Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
05/07/2024, 17:25
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-05_1f57ef6b1bbbdf8f9e4e987588db3b24_ryuk.exe
Resource
win7-20240705-en
General
-
Target
2024-07-05_1f57ef6b1bbbdf8f9e4e987588db3b24_ryuk.exe
-
Size
2.2MB
-
MD5
1f57ef6b1bbbdf8f9e4e987588db3b24
-
SHA1
9532f00f9c9e993107e079ea3dcd2d5752681e9c
-
SHA256
3caa4d2fe49443ab2e0b823964f9736b3894df204fba424ec145e1dd36e1df23
-
SHA512
c9b786ef743c16c45ad08681dd05f82d2fdc427a3b818008b8e41fc4c67f45fcfba74d05c2c1bff857e991c602e86bb31532860feab850bc95e8eacb0896b7c8
-
SSDEEP
49152:iOOh3aN4kuLbegmtGbiLlBUKubZrX+ld:EU4ku/ctMiBSTZL+ld
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 840 alg.exe 1040 DiagnosticsHub.StandardCollector.Service.exe 4392 fxssvc.exe 312 elevation_service.exe 3400 elevation_service.exe 2900 maintenanceservice.exe 4612 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\system32\AppVClient.exe 2024-07-05_1f57ef6b1bbbdf8f9e4e987588db3b24_ryuk.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-07-05_1f57ef6b1bbbdf8f9e4e987588db3b24_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-07-05_1f57ef6b1bbbdf8f9e4e987588db3b24_ryuk.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\aad5ece392844182.bin alg.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-07-05_1f57ef6b1bbbdf8f9e4e987588db3b24_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-07-05_1f57ef6b1bbbdf8f9e4e987588db3b24_ryuk.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe alg.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe 2024-07-05_1f57ef6b1bbbdf8f9e4e987588db3b24_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe alg.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2024-07-05_1f57ef6b1bbbdf8f9e4e987588db3b24_ryuk.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1040 DiagnosticsHub.StandardCollector.Service.exe 1040 DiagnosticsHub.StandardCollector.Service.exe 1040 DiagnosticsHub.StandardCollector.Service.exe 1040 DiagnosticsHub.StandardCollector.Service.exe 1040 DiagnosticsHub.StandardCollector.Service.exe 1040 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 656 Process not Found 656 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4828 2024-07-05_1f57ef6b1bbbdf8f9e4e987588db3b24_ryuk.exe Token: SeAuditPrivilege 4392 fxssvc.exe Token: SeDebugPrivilege 840 alg.exe Token: SeDebugPrivilege 840 alg.exe Token: SeDebugPrivilege 840 alg.exe Token: SeDebugPrivilege 1040 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-05_1f57ef6b1bbbdf8f9e4e987588db3b24_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-05_1f57ef6b1bbbdf8f9e4e987588db3b24_ryuk.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4828
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:840
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1040
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:2784
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4392
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:312
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3400
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:2900
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4612
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5caa5175763df37416d28cbd66484ff80
SHA12d74f123e541ce4457b32b66a5c2fed5cc772b28
SHA256eb1eab80b48e2d9373fe50e94b564142cce43aadefd31a70b640dca331276ac7
SHA512d17c5e4a3da3a05c59f9a9bb187123e2ca3c338a021f25f6465b46aec6eacc4f2dd0e90c977a0f02993f6fcfa6bd66af14f7c574ebb7b3aeb8c3c60443dfb3b8
-
Filesize
1.4MB
MD541e4e87d1b63d0b8941b4e78b1e068c8
SHA12d4acd84fb16ec6c8d775e450cfe4775d7925d92
SHA2565868e41dfaea8f45d738eda67af0605cd904ce798ce3cc5957018afd957df9a6
SHA512125496b847378a536e2f22807cc86f4c85b3f06113be1634361c3b9935dbb65c1a02fd15ea557556bc67b1ab7f00a775e8ade806d2c6c9365bd316528baa1aba
-
Filesize
1.7MB
MD5d19c0eee83e890399157bde28e3df141
SHA11bc25a4e99928fd9fb35eb2ad20e1d28584efe75
SHA2560ae0214e19032243b4680e29b1c564d8ee87556cc18ac48cf151402c35a83e0a
SHA512afc7b923a0bd99ac8c147ecbaf230a2edcdbdabbd164ce728e3e311a2d144093aab41e466fa056f66b677356f5e44d62122b8c5930b4cd5dc50a0bc896e7ee70
-
Filesize
1.5MB
MD5a6164b7fc4969f9b99cae9b767193ad8
SHA1c53f6e732079e59a33ecb369999d4807871deae8
SHA2563834adab9a819ba53ce5683c40ea7bb3f9ce22066a521b2684bb85b8c1465aee
SHA512dc7797d45ccbadff7031933f3e2a687542665690221770fa5526426f918fe8c7d41323061a34f7cff4ea70510cc89e4188f62093294b1881af5dd6a71d62e4d6
-
Filesize
1.2MB
MD5908d5dd91b53856b051fec9190e3de14
SHA1099e2d7fc1b52d73c3aaba830a7cea359dcd97a2
SHA256818a24ea651c464f0434f6d06a4ce50369b98bb13270c944d18100595a674ece
SHA512b8bff2ed7ac852b7d0fe1f916d51e33bfa9f4dcfc22518c750104995e1052b122f7ea0e6c26bc944f175213640a50ad0a84209400369b95bab4ce510a72a8cf0
-
Filesize
1.2MB
MD579385b439d321d952ea5d2f011c80af7
SHA1a051d42f2859d5a8f4fc4261a32a6197934e2c8a
SHA2568e644c6376a0ff4ec74eaf42817cfdd9f70f48bc8ae2b9bd494a3d69485972be
SHA512bf580927496b95daae28c2a251870e93e466e89a2f1526423d5204cf55510e32ebed3cc7327f6c43bde2110e20c6b42d370c80d9bfb4916fbd67b8e29e5eff9a
-
Filesize
1.4MB
MD54f66538fab3512461aa30d8ce34eaff3
SHA153599b8400284f32f817dfe7eac4eaa8998ac7b5
SHA25657da072537899e3821be626b9cef49dfe54a340c95d646940db8f06748d0d54f
SHA512863a531ab683c9f25de2666c97db75b1f0d3ca781056554adde8920ed1d5746536e05586ea70dd5ca769408454588fc2cb604bea1f71d08a2b1a936fbf327f4a
-
Filesize
4.6MB
MD5d1c14a300ddea2495cd8deea3c7a4a7d
SHA192924bd4ffd8410aa1aebe8b581bf8092a7d77ab
SHA25679b162e80af61af3fe8138f44bc45c76e9c4aa5046e3241adc7b68a1df1a8511
SHA51200322997a38d5f41d1c42825abd52c6ac6eda765025d1e8340c78a961f6e43cbb9db0ba59fb24c67df71a8fe78fd6dee7f6ee0a1ac199823b9b7027a178877fa
-
Filesize
1.5MB
MD55ce69a90071bd6f7e15c346d61fde517
SHA166243841b731c10ed276a09452f85f198d055973
SHA256848ca780308ac49d3453a04b4c37a5350372e4e8785e6cfea810444412c183dd
SHA512aaf6a629b011a064188162121feb283fa1afe3191de1a5419952207d0f32400c449e286a7622f63718f9dbcd9c13cd1efab1c17d4ff669cba15c41857a356e6e
-
Filesize
24.0MB
MD52e6b0e4129c6e69eddca64a1a486582b
SHA1dcb975293bb1e794541a0874890361b56a6a3613
SHA2564c58777f60a26ebec319af1d417876c9262fc015216b07ed0c08846b20797567
SHA512488e78529a3192cec09d10e247e6c4a8e2c381d2da8f8d3be93712ea36af3327928330333fd407de674f7ab5513487511da962fcddbaf4c4d8c71a986886d0d6
-
Filesize
2.7MB
MD52fa82ae0bc8268cbacd59f61df3b98a9
SHA161c34fcfafcaf994aaef3e1014e53773836ba187
SHA25683a4ca0182b4761972c2f08353604c903ce50af9bde89ccafc33dd61d85c23d9
SHA512dd0ad781b21481a38748142513ee40f9f0bd117cff0ba37389483baca4b025a49a6685a340b5d1c578116fb8a4a9637f632525a8d0762e1fe8ce860f7c72c433
-
Filesize
1.1MB
MD5c1974b6f42e1c8ec212dfbd9c3c1943c
SHA106a9c4015224197e30c9f5feaffb1d3f2ca62da1
SHA25661f56a2213376de886d92ab2990d9bd4e5277e83925f746a6c853902b202a550
SHA512dae0d0ea4eb816e6cf8a87a108189e55284b90fa90122438207c73cd69993f7577e32e2c2ad6777ab41ddfd576f54a762d899f9fb49ee3d130743f7da3fb2606
-
Filesize
1.4MB
MD5c895266333a362092cd20da378f57520
SHA11f6ed08b02fb11fcb05a84ee81407830c3bca44f
SHA2561d9ecdc3603711c2479419c58358f5688930b1e639f053c5bdd1037512956043
SHA512ffecdd7feeea42e0b4773a914051943a0e4480388ea5bc1a90da82720cd394c4958e636122083ac27eba6b0c808f58f6a0c27e18000fa56513e48830f7be9623
-
Filesize
1.3MB
MD5b00d22fa4630b8ddec9194313974092d
SHA1df0819de9674d8d548b685c578d3b0a755caf8eb
SHA256a0f3f491fcdff9f889158dbf73a45b823652a7a7fbd83cc47ba11cbb127ad389
SHA512b2dc701d380ca9a2f72f370d24391464597b1ffff361e0c09398daeeea510ca782d53283a58b634c65b25c89ca25c4e07f2216231e74f796b85322132565bec8
-
Filesize
5.4MB
MD57fd7b07a0979e9c468715fae24d9ef0c
SHA144fe3b38bc68cade6981fce7edb778d055f339ba
SHA25606460dbaab279604cc1be4c46595553d93591c0b2d3d7535239279f7b7dfdc4a
SHA51246a287d1dd0b72cf9f9044f377a39ce92b074301be1dac3ad933d6c34410a0fb81f13c01306fe96fa274a56065d261a58a4041937c4d0f74ea88ef1d2dece783
-
Filesize
5.4MB
MD592ef039def819018cc5fce1b7e2e99ec
SHA121e05402e11fe6eebf564fc47419fdd273338034
SHA25660c92ccf5d7614ce62be6a63d818cfcc61fec466602c325dfd59dc68c174574a
SHA5120b48d91ece7e021efbc27d44f26409185768b43e28cc0ba6e9d789d8ef49a16e9ddec58eae93d0614b9b2fa246d31a099d68146274bdb9692fd68b7d35f0d5b2
-
Filesize
2.0MB
MD53585cf7390833367a2838504a01e9342
SHA148ec1fc5cf9b0646b4c16aaaea7cbaee085d85a5
SHA256fe88ff7154fbb33c33cd9d5ee2f159ceab85fe2f9eaac89eb71549f8a7b4ce57
SHA512cd1890649435cdf35a885ab82848e8d8d867defd57cb6e8e153e09d79af2a99232a598d7c4ee9778b3d95e4722bd80219a68a13a732a85fbd7ca9e14bc6e25d3
-
Filesize
2.2MB
MD5e2b0d03ef94273ec663e06dfddbd6c7d
SHA19d651c11a95ae0ec8b77873d0045889bee739d60
SHA25605adf6ec7aa3205544258a180a1c5858df8f276fa8cf36b780c4630b3c3498d6
SHA5121889dfc7a6d0688c27b2d7f28abf1a9be957c7bd55abb5d34517c0ffc001ad49122f633a912b873971106d2e61c07fdc925488a09a7e4fbaa1933e82bff1022e
-
Filesize
1.8MB
MD5b1689baa25b206a2dba2b6d5fed95ef5
SHA1d41ecff65ae1b326a4914aaa2c771a9f5668ac0c
SHA2564555958f484c89305480e7bb14e5bff2c37fd8ec5a4d659ac4e43e353bf9089c
SHA51226a44918cfd1b43195ee055a642158c4f8e95a418623eb5c5c1279005576299bb930f530477651fef896b08f78b30e0b68dea09043af35222917de5f478eeb59
-
Filesize
1.7MB
MD583cbbcfbb574c634a322f34dab655937
SHA11e00164b0ee8f15deb9ffef3cb1edc11b417c257
SHA25685671f506d7f94e0c88cec26073c271e2432ac937a3edaa5944dbd50bd667b94
SHA512ad53b6ebdddc5a6dc543951a1d2a395caeceba9d04e267e422bdc4c83b13a93b40bf7db8533e444989bef4c2c8acd7f17b3ac0240c85c7868a76e999236c1f60
-
Filesize
1.2MB
MD5954e4c24a8d6f2b554a21b2fbf88f1b8
SHA11ca2c6d56453309fe01ba22c77d5706b4c66da3e
SHA25628682e070b25873bebd9a3c2046cc5fdce331346fe8ebaf021f371d1c212199a
SHA512425962573212611137eb41a46de3f74bbd57c43b970ab6502ece37014892f302c7c9cb5d3b061202ebabab7e00e8745acd6563682f9dc96988cab33d52a385de
-
Filesize
1.2MB
MD5a3d57a3773002a943ce11e1710e16136
SHA118e373ac045b2ef39d2b7ba26dd02f4b73c65a2f
SHA2567666c61517e1bc22ae6f2cc748c8223936302138c873a192ad500065f9a70844
SHA5126e16acdfa11a8d662646dde5a09a1ffcd0604b4ae327f1b52e961f877d5d7813d5c79926cf5780f9639677cc7dad10c4edb7677b4c08f9349c05528ea794a13c
-
Filesize
1.2MB
MD5acb5fe72afe9b12d891cc89b7778c265
SHA11bb2d26c1244a226b0a85043bfd141c729d78ecc
SHA25618f69fd98597970faa59dd275163929dff540c6ccde1695d4409a9e72abf871f
SHA5129172a0b3abe906b582153ed2278d2c8251b49f23a875ed6c2b55c0125a3d9b5bcb47808fbbc912b46e248fe5c8f0cbe5cffbdca24b9f2b7bc8e7ef84c287f172
-
Filesize
1.2MB
MD5b5c16dd9c2663cb6afcc98bb6560f236
SHA14ea36b9d017b3c57ab0c49e65e576b3ae9ca44c5
SHA256b4783c5e0a2948507fe613db2c87b4144a8a5e4a117e77ccfe0bc9fba0018279
SHA512696bca8672bdd25c06c7f6c405cb3928622316e7c6fa6daea3c365d7f05d67b0e1d2443b9582c8121a5199d2f5c5bf528a3057f5480a5152b69e81f21692c6ab
-
Filesize
1.2MB
MD54d514fea4589e9cd8f19be1d667c785d
SHA19bfbd37f1ac92e54b9564e2cb68e1f79a172ee1a
SHA2567a53b55518ed105433472d31c45d3598d9eb9f7cce6ff4153b76f5a5eb93491e
SHA51218dbd3edde09b07b5bdddf9e0e310b9877f9be47fb3d26bfac4084953fe6c896706680f7e4b9b0e850fa2ee65afb1253cdca3d470300c777228cd01158c97471
-
Filesize
1.2MB
MD5fef372d5f329fd2eca832feee4a38180
SHA16e330abaf21de73627652aecc1d7cf6657ea5066
SHA2561d43595fca92e64810ce2a58afe57aa14484c7794d28384e4b38a19f510aaf72
SHA512a9bc6f97bfcb04d747754bee90015813bdfd11c586945b4c2ee4452de2a7464e7fcd550cded08f0b5c64c7ddd3d3e8755710e17e95e7875910d069846aae4411
-
Filesize
1.2MB
MD56a49be0859dffbe1cd35b329fb01dca8
SHA108481c71dc44ceb18e5daf58739ce4e964f62669
SHA25682fe23e3c5a8e90df08d469f697255bf90ecada918cce70fb2d1d76583f4d4d2
SHA512c870832bf8a156ae1b7956771c29dbfe92ef190ac81a8622d576f45836c449e2de1146ca038dd9cf0b35a9bc90e73b4be84b36351ada37c088238b1ef61646b0
-
Filesize
1.4MB
MD50c87a509b8dc21edd48bfb815151d528
SHA1b773c16ee1188ca47e9ed85fd21da65d950d36da
SHA256f8bc80544099c87edce5b41d8a0d881112baea2a6cc50e3967d1193c20b778a4
SHA5123b786f481983367e2c88b75728c12c6af64a067a7979506a5e41a856c5a557acde04dffd19691a0e34aeea47be673e8e755b0ff36badaa7e9b9bbccecc884f8d
-
Filesize
1.2MB
MD57ec7f6f6a9c5b3986688e3530592a143
SHA1fd378adae5b84b4f1e0f96c83dfe907c2831bd99
SHA256a05f337a8ceaf3dd4f9e329af8e33a080bf37e643b446f9c230ee42b839514e3
SHA512bc02803637b049ddbb2bc4f5aff8671c0cc00b156ec6db666ee65b71292873a4af7f920e22521189450579b47e040f5cb770111c6918775a68a9a1ced9eb2bbd
-
Filesize
1.2MB
MD54c522cdad24eea5b15467a2cbef6efcd
SHA1c41307299e10b777d493f9c115b74168d9e2e732
SHA256be98a035bb666b1335b3643814016d33cc515c3a06b79cc53dafdf517e63a8d5
SHA51208d806e2eadcb028defe5eb757ec028ad239dfe7dc5d24c768b1ebe7cdd23ffe5a1f69472f37e98b4cb51432e5eba1072700f9ccaceab9646619fa9bfed78dd1
-
Filesize
1.3MB
MD5c53530251a9836ab61bdf73ff5e76cc1
SHA17ba226fe5aa39bf46a4e147005a8e88d630493f4
SHA2567d25d46eb1b6fc3b94209783b650f8c22cd48e8889aebd0a7d1a6d4af38e313c
SHA512d239a6f0c7b2e8abde9d812d6aca2e909064100856abebc56d8d5ce9ee9815a972876188cca2b07e14df8771199f1f540a9096a956cb1fec41f7205df38f3d51
-
Filesize
1.2MB
MD5e911fdf1abe777c84a4948df605c8dab
SHA1687dd65d620326043eed68b88656d8e5567aa4e4
SHA2567b8948fb3e40ba9111478aa298f88e4c76cdcb732d67dc8004ba0df6edd6e283
SHA5125721a4c9003acf46f5f034defee37c579f78ed14d2a9a7a28e03954babff628b83916ae3da0f0a6256a67621882b98676d7ee10ee75db4399d6687054992dfff
-
Filesize
1.2MB
MD570b9cf903fdb426befb438eed8481ad3
SHA19b831d7d6b67e348076361a7937b959d0de26eb0
SHA256d7134ad79a2ff58f04e4234f9057100230e689564b16cdd41604cbffc0a18240
SHA512a158a5aa48a81463896c41696636e853698d7f99094ee8c0c7c1e3cd25dc9dfc749ca5784bf77db738f16a5c5ec52afed969ab1bfb4c33fcef6a31079dd3e486
-
Filesize
1.3MB
MD5f8a4b6b4bf25ab7c42d22ee462d4cfc4
SHA1a34328331476d5e283c3accb072f81cf08610ca5
SHA256db5ebbdde28615ab4a1de4bc69809edfedc6c7e2fee81d15dcbab9a7b49772a6
SHA512774d5d56bcc36b96d5cdab772af8991bdff4b03a562989895c5ad10f494d87bedcd8201befd8fbda3ebd2ed617eb450e01bbacbf920b0f02b4fe9c46665bedda
-
Filesize
1.4MB
MD5d2cb990c2b12a6981c964d6feefc905b
SHA145f7346b6c8ecee824fe3d1f945abe88aa3f80d2
SHA256c45fada0a99c54e8e5e089c6523cd1f178a2a5beeaaa986df985817b8923fd17
SHA5127f497ecec6ff88c958a9dce403aa029f5536031b08f086eddfe80de7eabfd52cd047283ccd62f5812d23031c495d5972bc7e9df9f385906c05843f69a8712270
-
Filesize
1.6MB
MD5a453ca24111ce6e11b3ec77f37b9f971
SHA1a00b7653f729fcd1f1b8fea9ee5d9fb56a678363
SHA2567ead474aa67ea55540660ad90b2615934e834184af25972827a5dfd362abbf4d
SHA5126e878324746032e1b86016f9d2d1173df1b1e6ae61b6f372006322549f93e1662d3175b52076f2374d2a32e22d200ebbf276e20c9c711a50e775b85ba96d9520
-
Filesize
1.2MB
MD58c61a5115a8ac4186239298d820b1e0c
SHA12de6d81d46f43f03f4ae5b661841b1d9e301e7b6
SHA256bc62300b9aa4d4bf3744455fe0d458132b0d2273c95d4ba8dbfa740e84ff882e
SHA5126f69fa99857d52dc0c2ef93d37fc5bd59217f7bb081bf9876111fd098343bc404607de59361af57302161ed683b0794fd4b60f8e640db8dcb74bbcc65fab5d0a
-
Filesize
1.2MB
MD5802c7db87287ed3e1f55e011b247abee
SHA19af85dbb48b058f0310f079f56608faef138094a
SHA256221d02c845c8509530051a43a4a2b921afecf316bf3cce531c7f82e75f210a79
SHA5123ce0d843bb01f1465dcf464c51071ccfac9c84857267431e48c142135363102d5cc167a0895691f1361aca19fd63e02dab742b4f0cf3ec981ac3a4ead44f2e63
-
Filesize
1.2MB
MD5c763eddf3a7d5a2d68c249881686f3b9
SHA15f922c26ccc725f16b54bef06f5c8a575e5267d1
SHA256c6b85547554febac3df55f896c789318aedef6f1e1b47321aa0e255444720a53
SHA512abaedcb22951b58a7c7514015f3d449f1fc6c7f1e674cd2c5504aae2c9a4caf2c4f44b44f1774dddcfd97ae0642ba5c55fd7eb3e0288bdd14ff9b0747494d038
-
Filesize
1.2MB
MD51d1758914180df26c57b86a7a9065c13
SHA1eb19e8a96b7cf555b8b2734f779a4f537806afef
SHA2568b4eac4f6d5128aca35faa231e7e41fc48a6f5e2e504b707e8aa127d1a79a507
SHA51217325940539932fc1f5da1a3abf6bfd143c158472fcfc246161fed0678cedd117437f5a29b0bdc651e7f0306999d36254750781a7ad48a614eccfc58e31d84f1
-
Filesize
1.2MB
MD5d5dc5facaf00317717b2417c1a92fd06
SHA1ff778c12ef3f014ac6bab24136637f40bec979b1
SHA256f40f2ce10a96401903b5be0232a18fe7809adb17496cee49aebfc5d30cfba148
SHA512cea00384439bb2a727b79091a378e8e9fd2ebb0849ad19883364b627be6694c4389b78e89e70507cb650c22df3f5b9f26628bf20d83e76e935d0b52f60859908
-
Filesize
1.2MB
MD5891c5504e5b56cf8ade89018a5cb045f
SHA1b388c4e46f364f851d3e5d4fe81890be9de9b72e
SHA2564121a58e37481e9e90822dc914f761d78f9bdbd4e525a428f6203df8072e0048
SHA5127f56edd80d73df5da0460647d772e02e182e7f374453f79b35d5b0227ae061ce292ee46cb2698608609511d9f33192a90191495114d610dca19659b0a9bc9006
-
Filesize
1.2MB
MD5d87a621d24862839de7bc4c6a05fa9c6
SHA166900683f44c2ab4b4e4c008d7e8962aeabc5ebd
SHA2561daec5922fdc2a88c14612190142536b8e8f74eae4baf66c6d221b4883e888a4
SHA512fc1b984a32a28de914b9942c0f15600c0efe5987b803dc03020a12f29c280add928376174c206beda06825612ec486418d420bb1d2438d3a7e95b49bc7cb9802
-
Filesize
1.2MB
MD50ddcc02c21a10a0f4c098657eed374ab
SHA150f27fcff2da0703b7cc34a2a317d58cbfb16196
SHA256dd6f7bc6a24d30e338b99505a3a78af3a3a55a73d25153ec18c51591bc492f6e
SHA512f133b2c8510c7228a87b534a58f18a3782c91094aeb70cc1f4d115a83387a280046c0f48f5aa656e66b042e3938d142b93f25243cbe7dda11e9f2f6b09e45b38
-
Filesize
1.2MB
MD526ec0e8565de8f24f65d7cc8d968bc13
SHA18ef7b40a3fc8931d5d442d40d3283ccd6a7eacaf
SHA256f2f0edc9e6623256c1c035852b500c83b15932910c4940c601b880662d6bd36a
SHA512bee00a31c1fc70a01239f46dc2f14653fafa00bf95394065dd1db2ff4368deb6551f9a0208b6af0d18c27390d64e942dedf80b590e1f76a25a31c1d49a2e752f
-
Filesize
1.2MB
MD54a242804fc32ad28cd9f607dbba46f93
SHA1e4bd042309d184f443577f5a3e49c1303634c9a3
SHA256f790e2e0a7a98a6161d5a3d1f06d8326c93f9ce5f5665047d3c767ed83db1bf7
SHA51276a0a303d1891ed49147ba16aa7ba432c2ec6de7f993e6aa5634010e13173f73d929341f3e91c059befb91f4188ff412d621f36883dc0f1d06dc23278d33189d
-
Filesize
1.2MB
MD53d1b057957d9ac03a644d58212ecdce8
SHA14483d3a683ea606c269d25a7de74dba3946edbd8
SHA2565cdd663ef4b70cd98681839d2b1907716118f63f496e14d1d445cb03668d93a8
SHA5126a8b75e0de0078de4c4ed574e4e6fd185eba6a779ef5a3faecc1c7755a1952c676109686add1b04ebcc03e8a39122bb847b5df5347589eb1f6ec82f8d15d5a2c
-
Filesize
1.2MB
MD5195179aa844e1031f670031d5a7fb6ed
SHA1057d7c2251357e418e2362a18b167ffef57c15ec
SHA256b623f5fbd5edfbff9b109043e50f47331191f309ceb265b5182923563d5fe158
SHA5125c43222e80e9affc213aa8bbd7e7795615b69b1dd03735a5aefdd2e57a115ec111eb88a117e1cb8556ba178f85a97107b02209e1d06cc0d094f8a7bd86753665
-
Filesize
1.2MB
MD50748e66c7046bc861ec86b7e092408a2
SHA179f030cc06603a29351104b1ec97fe023af6144d
SHA25669938aec950cf8b6ef493d9f5f503f3fbf918e8f8e8c0dfebb14e1d55456d4c6
SHA51287e25f310982285750b05f790d9c05180ea7bb4ee75fac9058abc925d4cd21e5c2f6b3d5d2ff65dd9f40b2e3b85f863b3dbd2e016bbbaaca1be445dd45b118f1
-
Filesize
1.2MB
MD5b144519a80edbdce2085063090dd4768
SHA1cc10489ff7581a1639448a2a96225bd043757647
SHA25614e95d6ec85bf3122d198ce1f246a72d1647850787ca4c74058a67534f2d691d
SHA5127ba8248b1d9f3a204f625e3519833eb9e20df275ef0d5565bcf3a775cc3a35bd3a9b8168955dea19bbad7ffbba9f981271d88444d974ee265924477c0253b428
-
Filesize
1.2MB
MD5f7f73072bc4ef7630e60e083611b5063
SHA19dba3fb948679202c6a6c5793994968b902e2244
SHA256360a8972aeb3702f50660f51cf1790065f1ebee5f8aa12d41d40f5a15769085a
SHA512afe2f5ecd21362e119f1551f83049dd19eef728457be26bf258f7157d5a207d048c4f054d964342670ec6ffd12da2b3de47692824d92ac93294c706db82f5e71
-
Filesize
1.2MB
MD5ff22a163181dfdcb715a0daa459eaffc
SHA199cac3def88122d38d75ad718b9f0f8debc880b6
SHA256fa8080d161b5765188693eecb00727cb167a6a352977bcd6b97b8068ed03f735
SHA512ac2e9e38e5f4e14bac92c44cba9eeb9b98ebac08d166e90de4c923b0b2997752a68acf1822d58d78fd579d0f7d0063a149049a422af04551e5a5ff1a4a93eb62
-
Filesize
1.2MB
MD567c33a17c77c0794719c05e4b57ff2b6
SHA127377ed4ef5fc925e695994759eacf1ceebdda7f
SHA2563e8038357ff674d1f2cbf54b0e3e699b6be9a3ec53962495384db74e6e157eb3
SHA512cf5e93a4d7d7027d30d82328d14b50579b3eab757ebaef5c75a330801c3781e91fbaf02e1f78b8c8956622125298586445f839ceae9c08acc85ec3de1d6b6687
-
Filesize
1.2MB
MD5a89272909545ada18b01db1072248b4d
SHA1d41159ffa88cf6e9ee0aae5946ce7534ffd55040
SHA2569f65771632dcada541a75b4209993df4f200574895d2bc0186149e7a6bcbf60d
SHA512b8f3925352591a9b52c1865a4af5622b88da2d8e1f664db8783edfea1ca3e556f1b01df6e11bf1ded91282c3ad35bc1f6281c7225ef894eca8a64803f99c1119
-
Filesize
1.2MB
MD5b0527ba30bffa50af9eb036da2fb2435
SHA1e5ebba42d11b549d7530f7bdb952bea9bc65073e
SHA256d832e2eb09f6dcfaa0aa852865baa4ffc96534c91e3757f22f87bcc7aff026fa
SHA5124684c7090a25fbe9993e198e8ed78a64209ad63b930b3a7af5c3fd0da0d5faf2ebe77bcac2622c96d1f97363f9079ff2b0d5ca72d98ffde7acd3f0c9780a00f8
-
Filesize
1.2MB
MD54e7c8440f06982a22cc372883b47d04f
SHA1986aaafed6d3f2de32845e475e4dcbf81e0a2523
SHA2563303c29d9344570b1fc948ce54e8d0748b1b8f3ae48c02cdd75f437c8f8ece88
SHA512b144924be1f0893b7ef97e15a51a3381c1b721c10a7bcf7b14528999c5eaa4bf57efdde1bcc0ca40fd3c7b9e8a4e39be21dd7f8ac51fb923fe15b4a02cf25bd0
-
Filesize
1.2MB
MD57aae917e73b399c431f5e6be841a036e
SHA16251a6c04aa5299d92a1bcef87f31a1e0284f8f2
SHA256dc86754041b43a323f097aa538ccd778e752efc059063adaa882e93064ba079f
SHA512e7ed9ce2dd7f64f8f9cad43253701895dbffe3d8f80db11c921ae6b683678e1864945793e76cb0930fba4d3a0fd5babfc8d31450cea190776f767520d38a1ca1
-
Filesize
1.3MB
MD5c7b166d385b2ef69b63a1ee82c85d5c5
SHA15b25b7b541a9b00eb170318261f8c34709b98d6a
SHA25615b40cd96d02f5047005a095792897ffb7cacc54dccbdc356c8741869d7f1077
SHA512d0fdfdc8be28e5b6d5a631bb520ce99a04f78edb35566620d6a0f7f6fb59fed551779f3b36ae6618ace524b3bf70fb5168d0078bc41f48558637428aa0da39be
-
Filesize
1.3MB
MD5ddf927acb6d86ff0d15726e95c5d6483
SHA1cc2f2ddee70213699c458564560ceb33565ae535
SHA2566dda48fa6e3c13c17e30a0586e2fb727ca8b0f074b3f08beac7f8d010de9ca12
SHA5120c4d4546fb5b72bb9bbca64ed426f7ad2eae8e80eb2d335bd9d72088eb81fbfac058fcfa6dbccd78d41e0cab8363c0ca381ee7533fb24bf99dac66b91af5b1a8
-
Filesize
1.2MB
MD54b8cc66408d5af1e86d48b66b815aa80
SHA1bcf9aa4f82c381b83490a9c6e005e49c73c416c1
SHA256fe599ad550412bf8d9bb198e5f2c67a3cf78e16383cd8c7b387fa06e123fd5e0
SHA51250860dc916cba91bea3882e4a881f2447e711773b699b0f1de00432a0a0e09d11f68616c5d8c7adc3f8509e2f68b167fc343761945f725a309ac0922a55b209a
-
Filesize
1.3MB
MD548255fdd89ceaf69ac8aaf63f72cb83b
SHA15dab637c516fe917fcd10b8c49c9293c8476377c
SHA2562e7ab50720ae6f9fb5b7ec05f6918517c233f57583bfdd5a519ad4f5fca63070
SHA51200f56f860eabe3d6d699017699b9d3d6a632232735bd42d6201480f581a8f0e19648740a4bb3ebf7abe57f489e1ae230f9d3693359a39ff4659e979e01809ef7
-
Filesize
1.3MB
MD50444e9cf8a3d8c9499c7742878442740
SHA1de45ea24f0c9f7796cce18bfe4dd674264c9f2c2
SHA256549f8a9947148db2aa19ba9b2278ab6cc868fca448d407a9ee7b0938b32388ef
SHA5122cf5d3cc7048d0522365ecf1614a614f2e76867239aae6a77f9211da78899211e1c23f4fd51dd31023ba1316a866f83bc49e49d4cf825d1bba20fea76b910b2a