7153bb89a66ecc64d
SHA1625b7c0e82e03e299b5ba010cd096d9849fca4bd
SHA256cbfd3b16851d40538ad38a74d7e783b23f2de2f82f690ff7e17a1ff3df139537
SHA512972ef35a9d4144e3b90c7fc05cbe620f46577d6f54258af21f14d7982a7a1ba4578cddf3486cfa90a6bfc576674daf9f83a9f9dc7c9c8ec665437c9344fcd2f4
-
Filesize
4.6MB
MD55c32e6f529993921e7ac191d1aff0632
SHA125c051d12fa4758ba177a23aa9f4cf196fbd3b86
SHA256fded85e0fdeb365bace747bddf2a73848cc41b27feed82f39d4bc55d601d28ff
SHA512e3d08c928bc223c9794b93580fbce325e88453680bb3b6b31db0dbe67b02030b72387684c2c65f5697043c0af51b000e012140d0e72f12ba1dbd5a8f4e42d46d
-
Filesize
910KB
MD585400b7e6e2e5c55b457892414ca11be
SHA14285915d8c5cc92a23c9db81f354f25612f20734
SHA2567a4f60091b9fe8800dadf4651a456746a69c1694e8d4b66eda93ad0113c679f6
SHA5129b0d28b480311ef043fe67d4415cccbe5adf1c0546aaab9e4b8bf16fecfe6718ea6cd170d7af57cab0b8d9bece12ea581070aa68f0ecfbadbbc1b51c5acd2e46
-
Filesize
6.1MB
MD54ab07711b4bae4deaf302130e8442f20
SHA165c7d02219c9fd75071a5d228c864c632efeb992
SHA25620b5af271704e7900abd9815fdd7b0a53d9f055fcdb6b4c4108d29081e3d2f19
SHA512aebf98e3f73d991123cb30abc7446842938c05558fc6e8d59dc72d5e8e222e80724166630857e61db5e6aa361c889199ad1e1cef889151c89f23921b49a585cd
-
Filesize
2.7MB
MD58c9ee040092d7cdc5ac02ca693bcf943
SHA1c16ecbc993c5ee32251de5843a85e553f66c9a57
SHA256322003ea4276ea0317885dddf78c5b5495b9559a5071dd898337c0059349535e
SHA5125869ac21251928b595739ba7d8c17c2761bd9f96cd913bae5d0dbd9be0f684f53d506f38923428719cee5a6cef99b6a408074fb37c180af7a0cda4b875c1bfa3
-
Filesize
1.1MB
MD58f913eb641940b5a5c1386dac40ac988
SHA15c0e0fc3c62e663be8cf6e18f6384a91ff3783a0
SHA256ef6cc761da58d8868684c2fe7b50870b45589098a3a1cb0e5f8738ab9db5f192
SHA512ad07055fedbef8eea4c61a3c8388b2d9bb8540f28b3a6b98617f94aeebc5fa22cee4f61b91cd04bf05a87165c6f3206c5787861c18da0abc1105f1992c02b991
-
Filesize
805KB
MD5764dc8de32781cb5e3fdeb01394f7153
SHA1d98ccbd6538c9445243f660d13842fa778cd6031
SHA25697117dc2b679a7a4214af70f2a805b8ac0a6a9a86c95d7b3008d045648c7279a
SHA512ef961159e481d902580aa122a8906d45f8304d183d744107cd16f4bfcba9e4a2fd31f11aefd3f1bf5b89550d81f15ba7bc6c0c3818946ec1f990219e407059e0
-
Filesize
656KB
MD597f2bfa9afbe2b84ff60bdb5895137f9
SHA14a1eccc926184ff46171f07c7c54a3431c31bfbc
SHA2567949e7cc37ec7d6ea746c098b8a64a97401bc7586a018b3d9a75a6876377e1f2
SHA5124296cd03ecf5b03b8bc7a5d74d14340e7a932868efb0708207feaf1aea9021d4956cbe5dd6b392d33522ca4820f223dbbb47021aca5527d8626c1b779fa8c2b4
-
Filesize
5.4MB
MD55b28bd23755a874ee2bf03fcb3c3079a
SHA1c3875c513a005fd645830699ae26a61806568ef6
SHA2566767c5ffb9edf90fd4b03856add263dea957951370689f2225544074c9febee3
SHA512703170664965598530a163350395aa6ce75b0bd9a88aae10da919cc90c8e783ff13808cdca504758f29b4d425ab024f50b9d5b3c426102af012e599fffd393fe
-
Filesize
5.4MB
MD57504128362595377c540ebf4c242e28a
SHA141843d464bf14cf5387b2d9a769c9513b0d1a0f5
SHA2568cafff1852b14b882f8ac057cf24bf4ce8a27b14e676744c48902f829015b24c
SHA5124640a3b7b47728c0a0293992a4d19ff812c93dc2eb94abcc6a4bff6b3642ad53335c5061dac1e9d2b47cafda8a5998bc03876e372a5cf9bada3bb873feef41ca
-
Filesize
2.0MB
MD57344c92b0bf6b096034063502b709d24
SHA173e9d4c885e1a7c8bfaa02fb2986307fc328d8b6
SHA2561cd2d6b4e5700f8aa3a9cbbb7dbef66e1d0b0d921eac7aedd6d2e3ea2020f54c
SHA5128072da04340fe477e70d31598d39c2e51830b760138bdeb989e6c44c2642a4e31c286442ecb7fc04f6783acf640bfaacd256b149c0a0bed848560109bfcdf42a
-
Filesize
2.2MB
MD50add8af35acb331354a36c603cf51d37
SHA1b6187173ca2dd885a41eb997a73fc5235b35f451
SHA25681cb13106baa997932be29838628cd8d2b7563f494de60f57e1046922e27f327
SHA512a0a170d6946d508aa8d727b7ce1aed2660a65722d9ec5294845e1dca412092801508b8730b1d779e0fe2573e1891c314e3685720508c2910f2ee6d427cc4f3db
-
Filesize
1.8MB
MD575be7ea2a2d7ad7e30894c1c4dedd50f
SHA13517b2b50b88c124a1c5c984e29c459728946eba
SHA2560d0ef19a8e5addb86c83f786b988fd64aecd0cd0beeffdbc9dd9d057d5e4abb6
SHA512aa72451d0a4b3d1f42862a32ab953bd831f2e04eb45a699b3ec2ae6de10a2674f04ed20010149766f701319528a396b70070aa57765adf5cf8b55cbec931af31
-
Filesize
1.7MB
MD501f18205dec707afe93a8fd8bbb23e91
SHA1e674649ae686ed4711e7969717c1276b1f0888d9
SHA25627d0806f9f3e3d0b210a76f43fb674844133bc03725d02a449957f4b5596510c
SHA512442df2f4fe5f001abf082dcd433732a26d6bccb2af39dba9de06e320d25937bfb044faf016b29e4e9f3f10db6f47e325045a7c73b8a672181d95a536faac8124
-
Filesize
581KB
MD50088eaa29295d791a4d3687e718ea6a8
SHA1632ad0f196b86e06570ca0748950e638d5f82eef
SHA2565b87d48dc67d13eaaf4b2be68ef0f77632da6d9f75ad5b7b365868b70fc55ceb
SHA51227a04e187e3e7d3e963b8f39de39b653fa9c76e476ba4b4e382b2c0ce3fc89653787e6ebe4a86126aab742f91f0fd504f707b324b2c41a0aa0d6c292e1e4d6ea
-
Filesize
581KB
MD52e1932da6cf2b499452f6d5d815a3e9a
SHA18e58adedfdd3beb78aa25327969ca700dab03b03
SHA25630bc8a7d7defd9c0187fb1b637de1c00c689758755935d6260e8351408b128f5
SHA5128af3e77c64a5f36fc723e69c2bffd90a3f13d554aa5a8302cd3a8e63febfe5f3329bd599501ac2205d4f1e5587ea7357b4dd96e351b280c52eb14cddfe75ac2e
-
Filesize
581KB
MD51c960ea7c7144af431e3215a857a782e
SHA11e542e06110d7dd79b744dedadb2107e6081ed3a
SHA256615918382c7a5dc7152db958310eff9a6a444749c5b0c64d993eda66f4459ed0
SHA512c460683a739fab78338fdf1bd91b90144a2164ab793b5e2b747bb1a7571e140f3ccb4bb09b5bd8b5e646f6ad1fd2858e3ea4461ccd9d6a605352439f709c7cce
-
Filesize
601KB
MD5531c3aa9d7d922cec69be901fcd8c28f
SHA1f5c53c3a418d2d0ac94589c8477db65590b1877e
SHA256209eeab3912cc3d5d7dd728f4948bb8dd9cccdc33f2085d1e84f4db93109c8cf
SHA512e475091a6e99ea330eb319b103c02df900b46577ea990679f180f6a86360c89d942929957669fd93f2d35d6fc2cffd119cdbca8f4f381400e0e3ffbda67942a0
-
Filesize
581KB
MD57557f32872abd38041075510c4e5c245
SHA134b4f6079ab0319d7245a882b06358f9414e1f6e
SHA256568c7abebc436b442b26f7322afeb2ccf0a3e7a83bc48004ee5d5ccff787117d
SHA5124649fbf870fd8645cffc64bec668076e83194e5207c3f2c137ab090117ba99db85e0852ebcc2933aca00a6b55fc3348713292c7ca251bcf7d503f926199743ca
-
Filesize
581KB
MD5ee2a2da7a2704806e642db57fe215968
SHA14c59d5fbaef8cbe437c8590e67a2f653a055d51f
SHA256c5daa1f2337a248536434f7a1ba7da73d7faf33fdf9a2586b733d158ba8fd229
SHA512c2e85efa3af1cb1073cb9130a0a911d41fb457a0cd15022e19cff0317f9c781b6cd1193ba94772284d09138baa067fe8aa7dbc06939cd5de149d4071475fc7dc
-
Filesize
581KB
MD5321a88d5831e1951a0a40fd5957c8731
SHA1fb484508bdf8dfa932b5c6cf2c64b7350207eca5
SHA2565ce4ea455ee267519d7c320080e0e9a1084763717d6f4698769cb64212f7332d
SHA512e4bc1b92e50272a42f2c6b3a75be78fb661e0205d3034a3ee9ea703d4e78212bce668e98db049991a11fb47f48f1782df0e33256db507be12ff0bb4fb39c942e
-
Filesize
841KB
MD5b4b8fca8fc233a458b4f23a6b25f392e
SHA108f54f65e35972bde4d4e51033934b509fc98f4e
SHA256e9c3468f3f3679e44a160eeece62f9b024361b5c4f0df7ea217ee75ad6542c2d
SHA512fe31b44013d99de9451292b5b76947f4ee3cea48f32b5c919b160214830aa9ca94250aad996b6138b347d947f8a60c5996c99e87ecf7d01334107dc013eea3d3
-
Filesize
581KB
MD5cdbf5ebfaca2cf59ba453c3bbfb946fe
SHA1245dc8cc7e507aeeee539a2c895bf56ae85ecc62
SHA2564b751ea2514c0f69de97753d98eda4fc5853c35cc4557fb5ba7f781aa9647d2d
SHA512ec65e98d4a3b27f4e73da60a916ae32488c2b408b63a9b75778f9fec744c67b33abd3102e5ff2a2a6d41bbe967e99139dd951dbb7430c5f2627d42d67f5d2a09
-
Filesize
581KB
MD5b9a2087e31735984ee98cb75693d21c5
SHA164c8596e8ed806b1b4e0fb76ceaa544002d629ce
SHA2563e49ea7e684080fc53d486dba17d849cff2744949dd870d67a6e120adcd6a76c
SHA5129fe98ab50080170d11c7a23282456389212b291ac607d48700386c575e8a5c1b83bc9d1dcb701fc99a45344324bd431317f3f54696293a47ba402f0f9fe474ee
-
Filesize
581KB
MD5064875dfc389f1b2dec3aee535de95b0
SHA1b284b8b12236281bc004dbcd15686c5f3c591f06
SHA256d3d6ae12fbb4f86c062d10596007d6ec5ddc898c4bbcc2f968e2dcf06d6b1213
SHA512c24955f22974ec1a9c88b78ca50d0f4342815dc1bb7cc280c59c33507f8ef89de83753cbf121995e73ea8c7cb49cd38ee2df7a1af5ede9185f7404570770d9ca
-
Filesize
581KB
MD5745ba056d1a58af84a2a572a88ba0fe5
SHA1d8f45740e500eadcbe542d976009754c5621ac9c
SHA256ac2d70f65cd81e87788f5fdabfc7c8a1f1197ef5de510218934a7ecfaed36498
SHA51227e78ab2c5b419e5662926359bce1b81dee86e2e2e667e0252305c79f771787d5409b2fb64f6b19c3101f1824c989bb3b630467dd690f081c118226aea346def
-
Filesize
717KB
MD5edbfb86000de20844552d2134d7b57a1
SHA1c9401f86144b05034a2eb2bf4ea658e92f639b4f
SHA2567687284e8b19b38da5f043e4ac208fe76397e10c69bd992393344ea06aae4acb
SHA512ddaf7adcc8c5b9f28505d3cd61d6d1677154b96f1fdea37722c0978a81f9286ea3475fbffb826f345f70629f404ff0afd7d97d679d3a6c76658c50b2d258706c
-
Filesize
841KB
MD5cf23ed1bf928e4904f22f2173d0ad645
SHA17e8e87fbdda01adf5f95437e4365ff2d3d05712c
SHA2560f2a1ee0a2f2fd394d9f7ad83dcf6fb5ad18b2db8a5b68a944c16976301b86cc
SHA512fcd4ede51037acde25a5c2b5a33022605337094a3f05303482b3832fe451dbfb56779155f2e9939c0993cd8a1e521408b60cead942e52893b559c69ad4df8623
-
Filesize
1020KB
MD5efa7a8239ed08872d59f8f4613606840
SHA134dd66c7dea0ae4d215d845f448c12a0209ccb82
SHA2562939a2f640802b0c989caef921f66c8bb7b9b533aeefbc9641c0cc93a4ca9ae7
SHA51293bd506a8586e2419e3300c70c8449709c7d0167f58073e8155a052bcdec9407063662b424c0da4888d149a77d713296aa243808a0b2aeac59f6a05af8c0dc6f
-
Filesize
581KB
MD5cf2983e034ff6f935f2d489b0c3d3fd9
SHA10ed8128889fc88060a35725828a985cc39191522
SHA256cc1d4a43aedc86d53c8d8bc96a631f78d95c8615d1a5512e95790767b0a16424
SHA512c9f29a3494835feb4549175d138c6a026d5114556e7a0f254e9020aa3d4317112a2b6e1ffa33ff7089909a34e7822e0f31640927e401c6503f932a43f178f417
-
Filesize
581KB
MD550fd5acbd006411598973a8830db3bc9
SHA1e8e925c2207ae3ec06fc8e8969c966834621a723
SHA256e16fd4dc03e964041d442a61d46544b5a3691decef1d5420049e070a99502f5a
SHA5126118a42e5237988e22a6825232ef58a582d404d76915e9db770f9eb1bd1dfbd22560b49bea72edd773cf0c9da7a35f4eed5d121495f9924739cd4337c81643f5
-
Filesize
581KB
MD5c3759162206e841512438b1b81494857
SHA184a2f205f56b5d83d94d2e2eb981925e58e74535
SHA256efcddc59c99c1186b0eb807459a9897e9fee438dfbd5fa9ee2c9cee6da1ae481
SHA51294023da847208ae4359c6a1a48359d29607d4dcf0cef294ded41efe58af768ca36d81e8bb909d9675ef29cc143d07579e04615278717e6d136141ed36f9ce1fc
-
Filesize
581KB
MD5487593de90508e796bd00bf677a7a867
SHA1ea44c0695e33085fb3346e22363f437dad02e9b1
SHA25610b999106d6b326bb1bed61d7889a4ed6a63b299a1163b499491a7949063228b
SHA512be30ab156053690925f6dd3e0dce2f5033b94a0820bcf39848e6a7ed9a194da7928ee3cc55708cda26cbd1e3277966b1fd5d639d24a12b56805406db8608dd14
-
Filesize
581KB
MD555e41205ffd7c82142b6a15e7fa28801
SHA1450352b7772bc3803ad34e53ba5b22b4b4432a52
SHA256830679c5a76415acece9496cd7420dfa0030b6e552bd30761038d04f51b94745
SHA512dc2ffe601bc8bb950ecc91287e96312c0130d9637d50293891567018f5512d1fd608c5ae7193626b2505d2e23d86bcd32dd3ab60308ca0d4b2372d1b8b41dbab
-
Filesize
581KB
MD5b603bc1747af59f6fc9776b7e59e7033
SHA13b314d4800b20cbd6da2387e42233282a84738a9
SHA256f6c0e68925975a985dc1f50ce2da4ce931c53941a96e9b8ab159c5c30356fea5
SHA51215b5a0e2044c718120c748d48490177715dcf5cd90bae49cef00a783cd95c08cb935656eb62400bd18b191c097d34c0827c3fc173926d9d96487728f99c308c4
-
Filesize
581KB
MD58e1dbb83a658e45084137fe388c1a9ac
SHA14bd7702dd90817d2ed556313386f75dc60fcd4cc
SHA256a1f5587ef80fa90602171ee6f9f37c99489889f569d5172e3b401e9916a42444
SHA5126965500e9a2d0341de521f8585d2c20e19b43c677aff10a038f1c1941e77eaa3d361de125ecc0500e48938d886b790db9e918c4261f2d512183938da264ddb6c
-
Filesize
581KB
MD588aa3d42600f774ca00c9d703ed16736
SHA1960f7c0cc75ebea6ec5755cb197478a0e8edc4a1
SHA256578678c5751990148ccd9b8fc3cdc0558f27f95a984938af2013a252cf1b0e92
SHA512809f27ecaedeed8c93da4ad797dc2f0a589dbad32de6683357a54cf27d58acdaef64f279cec4c1a534d256ed530225a8d1e8ae1c2ed4ac89befaf7d73f997598
-
Filesize
581KB
MD5d77a2e2bc05f1a164b31e9b9a4c6fc22
SHA1a2225e6578ab27015a0986d4f56a3fbb1efd7d70
SHA2561ad688c2c0d5d990cb126e7acf1da5adc809ac728d57539dad2f121fd28157e3
SHA512a0efc54ca6f3be8a010adfe7b43982a482f1b19c7863026035e25a57bea602075ef4e4ceca96b9aeacd278e5f2429fa03007f9008c3d399e2898de0442f51f26
-
Filesize
581KB
MD51fa5f22e09f8867b134ccf042d85ac8f
SHA132323588b8ec636ce7c472717bdfea3a53a16bb6
SHA25680f9a6b01aa5d365e7e6fd9134c988ade017eab1c2edf9482b4df7f048a7c053
SHA512ee86981e5cbe625940f0c2d8d317a6f554a3857a62ece27226b6d6f96c2b2418adeb3e0fdf0035c3cb870ef5d7cacb8a3f294a3cd4b669c2d0cf75bda9810cc3
-
Filesize
581KB
MD56141a158b76332569b12259a2b3866a4
SHA1a7f95df72b4c23277c267cb33fc23ca894c94924
SHA25663ee0c064b97e4750a763b501708704b1f97daf7a5099e960575ab577ec2d8b7
SHA51279cc7fb804c15e7848d4a42f3869635fb6692cfd221c15e160abf61cd8b06eceb26fa757593f367ad6093231a8ed93af8d1d993213e6c2eabf192886cca09503
-
Filesize
581KB
MD5b8495a050fad58258ceb3f986bde0111
SHA19808d5a4df98f26fb2a3f74b14f92085ff2e9ec2
SHA256f6bd2d60249be21c7e88008ddb0d8f22a62c7c261db2ddaebc99ada016b45d6a
SHA5120cd0e050beeb270379f522177bc897fad75a1c36e3e2de11e524fff38cdfdc69f01eff8033719fd2917d68c291592ebbc1f587513e14742ac2b2dd9924dfb648
-
Filesize
581KB
MD588ef296c1e987fa29369f2072acc9a8c
SHA15128e6978f8567da9f8810105eb118691ea62701
SHA2564775b4ba176ff1390391c817f4638b8d8e798cc90201a006ef93fd6661e1c821
SHA5129bc4699d729979b4778ceb58a6039765d70c4c340da4a6cb1f0dd69ea794a7fe5d05d768b93691a2dfc26eba4c78b572d1fcccfe5d2631afee579c01ad0b4c22
-
Filesize
581KB
MD52d898314e89d933218c92a2888b81e16
SHA15143bdabd50c0ce2aa5f1cc11a0bd0a35c3752e9
SHA25693c3c5f59a8e0af3cdb34aa02f139009969c947bac8a175083a23dae424b0495
SHA5129cb705a612ef3686ed00a1c67d8a185ba2a33346e6a66c0ac85c9df1487f39fc93360b7f93a450a83a8aa91b600e7bbf0e7784c72cdfdc7e78378c4f28d6c49c
-
Filesize
581KB
MD5b682c3ff116a3e057afd1cbb6cfb885d
SHA189d7fe44eb321a9f97c9e0d5cb066482eeba69b1
SHA256a4b576a9ad927ec0974ef056d9bd0d62afb6a671a01c5b9b54dfeb6a48e633e9
SHA512d945ad4a74ff751731584332a1340b43510431b858f75f958de0d0421764c44066cf527d37dafd2a7a2f620bbc14aa909afec5e994f1c223dac423da6f640403
-
Filesize
581KB
MD58885f9285009a99081a31b893a2614a0
SHA1d4aab7bdc5194ab748823e9ff88e0de3693519df
SHA2569b77de3bfedb9f0923a72efec617dbb50c2e0475ec28eecf9f37c6eab787e9a3
SHA512523fc14f16178b1b469860941366efc097250f7ab6f6bc9c629089d59c22a500c22c6935cbd43d914645e5ff3fd90a8691199553442b5f2bc195bbb3f47d7dea
-
Filesize
581KB
MD5c1065159df5267c32c190fd536dec795
SHA143bc5e2b20caa2f6abfa3e96e6f99da6cdf135e6
SHA256de9eb23359f73b1555a8f9654800102fc6d0eadd06bf1266841736f38673eac9
SHA51281ddf3ea8240fa8da9001e584eba39848a0051658d3e2e050203bb08ed8ea89c24bfea30fee49b09e839ce7028460809deaa2f9ceb65ba7fabc25b9c3e00f915
-
Filesize
581KB
MD569cb0678ca21de11be55c8a5966b7c70
SHA1344c786671bdb73ca21a756f75dfd6b6bc2c9605
SHA256cf428267ed71dc1039c69685baeae76f27c4ab5d88cecee30b7fd3f7fbbe68c9
SHA512c4fe3189abcae21897eafe1e3aa5b468cec3284fc2646bb19cb1961a9ce33e1c103da0bc66072040d6fdae289215ccfd569cabbd950858dfc6844c8ab2b93fba
-
Filesize
581KB
MD5e9788b8cb0ec571bca16018c2b0c6c52
SHA1b722fb92f90e8f7fb1c25d47fc29b2ab0b05c988
SHA256f130297df83f11e222fef5f53b01331e597c3d96154305e05fe0a636e8fca048
SHA512498ac6d4bdcc3bb196b553549a0b647ad7dea6bf5bbedff9845e4378bc7f7aa85f8d9c567130394aba0bf1f99c013509256c8a241f469bffdbd0880e4b34a395
-
Filesize
581KB
MD54c807dd241e66b1961e382c40b905e30
SHA17c51a9d677e2835560ece47f9e06f6a928c339f0
SHA256432ca763db533a308ed0b3caa39c2e68f68ca412638b6a7300f163738b3a46c3
SHA512631f8b909b25e554e13c4ed7067f6867a2c2653e9bb77c9e8eb6308b6a4f5b976745a19c2994f50398aa09a8cbb904cdfceb7e96697ceea0e71c3eb942a5f990
-
Filesize
581KB
MD5fe7b3356e30c5e73fb1acaa8a8038398
SHA117906494275e1447cfcac9963a3addaaaf1d137a
SHA25668f7c3364a0d92cebc4a9a566129e1146057fe587698244449da849bdf982310
SHA512bf6cbb0e2bcd61b4e46d8b7420c491268b22caec939de9e97770e53592935c5fb63a5be7422e05da4f5ad41fc095227917455c2bfe7b079801fc1369987b4780
-
Filesize
701KB
MD5b43e60a2b0e3212dc11297bc19cec6be
SHA16936250d41d283460cd764030d5e27176e94d325
SHA2565853d719f62f8845819ed47015cd12c73bf47f8c10da7acac15e2e7a3aeaa758
SHA51254c8b0ad594b210090952190f8ef308a366a64662dd5b00ebccb4b5844233fc32a12b2cae269451cf1d83e9c46577af26935f8e7d79554077b544a0a10e259fd
-
Filesize
659KB
MD5b573402e91c7467626dd6c2e0355398e
SHA10a4a81110f487979d005d0b68d24eb828cb09973
SHA256ada105452aefedb024922e493b374e86ae050e79dffa86ac87918a5307b72a7d
SHA512399ac474185b5c47789b4c99fb37a857c10ae4cde57346f451ac766224cbaf6feb8ba13aed8833fa3f3fb996e34903cf06e393620c7ae16c7d630133b0784aa4
-
Filesize
1.2MB
MD55a40f45424f4978ec52a6c384685c5e0
SHA1bdec2dfeb67f6263489f754871ab50a19b9152ee
SHA256a150bb0121f1f37ada15a4cab804a42d723284ec83058723bbba2829ce816a3a
SHA51254e24842f405289ff0890e6e9db0a27d1ab8a3488d71971554f6caebd005d7447a72e8ec6c21f4ddf9729889d5823d63edf2c6e9cd28a7bf1407bd4e0f072b07
-
Filesize
661KB
MD59e6b2ef113064f0cc6289b5b03aa6b83
SHA16022ad5c406776ba4994fa276b311be0b3c23379
SHA256ab02175ce104e38992fa048dba6dfba0fd9822a445d6977eb58c6fb42c04a011
SHA512731b9286c0ba215c6149afa1d96af9c772247061eac915e8d42ac5babc0238be8ec61e8a6f609430e8a3b0526b88e058334fac5bc50bb8ca0ca32146b2837a7c
-
Filesize
1.3MB
MD52fea0c206ca0b4ddaff4fa9509c2e7a4
SHA10e097f500ac67b6fbbfbec09455c7f607460c3be
SHA256d9ff7278e01bf8773be83208b025f26bb95968cef5c129db5b75a8fb447173d8
SHA5123282640c2b3d449ca3f1440b1c9ad29e23313a6036213a0aa2ec3c391a775063229b3005afad14803695dbdcd1b2bd32b42b56e9f053b40a45cb8746916c5883