Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28/06/2024, 14:29
Static task
static1
General
-
Target
2024-06-28_1b39dbb6110a49c077c60fc98ba1fd02_ryuk.exe
-
Size
1.9MB
-
MD5
1b39dbb6110a49c077c60fc98ba1fd02
-
SHA1
cda5ece1b9e3632cf3a1103a36385fff4c4ae42c
-
SHA256
8bbd90e4d54d3fbc9cd55ce219544d253b22979ec085b5fc856f5b9793e1b471
-
SHA512
a41fe6354c33ef4bc9d7815ddbd5b00a08d11028ee94f3edd6532c1494be56ca5405303d883397a6e17d1693b8b2d1022d01bf03e44f32bb90317a6543471344
-
SSDEEP
49152:k/fQF37CGaPNxlMPdlR8v4UC0Eg6ET7M/I:W+37Ul2/V0cETQ/I
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 2248 alg.exe 112 DiagnosticsHub.StandardCollector.Service.exe 1416 elevation_service.exe 60 fxssvc.exe 4636 elevation_service.exe 1912 maintenanceservice.exe 1124 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 11 IoCs
description ioc Process File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-06-28_1b39dbb6110a49c077c60fc98ba1fd02_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-06-28_1b39dbb6110a49c077c60fc98ba1fd02_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-06-28_1b39dbb6110a49c077c60fc98ba1fd02_ryuk.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-06-28_1b39dbb6110a49c077c60fc98ba1fd02_ryuk.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\2b1f5eb2c3136770.bin alg.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-06-28_1b39dbb6110a49c077c60fc98ba1fd02_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104468\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe alg.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104468\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe alg.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 112 DiagnosticsHub.StandardCollector.Service.exe 112 DiagnosticsHub.StandardCollector.Service.exe 112 DiagnosticsHub.StandardCollector.Service.exe 112 DiagnosticsHub.StandardCollector.Service.exe 112 DiagnosticsHub.StandardCollector.Service.exe 112 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 648 Process not Found 648 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2768 2024-06-28_1b39dbb6110a49c077c60fc98ba1fd02_ryuk.exe Token: SeAuditPrivilege 60 fxssvc.exe Token: SeDebugPrivilege 2248 alg.exe Token: SeDebugPrivilege 2248 alg.exe Token: SeDebugPrivilege 2248 alg.exe Token: SeDebugPrivilege 112 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-28_1b39dbb6110a49c077c60fc98ba1fd02_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-28_1b39dbb6110a49c077c60fc98ba1fd02_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2768
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2248
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:112
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:4500
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:60
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1416
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4636
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:1912
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:1124
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5cc9270744efe627f2128d7b155f348fc
SHA1d21992db368f47a868e22cb1377c761af4c3981f
SHA256e2d3d039ea10757979ceac62b8f57c80a8697a886912d343d7d1ab95495c5f91
SHA512d9499bb88fae217d125fbed570ee378882d2e6a4ec9817cbf084e13429bfe7717a28c4cbfccb9e4fea219f373ed4957a6aac9edc386cfe7e2c1cd1357471dd22
-
Filesize
797KB
MD5c708f2041c75aaaed7119758bad3e878
SHA10863a2b751887f558d400401376fe220eca16366
SHA2560e1ef34eb913eea15b5cf069b5bcd7bb295cc9fff8ba71e2e5a00d47be307200
SHA5125c588e2c492a58b46db40314d2ee727a7889bc398440ee215f2e94f7f9f024b77413065947aa52c520e7f25cd3ab061bb66293917dc273439fdc979e9e865fcb
-
Filesize
1.1MB
MD591448c9fdf998db36e562f170e031588
SHA10c2019e443d6deb83b8041fa9be2c23bb6daeea9
SHA2562045c2a9a2caa0d38cccd0005c710b4ca349ef34cdf258532703ec80e10bac25
SHA5124e9f5bd64ea649504feffe005191701c67667a802bb94d6a53b7d43071bdf08e6be00eb774dd8904b37f45d84290a1a367730725e28b19d3292de33b0c2db5b9
-
Filesize
1.5MB
MD5eb1c68ce2ae8220bed86b14262af13e7
SHA12e1e4bc8c6e266332b8d3101d6faf34453c1f5c1
SHA256eee73f85c40cd20708fcffafc4701d92515fc60a1998db6fca3277e5a361dbba
SHA5123053615369123f712dc44b73260bf1257a28996abdae697e14651b3533d7f725de1b4cd25bb3d045d63656f710734918c55d963a614bf6c3803f22919418793b
-
Filesize
1.2MB
MD56644639e59488af131378b2aae00a93f
SHA11d0f1c339cb42bf11cb0af2650a0efdf1752b420
SHA2564618ef619042d0c4994c8a02cde0ce9913aede3d32693b840d0a8d89ae57b190
SHA51232d7007a736f0659f8fb915e176bac45e832a7f10cf9f5fd250abb8ec0296ea5544658e33fb20474e52cc278be46c078e3b2ae5fe353c19de687c46b2e66f822
-
Filesize
582KB
MD5d820649ba071438e869c79475c1fdc4c
SHA1f6bd1f99784422f066a2ec48b2ef861184fff3c2
SHA2565d38e3708aba4142eaae6cf042f892acec0d88843b5e7a17eec705f6a0403b11
SHA512bc516d9c8521533506ee108b57ff1d6ee379553bf3e3a03350bb6ccd221ef03815780c5ad9784499f7c50ad27b3b6482e3adef50527f8638029331bdc4e4a8d6
-
Filesize
840KB
MD5b137815e1740ecf569e1c9ce04687b1b
SHA11ac220b5b9cb0404633613f5188cd0b8708f3a31
SHA256c34ba24ff3a34c786db8b5a433210345cf78c1c9cdf63eb5865caf9f92788fc5
SHA512f3b75354f9cceb1507db80c2945146c412e7f9b5c286c9fba784767f8a5ab049a2ff2f757dc6e5a2c597626d5c9578bdba7b96884714f1052da1e76f4d18059e
-
Filesize
4.6MB
MD5dceb6b306c62697fa2e3d0211230265a
SHA1c58665a6a0d162d73010741973d53705f7b61cce
SHA256ba00031501178f8d07711395c17fb1c00c4a302b822494119847608f9385f2ba
SHA5123488c5f0c8bbbae07c527f01dc36c59e61e37c090229c5692d7400a6bafcc4c84a8a3beb08a7a23065e1ebbe4d068dafc461d9c2142beee2105780e922d01b11
-
Filesize
910KB
MD59af657faca7aaabefd41b22b00d42e21
SHA1ad9641e9cec9938837e8720db805e586bfaee7b0
SHA256b939e63f840defe430bc00886ee7f442e66035485a883a0c54c6ea22d0103aea
SHA512092cb7e17f1ad168c0ef09e2f5757f0a3e850650ba08f5f84f121d8e6011a2d0dced7b22238e51a6795d5a22ea14b7af80f58dca3f4268633cb7d59c85bd4e51
-
Filesize
24.0MB
MD5d310d5cc006fba36f2f5f22afa6d4fda
SHA1bfdfbc52cd8180b3980bb42421e2734c3799f4b7
SHA256ea77bb204cfa5e91eadc12f0c97e69baebc63d1f055b5897c46b58fd5bb5f3ab
SHA512b7487f44227707361ff645bb5d49381a0ff07e539393bbe1f176381cfa7f51d359534142737522eae69e011bd49b59706cfdc4f486e2ec452db05d88db3256f0
-
Filesize
2.7MB
MD5333675c7ca497365e390bfe4fe0eb0d1
SHA1fe952cf9886babe8d70cfd23a9f19cddbccc371e
SHA25642406db800e4d94e1d8becc5bbbc16596bae29f91d230b902573bf67ec6a24a2
SHA5120ec5abe44fc25277a93330d7c203468a79583c19c84bf48af23413bc6621f52d0a5041cbe106fa186660f9d578f43eeb25854ab044ba128ee6b23ff2360c7465
-
Filesize
1.1MB
MD5cb34ade57d5044863cc45d5f960e3012
SHA1c691c82ab522c9095f89333043d33346f946e243
SHA256ac2bc05d5ca51772e7c1fa4c0ac191098e624c18012a8fa2e2a12f6fb41ecf19
SHA512ac2e489a5905760cc4c2ac20de61c76c1f37afc7477ef45c7e93e7568a63da8dbd731ff89310ab5437d24b3adfe5dfe3ff32d18be7fcb686b414994bec73e5fa
-
Filesize
805KB
MD56796c0c38124753bd20f7dd73d97fcee
SHA1568dfad1786603bf7b0f5f0f512abc9609e6d3d8
SHA2569c85de764594b0ff4a568913d34768c793f1148669bc326463fa93f25b58ae29
SHA51211963c13803cee68a0501849562dfcb723d153d858cfbb7f41ae64dfc9cae93cfe7eb8e6038457ac0e0cb4992d9f3abee92db8c9acc156d4ddaea2832b033c78
-
Filesize
656KB
MD56f601285be9997c422b92d04e0fcc023
SHA1b4193315d4c9781d3006af62ebd7b8e6e7d86109
SHA256811ac26a0ef4dc3c9b968d6d3295a9ed7f8d098f0918f30acc4aa36067402977
SHA512ac9b119486c8067c1daed9a6f7ef45d3e3ff01a029c017962e3a5452a28d70c36e3a46da6c3beeedd09fbb4c897cb29893c6d090c257c63dcffce45f4ac703c2
-
Filesize
5.4MB
MD51f600bb356dbd8d8b7b0dd694b208765
SHA1324babaf56e4cb98e831807be8487f116aab7ed7
SHA25624dbd99a9fb69331f9af7e1fac9934d5bf4d20f4a8a4d51e1638d337a2433776
SHA51205b9a72655ee35382e2c8febb60f03100ee210e22e280ae66fe9d002df92f4d74521cf754482f31f130538ae0af8508e70ba0015d52e38cfa9a69f58c4cfe2d2
-
Filesize
5.4MB
MD52e396edec29ed553f494a9fa6d7ce3f1
SHA161134d358330b60c4f3b891392e6923278ce2906
SHA25607cab03b601c26089b4624ad6dfc7428bff14b4d2dd9eee62a23daf3a06d5afe
SHA5128abe987f7f36b9936a207730433c65eaccbc02952c209f76f38ed4e298980b96d14ef9f4a7a749b5fa5a1b4ab5501e779634abc381b805c6366750a60e746bf3
-
Filesize
2.0MB
MD56d411d0d04b9fbdafc25296df1893833
SHA1cf4a992d3046233bf6d2ca2387147c20b83339e5
SHA256cfe0c582c5ee33f903781041ec913c0f56c6922f11ec66095ecb3f67f765857b
SHA512cbc747924f25c4238ff97a70097ff7ed681e7b6c1b2d691e2ad1835c7f41ae6d39a69bb7eec639463af31a5d70e4245a3891500f7be3a9a842adb74dafef251e
-
Filesize
2.2MB
MD5dc464d9db7bf0dda6c06b0793ff9a687
SHA1ac7b75449c0fee52ef64a3d9d1781606ff1382e3
SHA2564626b595ae44e3b45e6de1539c645806d434c42dd1dcd105e8329db2eec8d1cd
SHA512a45d663323d8ae3f3e51e11b0d30bc4845e6a8cf0bb021370a834e2f82f18a8643311002ee7f2242cf622ff6bd60aef75067b60958517284a4436946a31e5f37
-
Filesize
1.8MB
MD59dcc7b56cb6b6e2bb8320773dfa82373
SHA198c2df7a7c95c3770d0bae81d3c1583ff2b51c06
SHA2563bb3f3636ea9c5fc56838298f5a38708fed5d303af493e31ff669e86c2270cfd
SHA512b44d04bb3341c50acb775e885acb56b8b174710c440be83c2b4837bc50dc632f42ec21426a1804c2d14b608ae9eef36c8c36f984ee6315872ca2006f6da987a5
-
Filesize
1.7MB
MD520b0f811525410ddc23660a3ae4ec7a4
SHA149fbdf5914c89591193f130de2c324b9090ac08c
SHA2568cea6881d1934dd66fd9621e85061e068e14083e8b3b51fee172c7ace67c1924
SHA512f97a16e8c28b0be475b26a6573227a8e9926ae10587827ad26ac33fba41f99527d033d4e6496089a02d0680499f6d97e34e150200aa3930461f7a4561f659364
-
Filesize
581KB
MD570dd9520af4b8c0147cc0944b7ddba5e
SHA101630127eb7b3731f24ce4995fda67c5ee2de26a
SHA2561f8d521b4e9012e46ac36015e467795169f45b5dae8285df4dfae33ff342c122
SHA512ddf1b1ee739f9e05ec57be1034e001f16a73b758489e36614df5aca7d301add08a7f2958e8d0c6fc2667ac3c8f5f1c562aca0e1e6b07fdfa7ea6cb73ef606fe6
-
Filesize
581KB
MD5eaaee2fa81d923a72451d1c90227b8d8
SHA1fe14d846d174c45845e18f2d8a657e16d7da4361
SHA2563b0fad37ba02538b37441e86c3b02539cb29bda9eb478f8f0f8285bef751c331
SHA512e1ffba3fcf08f3bd01ab90f5b4eac2bd04237e69c6980311f205e41113ef42f896237dc895f0ffc7cb4e4f0cee1e04d818e7aee6e14645ce1670a88b9f060c2b
-
Filesize
581KB
MD52b067be83345826666f4b3bd33d0e383
SHA16647297026a06d766903c3aabb5beb9329efea7d
SHA256d39a3f968261beda2558275071f13033f6cf600a09ff82cf62ca42575ee2e0da
SHA5128bb4ec52c360aef73706172048e492dbe2d1e48b7c6b79a540ce9f40de44bc15e3dfa17fcd3d547ea2e20e29ab9310b9d4426ed6c5659f417fe8a26948d2d4d1
-
Filesize
601KB
MD54830c618ba2cb932698c2ae7b5423d60
SHA1d22050aaa7e0ec570382f141125ab0e6c2702c17
SHA25660f0cf3c9dd95f8f8dbfd93e30f9b82fef977dafd611d88c37a4ce120ef95b47
SHA5121e025a26ac85646ebecd034a01392ecd2cb6a43ebdaaf7ef9b288f1194bfba7730c76f54cdfad8bc256e39267dfda3801cacd644efd1c6e80f36bab54d50e538
-
Filesize
581KB
MD5310aa78e00278056f21c4bee37b626a8
SHA172ea74b9e5095da27a7250fc90e396e7f5eb92d1
SHA25698fca018aec3fe2e379ab2b73b07dde49c2167682af9be2a5fdc2d925bc9b46f
SHA5125436d8c3a824714c3330cf3e6cce979112d42da8f4f272b0972ee9a22844590a727f788425822cecb89cfd2afece45cff52d1c0d2a29c80285dfac8ed4cae06c
-
Filesize
581KB
MD58dcf218690ab2d40f68f7a268e54ede4
SHA1364d34f4b52ccc7eba80493a64d0665e6f175607
SHA25629e031cab0c57ef794f57b8efcc249096f6afb9767f15adce2b319e6eff17c37
SHA512d647154d0b00b5632dfe34d21b2eef18c92c21cf435d494b934b6ca817b644bb0b2e2041eb38ebc3bc9a5a20a7b0323c24c23aadd1e1add7c24035dd27cb28ce
-
Filesize
581KB
MD5c525f55b6264625f40d4d38016ba910f
SHA1b61ae6c5b826020c1ddbe400eb77630a6e0da42e
SHA2564c7c30e31599c3561005252b03f7693190a6b95ea19433b177492231ec5e3e73
SHA51287996a53268a35684a5b6518524b86ec86e30ff4fd7a69f9307e532fbbc39e2ef74cda2bbf2e74040132f2d5af55da3bcb99e92bac89d63763cc31ca2f9aa7e5
-
Filesize
841KB
MD57e54b06754aaf141240829275db6bbcf
SHA17e8313162017011a27e54238cf0ffb8f51ef845b
SHA2565f28e383f21af95ad39fdc2e584d47cddecd3400b0eedd78b0a2fbf1a9bb295b
SHA51217d4e5ffae51a60da48c397bf864448b41e0c30074128178d23cdb35957921cd0756a883f8a89401ff2de02e3a5f32fcf225b80b900a91bd15f8208b6daaf5f2
-
Filesize
581KB
MD5c083bbb070be150fb8d7f42dea332bcf
SHA1520fc6de60fd4886a7298f43c3ac28e1c623bb28
SHA25612e4121c67927d94392796201f229165e6002ec07c94cd2b5dc28d0b173d9e25
SHA51281045367f22ade7648d8298d2f4d65e699117a81fb6d6e0a8643969f5ca86e505edc817cfc1c97a366bfe63c377968f742f053f9958fa41bb63ff39bf0db30a1
-
Filesize
581KB
MD5531fe0c09819c406b0c29a494af96afe
SHA1121cbf1122efaedf44111eb11981de46147eadf2
SHA2561da646d356f950b78656916c2333ac9ccc2ae963b709f514ec8e7ab148afde9b
SHA5121aa940077255d308f038c96dba6943224f7224edc1703c3d56dfcb8c1277350d93cce66a4ad83fb22514c848a6345c2c96245f8f4294993c098ef1f249a70638
-
Filesize
717KB
MD57f4964a769679c990c48885b514792d3
SHA1643af6b11bb4e3e25faeba2002a1e33b87bfa6ae
SHA256c8f2170c8e48d9e0915df68e19b7370c9537a76cf545e982e60518342ae5c36f
SHA5129549825a69f093d5b6d17c6ce79171bc41ef869bf74cf07e71b363589ee99991ee5b35d7a05f3eff5ccbce76049a9cc18746fd57173b5e612231daf098213368
-
Filesize
581KB
MD5c49c69c0026f35a8caa73f844ad3b94a
SHA116f2ba97b9226c516699cdc47ec09224e7a223b7
SHA25637862967691b4e50d45ee91ceb38d338cb8d807b279f7ed4ca7404d4737f3861
SHA5127e58a756682c3f3015e50d302120ea70ab03ea8a3188ae2ffd33c9b7930139f372439127713cd7f24df56df7df1c323b8335515b60821234e46329418873cad4
-
Filesize
581KB
MD578978704bbaeab1b703673718084a5a0
SHA1496660d01f7ddd9ec5088e9dda1bbc84593c0acf
SHA256752d610640ab1999c4873518d8372cfe1e3860605e5f109a1bb29a78620aa2b1
SHA5121423bdbd4e4f814fb749be87f5e05f0d005eb7618e63377ff0fe0edaf735a949542ab7b61df2d9e409c89f70c399fbfd44ddc9814e0b2a16a04d791f18f0df8b
-
Filesize
841KB
MD572318c61fe88a1a8526fc624aa95f9ab
SHA19dd9b5fb1d8265809ce905fe25d1cd1ad2be44c0
SHA256d2c899ba0b0d134045fa91551235204e8d4cbc4415b133cf7e064c0a8ec33a5d
SHA5127d5939c6e1519a96dc6e3cf39e67628b5cbe1c5071b9c39153c30c2f018c46a9197ce945410193a933f858f9165309f1f4213a06814a24a6b397cfd63aca8482
-
Filesize
1020KB
MD511fb1d3d05fca42ffef442c862ed7531
SHA173d5bac6d52d107061fb5a319e83759918196ebf
SHA25658ef7bc8461f7b4325efa7752e107eaa33de04cf75071e88b0f12ee22bf75349
SHA512060d6bac7ed972241088b175cbbdcae70244c126845d615548f5567d276f517e612376bb7e6aa70e72b92c419b89151fcf7154a6268c21beac6df9be3f5d9711
-
Filesize
581KB
MD59b49a6dd5ab97700fbf631d2138ae726
SHA19889a473abfa2f18a729e00d99a5d39c15320306
SHA25623636df0cb32d198bf84c21abf1815cc9e9e28d8a2c7f61ac60335c53f8f26e8
SHA5124f6ddde32541fd4cc1ee7df83eb17759fb5251510ce8ea59b983a6147cf085d2a21ca47e8dd9e10cb47ae37c5081066758c2fe9da15bc84486fee87fffe25af8
-
Filesize
581KB
MD59d96d5ba27465569373be9fc54eba729
SHA1bf1b27e4bc33c91b74ee1f84b6e8859b588997a0
SHA256afd4d3609249558a919d9e697de03de6bbd11744f1117295899ea8e02e20b54d
SHA5127bcd466500c556755db9c3c1715e3a426c0183c4595df510871590b0397a716d8bcc75722c2d4bff17e2e519620052fca309e8295bf51a3e98eba52de8cccc7d
-
Filesize
581KB
MD5c883ccd20cf96477b2044cdb4b14a643
SHA10a4f410efec4a1230940466a1c0924995cb1008d
SHA256e546e9d2ded478f45d2903ecf06ed81a58bb7160dfb0b580617e06cbdc71a6a4
SHA51271548c298b40bd2d401258e146893156bc81ec29d54063f8951eed84660b1ed38a0b7e32f5555834a44cf035997b60102d8b2b11554063d2c29becfb92707dd9
-
Filesize
581KB
MD586a674df2ebe421ba38b012f0b54f8dc
SHA1845a13395e0d225af17b3b525124a0de33b69cdb
SHA256140f19f278b0c00ca14a494879bebbc0432977ed4e89e5de5a3778c41572bdc0
SHA512971d21503915141435da2823f1c0b44e976f2d602af480e8c9766ca30fdafe0d05a1227ef4722eaba311f237a1b8a41109cf952776c3e3e5d7c5eb23e929fcab
-
Filesize
581KB
MD50d9a85bc4750d88996a500265938083e
SHA1e47c9a132a70e42a669b0e4ceb682b5cd87b4769
SHA256bc6e0e01f3f948aca89d8d9e4ef0c86fa09167bc672809b4f6798924d479db1c
SHA5120980dc534a3fb744485aced10e312d488c9e8f3530ca381fbb6f3c7320850512eadd9dce39b2fae824cf61a4a59ad4470548e483a1bc9b324c1e2fe0a5ad908b
-
Filesize
581KB
MD5dfd89c55678ae2c938ee348d2c53e262
SHA11819896f64bd18afecea23ace609c701efa1005b
SHA256a666711f8d369648f5a7a5ed0fb80bf7f5e3cff91fffc4aa0961946a040eb258
SHA512becf6cdf17ee0e5e500ea15dfe6b2cb6a41cf1a7636efac9e8919033b2315f7f35d14743999483a2210f5bc422c2b443afbccf4d8f79361f4e0778440fb923e7
-
Filesize
581KB
MD5a68e92e08185886d54a80b6b6bc6a108
SHA11073cdc4f3c6ced7f77e324456c3a9969ff07053
SHA2568dfc9ab0411f1bb233721910e6794eeb4dbe085398533eb9cdd49b026605ec95
SHA51261ed031b52d2b9f273187602a87a3246e79cb7c4082e8379c863128211830f1ea8792bf4e792a3c81dafb1cae303cf340e5df53727e85f21d3129cbb42d585f8
-
Filesize
581KB
MD5077960437399b299c379d490c8273c3d
SHA10a56330f8516b18ad8487a6262b36f9fa9139c8f
SHA256cd066d25081389babc6526b7635a7d3bcf280d0ca910a4aedce9146072941083
SHA5129f9c7850b705d3790cfff50417b79b3b8a18ef647c3a9e5986278cb8fbecf93b5bd5f741bf28013788369ff400fe1f564d715e29dccbfd2640b65cb283590be6
-
Filesize
581KB
MD570469a126a9dd5631b467d8addae273f
SHA137b185ef6b4f9127018b7b26cdc0feedd9798d8a
SHA256886da8143b4c144081cb691d19a9aaef30cb984b78c4d637478ff6607065483a
SHA5126e467c6e5a2ec5c2e1eb3308156b2466c3359802924e6d1907618a0bfd3e637334eb36fe65c83e7763b8f4ba64758573f232f0f3692e747064bd552b0db841a3
-
Filesize
581KB
MD5892f0edee554c0fc3dac5ce2d3037113
SHA1ca23fbd9bc398eec41d0f21c5458c6de3a9a1de5
SHA25671d886be8db1b9bcbd10fb73844ed9303eabde9af71d65fafc8263a8eec95eea
SHA512c76f7320a7e0754621509453ae806136f72a2d0ae34d588732bbaa56126d5a4949434dbd84878a40516158aca7a0c80c2083960600cd61ee00d88e52c66f2bfb
-
Filesize
581KB
MD58f78ae57c2bebe5f3286d74ae0b40564
SHA12f604b2b66fc46ea5cc6acb60918fa5884a43655
SHA25667de633ff23706adeb1ee38e84df73859242d31b1c3f84afd51366994f7d3775
SHA512dd82af050b5899704d2b75239e0120d06a1a8f7ed79b843c3337722a5b33ee9d8bc893bae363cd16bb66d9f260cc7fca6facf5d2633609db55fa6fcbf33d6bfe
-
Filesize
581KB
MD50755010a0415f88cabc59e8e6d7126ef
SHA12fe033a96a8daaf63eca982373afb8e633356d6b
SHA256dbaffd1c37c3567707a82d8eca09d54f18541f62f4aece174b5277d67c465cb9
SHA5125f2b3ddb019f114de62b33f2d5a9ee716dd3378366a9b733190714ff9eb45fdd0a78f5317c74cf0fc7ffc6b086bb7c1a8308e314bfaf8ebec04e35004b370f93
-
Filesize
581KB
MD5ef20e6672af5b38046239ffdf0074ebe
SHA12916b0a727afc267678221a1bccc65da6bfc801f
SHA2561d28c4de4f6f985c01720978351aa8e517cb6c84b6fbd329c6ea0e818e25e70c
SHA512982fb5e7cf43cb3c404377243f603b8a3c7ee1f3ae67726a72cb7d4cd9d9f52f08d8dbd21ab5ef3b0be6feac0336c77204a2d039fadec2be7dc10d8d38f62fe5
-
Filesize
581KB
MD5b8f861a8c622756dc0dcc2d236c1c717
SHA198d2f99f2823e73bb6a35724191ba993eed7df76
SHA256489dc5301a4e06bbbaf46882273f750edcf72e49e3462d2b3c3783e5f23653af
SHA512144e1af0786fafe2889607b9f3b5a520ba2d108bf3afe796fac506de4668b0d1482323989784fb61be1218f8bcb10d673a043d0d85c12c682ca8f4b6d11ef157
-
Filesize
581KB
MD51f0162e29e15c3ee1173eaa47c13193b
SHA133925f88c5228b5138a32cc1f586b1b5fbff54e5
SHA256e6875e933a5a7f602568fbd610fb64be3559e58be63c9dbe35bfea86a7ccffa2
SHA5121de7073b5e6f21f2d47495c8500afe98ebe7952e37c4e59c6c55bbf2f4da1b6d37a11976f5bfae51e97521096d3874c872d65ff9ca449cead1d29539d3ce3efe
-
Filesize
581KB
MD510d0e12fe10bf4da3f4a895d00c16e21
SHA1f43a1f25e3fd6c408fea907c69564f5a347cc31e
SHA2568204d7499a9ebb362149abf0d48abcfb804119ff76ae473499fb0b50fe02490b
SHA512cac99569dd867c05538f78e46fa039c5794af95242d09403c80eb0fa979e8a367118cd89b4332352ca6d0e4fdc60d3a02f7f9fd0a1b12e4e8515fde6504f971b
-
Filesize
581KB
MD5d4596d23d95e49b39dc67cfc3aa21f6e
SHA11fc2be7ffd8bb1b737ef47a0144eee7120cb60c8
SHA2569a20411810e6dfc413888cd29eb07e4ba0c3f51f73b9d988d455a0af0adf9fea
SHA512390d6d3b7c5695e0d5610b9676e2528b7725ee1c4a7191ae1f54a572278f431d6b0f4f97f9e95f0eeaa457f41d465888a46af9fe54196909541b21923af1b87b
-
Filesize
581KB
MD5e9453d64801f4e62951546e444af407c
SHA1060a2e4fa063c7bc57c344aa94e294b2766cfa2b
SHA256fbabeede81df9d17ee5617e867b73cb3b5ab92db26c17721c60e931bc1211c56
SHA512ebd109369b2860ba00cfe844166ba630c4218b161243a3f41c4644dac0a62d07440a11067e2d308fd464c456fe043bb5d646f858f81dfc55d6277656b52459e5
-
Filesize
581KB
MD5a8cef7bb47dfcff024d2c9c3eb52003e
SHA11646ba9605f6e29dc3b85352b6262237cdf86d45
SHA256a477ccd4b4c537b52ecde0ad7cd5a81f8070be66539bd3ad3e84de4ada95cc81
SHA512cdfb5f8faf53849f815cd76f4313e02602bb431c42478bdadaf4db7802b389cdd5ac3ec06d4cb35ca15dabb22bc246e274f7ce637a8ea19a7bf6cfacdf96ba63
-
Filesize
581KB
MD5297392ea394069e23fdd2982f4d62a58
SHA11c9032f1a373418c2e6a310471694ea2abf07558
SHA256f66e573803dd728fb9dc6d368f215a4067f88a6702d3cd3f5fcf4a2fac74e1d6
SHA512d365f6fe3e6dc896b87da023770f199747191077919a813b470a18a804dde5a67442bb0cc0e14dd65f8d231eda8de4c4d227e883ac3a43b095a4600fa77d2107
-
Filesize
581KB
MD52198c11f97a9969aad5273384688437a
SHA1b0665db17117b41071890267bad799684bbfd7a5
SHA256b3f61550882fa2343b949a438716682ded4f049889994974e1a6ae49dfd8d984
SHA512bc8fffb1dac3cc5b154239b16a4568e7196b869ff584aa6681ce88175a3b40353d2f71d130c8eea74595f902351956c3d7e66cc1da06f35166dc69cf042913bb
-
Filesize
701KB
MD5ab273f0e00694ef7e6fbc24c5b775954
SHA1ce638deea9fab786d64f31d96d7523bec1bb3015
SHA25634ad656780fa34ab5eecf6221743f89a4efec4cff02447ddb3833e90f3a97273
SHA51286c04b052ac238311f4d26bdeee617294ca5215337c7db585ac2229e86117ec87e183f4ae1b85fe324b3afd4559dbed61c22d24ed05dfec6eebd4068f454a1ea
-
Filesize
659KB
MD5380280af2f694b7b09eec3f9c4f1d06d
SHA1ced679c7da757c9ec58b999751973754b81131ad
SHA2560c9e611bd1a3aca472d32b65b98709bee98c552f0b7abf1fd97122ee18efc643
SHA512083c3a977ce12eb8f1a62bcfe3e91db376d67b8c9f64b40bde16e378673c4ef66da4cfcd7a469ad612968c5a71f6c35658202853303f0542f5cbafd71e567abe
-
Filesize
1.2MB
MD5ff2188aa64bbf2fc4b8e6122c6da43c9
SHA1cd38c03c392de914b11305ab78d708211cd0cc09
SHA256d3e4b9d55297476f5b18ac08ac8621c16afd39e4a4777b09a36cf9b18aed5cd7
SHA512d99d1fed8e1b5eeb9a9dfc60a5b852c87e172ff1972c44783aed921d879128792eed5378eaac7d3ef25b05498cd32a3cb5990f58534e944c54c960fd3cebacfc
-
Filesize
661KB
MD533683863eed573bf937610853ec9a9de
SHA1c3da6e2fd3a31b9618714b310bb4ab657405b392
SHA256197f482aa4f24ba49c0fac6f546ffe20cfe7bffc5bce5f407ebebaa117921fc6
SHA51263d1b315ac7093416f0864e9d68ac1032facd361a4b5dc0990e5a43669785314c614bdd0478707bfc07d0ce9cf9d41469aa7bd7535ce50a364ff0951cb1063ff
-
Filesize
1.3MB
MD595523a1e474b274feb4fd5824c728db0
SHA149a92939308a6ef52f825fec5865ac59f9b2544a
SHA256183ac46e322cfa98ca947e3cee3e529eb3ccd42a0a648080e1c1ebdaf9424171
SHA5124cc4d322ff3f6aacf47ec24e2929f34dd2aeafc39586b7a639fd8a41f2b8ef4ee7fc4f77c1ad25cd9cea1fa22848b8428401ecdcab4813e8838093c84c8cea5d