Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
08/07/2024, 17:58
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-08_45ec7fd7acb872c321b843cdf0331846_ryuk.exe
Resource
win7-20240705-en
General
-
Target
2024-07-08_45ec7fd7acb872c321b843cdf0331846_ryuk.exe
-
Size
2.2MB
-
MD5
45ec7fd7acb872c321b843cdf0331846
-
SHA1
ab781150a6f34520ffe4aa9d275fd1402606638b
-
SHA256
c1e30c7b2f66aeb9446594fc646c59accb8a51cabae781ee206c1edf7d63fae6
-
SHA512
04d5dcd0dda7a441a35eeda8bfc40b262c19aa0a0c4a8e8ddb3a7e37f515ce9dbe68f7dc02f627fa980376f1863c976da314074c6f103fe21fe4219845985740
-
SSDEEP
24576:XOObVw4TaN1wdkukCba4oXtgLhU3wEdmh58dSkQ/7Gb8NLEbeZ:XOOh3aN4kuLbegmtGxkQ/qoLEw
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 832 alg.exe 640 DiagnosticsHub.StandardCollector.Service.exe 1708 fxssvc.exe 1380 elevation_service.exe 2020 elevation_service.exe 2200 maintenanceservice.exe 1712 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\d0e927b999ad3704.bin alg.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-07-08_45ec7fd7acb872c321b843cdf0331846_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-07-08_45ec7fd7acb872c321b843cdf0331846_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-07-08_45ec7fd7acb872c321b843cdf0331846_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-07-08_45ec7fd7acb872c321b843cdf0331846_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-07-08_45ec7fd7acb872c321b843cdf0331846_ryuk.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_109015\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe alg.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2024-07-08_45ec7fd7acb872c321b843cdf0331846_ryuk.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 640 DiagnosticsHub.StandardCollector.Service.exe 640 DiagnosticsHub.StandardCollector.Service.exe 640 DiagnosticsHub.StandardCollector.Service.exe 640 DiagnosticsHub.StandardCollector.Service.exe 640 DiagnosticsHub.StandardCollector.Service.exe 640 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 672 Process not Found 672 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1448 2024-07-08_45ec7fd7acb872c321b843cdf0331846_ryuk.exe Token: SeAuditPrivilege 1708 fxssvc.exe Token: SeDebugPrivilege 832 alg.exe Token: SeDebugPrivilege 832 alg.exe Token: SeDebugPrivilege 832 alg.exe Token: SeDebugPrivilege 640 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-08_45ec7fd7acb872c321b843cdf0331846_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-08_45ec7fd7acb872c321b843cdf0331846_ryuk.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1448
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:832
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:640
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:2844
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1708
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1380
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2020
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:2200
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:1712
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5691a08e229dfa46654f292a535a443f9
SHA1d1a2eec39df03b54d8bf0601a8da3826843bf51a
SHA2560d915aa00ab07222c574d3c2288752b7588f7e149250ebf029ad21750e073317
SHA512a02bf59e6e26327f0e8db3518b62feffc521e4e50019a174ee7e40bbcc1e7e796c870c3d5dcec189c8633394fd7a1b93a82170829f14204db62880a100347372
-
Filesize
797KB
MD519657fadbedf2917d0c71fadffbeffdd
SHA1bf6b72103f8128509711e1268e36ed4e01d8f9e8
SHA256975ea6982c67a86ab5c37a9599aaba4ca4418d8d8653ab69449e812782786001
SHA5123cd1993eed83bf063fdf508b40102e33ce20f4cc7b3259dfd52ae5a904c155f3de2566d147eec3f4fcfe1b65dc6a01f60c1b55e293464e044e7658991113c2ab
-
Filesize
1.1MB
MD5d5de778f44ce089bfa2350d5c9d4cf03
SHA166f6aa76aa0961f2d95505a3c4f1c2b25c613c28
SHA2561710aad6f1b02ec9a452e11f5f5c63e3e86f4ae358c9155a2fab7961324b1c6a
SHA5126547651313efb976c60199507cf7e1d7370a9d410906c0d25eb46d94c3a6821caa4fd8df4c46ee2dc57eb7ab24de5842f9c575ad5059f034a0bc2a5e9d276b1b
-
Filesize
1.5MB
MD5300c46020deb02d371b5b4fb58248400
SHA1bde332a32fc993dcf3c8a59b4dc4a3f129757426
SHA25647c80ad17041c225ea0274c1221e47cc3061c7d9723412ebb8a27478ff4ccc81
SHA5121d938f899e0e1169d2eeb08e22e6c04f083de166e76483c118c973288abc46d8cb1953aa44d1991868985915aae885eae2b6a0797dd49b75f45b023a6df2be1d
-
Filesize
1.2MB
MD59dbc403fbae92fc1efc9f17addd98280
SHA13a8f0ece0c65e5803b57507c4f9c53c4242c4043
SHA2568d7965d95f6eed961da475b68390cec0dcd1715f9ac69515b17c4d70e8f14891
SHA512be1472cb670113a1688875c3d5279004de398a9fa768671fa64a3c094ce0ef5e68e094f1a6b87c606810427e7b46ed8495a31bf9fbd1e0f93c80144b1f023c49
-
Filesize
582KB
MD513d5f20be1773b44e02c7e8c26135551
SHA1a38c1756c080ee4d0be515fc30e52efc249f33d3
SHA256898b9084c3be6de8e802cb2a1dfa8f4c5821eba8f09a1511c1c76e6d63bd0446
SHA512a7e1afbb5747172958a4e94671abaa93f0e164f80117c765bb3773c7fe43d41161bac58ecaaca29737a790f08257de65d3714947dbae16152c51da39edf85d0e
-
Filesize
840KB
MD53137842ad928b186946dfd7983998931
SHA1eabd11dcff55ad15c554e3dc0e0ad5f55bbf9b5f
SHA2569a440919a0ce4dcd6a52eed6e0c589d10f73901a64c9d2ef9c17fc1b35fb7465
SHA5120b445b70603688f0716fdb5a753fc454b1011ddc06d61030c7b09a02c5fe9ed2bc14278c938fbd6e6470f38ad50b4f13d7ba24fb9ef428c4f3ef0d254ae51bcb
-
Filesize
4.6MB
MD55edd9ff6ce8eabac78e83d0fc92dd8ec
SHA198594249ce7adf1d2a591f39dddd85594bdcd7a6
SHA256a1fd861a2b9d6706240b7a52afb6273e3393e89491ff38ca1d7cbdadfad4e4a5
SHA512da3ee665b01c09ba960e7854bfdeab9910da704a41cc0739d60e5ac2c18fabf94c1fa7de005086685df814f0fedfb43b970902508e89fd8224c91d371b44bfdf
-
Filesize
910KB
MD5e10dfc2991a37573b4badafdd2ab15b3
SHA16e2cef586b77cad2c42400d9f7ed1d7e52458142
SHA2563eab855d696629d42074c3515a2eddcc816bdf55054156a0997ad6f52524729f
SHA512c2b1fd3722a6467ea61aa58426006b55900e3f73444c83c2972cc3102cc260f413b876d4c2dd1ee0c2203f748bc7a49456f94d5f1bcb976b433f04876fa4f516
-
Filesize
24.0MB
MD59694f12f650c024712dad6a54646efbb
SHA1c691760fc6aa5c80c45b0e802f2fe105522617a1
SHA25627398d68160c8a919431f3d6433af28f9b8c5a859c2fe44eb23a8a0e44582380
SHA512697f8e95f7b76adfbad24a765bf40adc146b6eced8a4516a0f59089f8d0cc1ff4ebb397d0520c9e58f25a12d747a05a28cc80a86af465efee4de24528abff4b6
-
Filesize
2.7MB
MD5470252b95ec7f8f3ef82c82807507f71
SHA1862d6639e9567465b9e65bfff33b1acfd483affc
SHA2563cd6fc953c42df66d3a193e4aa1fa98defb4ed1008261de5c4d904c1bb060502
SHA512f228205b766e6f1cace29e433dd7ccd8fa1e2f225b50acf5158efee9cfd0462bea2fbaf156a8cd1ad2cba7c8a5f29dfa444a765a1d1967b8ff4415ca1461496f
-
Filesize
1.1MB
MD599cc8f5aa3fe56e419ed0d862b26da0d
SHA1ed2ea4690ea1302d41edf3c71edaa3c31a47d5fe
SHA2561c851839585091f873438d5219e15820a2e03695a252fa759e51903679b7d90d
SHA5124b40e52a4b1f08fd5d5d024f8bd1ed0cf6f5459cf5f56136e159164cf01a9a9ab48a72f26ec0fc673048a6ae28e4ba94caa80a4cee1935c86a60f4c20e795eaf
-
Filesize
805KB
MD509cf586f196c3dbd2913003a5cee9fda
SHA1b842ae3161116e57480eb1f968b5cfae3669a6a2
SHA256ce024ce88866d993504cb28d81f6525da69c3b30d9331e43fc7bb6477078550e
SHA5126a764769e60977ba7b338be84805c15854a2043bbb531c3edc6366e5c34131451e102f3802ebe7d63805d6acd6b9f7fad8189424408bfbd86b3e190bafc3fac3
-
Filesize
656KB
MD5362d1844fee9a6ac7a2abc57a644d981
SHA1b03188b6329c90640e29cbd119e9202117b2bcca
SHA256933063d19a5d2dfcccb9afe36d2a51756ed95141c5ca0f6ca33b2ee0d5b17404
SHA512da7e79c7474682aaedebcf68098e1b38620081be3c2264c375614a3d3ef95219582ec42a7d1ba5129753489cd0abef53639835ff33dd715de4217ea00e8190b5
-
Filesize
5.4MB
MD50b6ce898d5518584594f202a7d6593cd
SHA108913324e99faa029d522918c832ae4e253ff331
SHA2566ccfcb7706cd50d2661f1e4b3fc81fbd3d7a15b7990b4788d78ef3d90d3a2a2d
SHA512bb34cbe435c810fe85039ef12876d3bf33948189af92facd8770ddae86dbb21975831b093f45ff87b8d5fe317f1b3ee51fae41daf0dd0391b51711299585a5be
-
Filesize
5.4MB
MD556c94322f9f972825d7f8003fead1e77
SHA1e5b21bdeed18e5a725b47f3f5603c8d591412824
SHA256c2587d4ead98ff4dd7324e9824c4f1ce18252392de87a02361ad7d56bd008421
SHA51208100f7cef6f9dfd2dd728e27ee88d896cf6e635d85ebcf2b52b52256f67b7df8d17534da2665ba2be18955991685b492a2f901c3f8c73bdbfb11ce02f359bb2
-
Filesize
2.0MB
MD529619f71459d91f142cc080ecfbc6499
SHA1ab640291d5c78717a0a09e047e8a09d7ed5acd7b
SHA256cc0b969079f4471a3df42811e6726390d728a7ef23a6ea3314e32391f89d504e
SHA512901a230da8e2d815e26b05d0b19d8db74bc2b15cf975f8a32f8b80ca31d8660dd6dcec44a6542824fd0e595454f5a7c462dcac705ae5d208a9f55d4df7074199
-
Filesize
2.2MB
MD54515b02e6ee22267ce4770817050ac94
SHA11adeb87c9d3c9ac3fd9b0f3b65344e790dcb724e
SHA25636128e085ad83ec00704d070103d294cabc8dd360221194d1c9746659fff3a19
SHA5129b1d2403f9578e95def8b1c072aef28fb201e848800fb38e27191e0487084996b14d7f256f6f13fc3ddac49d98371ca551920af26354177f9b9e03367b01987a
-
Filesize
1.8MB
MD57d45c8dee00de456b6c377eb46bc3bcd
SHA17c1600b92bba815d3dd92c5caeba894c4754154d
SHA2563fecbd926c96a402cbe265c1962d42f45d20b2e9c3679dda8b12f0432b1a683a
SHA512a5be26b137b6876d4352f02aece25f246779632f67f0af0e1b279b98713f4a5bb77b3191e49d71e3797d44df2ac232e95076a69f36268e252f4c979dc6ca6111
-
Filesize
1.7MB
MD5547e13af2f8916ea1e62f70c07bbf37a
SHA1c6489f90d2b6befe0b7fe8ebe3076d1dca480774
SHA256d34d90ee4be77a6272fdb641b958a6a2ec938131cb5adb76a6c1b6b0aa298aa8
SHA51272f14fcbaeaa457f981864c9ef858999455fb99ca3f620271aefe4e344d241b44fab203c534560aa4056a3dfc50e7f90829c480f10ae38d7cd2bbb8e40e09362
-
Filesize
581KB
MD5e0b3ce6ad31fca0957f045d826a67b2a
SHA1cd3fe1336c526ff85dcc71a7a602dd081879d55a
SHA25633046dfde8c9589df796543ec9ec37cf45c5f74fa0489dd9d54a14da214cc1b6
SHA512442839f23501d6f4b439167fd2038d70851c0ccd88c05ecd35606a750f9fa11676e5bee47ee6cf5ef48614653bb65a95ffa0eca8939b6753182204a9dc0bbe10
-
Filesize
581KB
MD51f5fda843d371c6f5fae8d6f7adadf2b
SHA116af40e640c5a22ed3e5514e01b05d3d3fc1d454
SHA256ddc21127c18e3f94da69ba57c019f8478fd4f8b14ba308a8e523bb3cd9f4bfad
SHA512715ecec2fdd7e4b85e729718599bf31500a078e352d6c43ebfb3aac81242cb3031fb99e1d73d8b3e03504c22ea9864229781deda36ee54a7e33eb775f65d532e
-
Filesize
581KB
MD59a850143d0d2099b8d95b4e428055719
SHA13546fd4cf2c3f79778dac958a7b84b6dca38a796
SHA256dd071dd2ee5ac6dc87278022b4187515a4bcfe286706f4a46b5af3800bafcbb1
SHA51233a4d49b9e53b5289c3e90f58c907573a55064207013ed442eb31620bb58628d38fac6e83eeb47d614503e893e315e3fa00c83cc79bed8a321b0a0546f61b889
-
Filesize
601KB
MD5e9402f3ebdacc96c8bef7bcaf23fbfa1
SHA175a9c42843d1d1677591b6216d929378afa8a9eb
SHA2568b8444edb86b6199d230994b9f7026d621eec1321290e6d9c2c3a7d5f931f823
SHA512758096b17e4f19dcbf8f206696fa0a34974a75641a0cf8f9db54f19b60a1b0c3e194abf4358af49d8bd61c9c396649991c597149295a984654dda6590ed7eb61
-
Filesize
581KB
MD5d2be6ae7713df2d1f48fde5c43a0d44f
SHA1214ce8c6b09fa1723c36233e5aaf2d8211bcd78d
SHA256c9f1bcdaef37f037e090c0006f9aec12b633858575bd0be1613e9c931c04769c
SHA512fbab731bbde2063c43aeec30e0d3b89c407aa46186a93f1d24fcf3da0c882eac3fd05a24d7b95c93480db8eea5ae5d65790d939285b5badb77836612addcfc75
-
Filesize
581KB
MD56d7a90fe966773dc4d28c0748407b190
SHA19616f8fd5a73222a6f2817cb19c50e3b5c3a12f2
SHA25675b4a8fba81ead0e725ca3dbd67f502889ed66e185656ce9486b78a213303c15
SHA512e59627432b264ebcb7b5c04f9274e8762d222eecd1c4982de8d86cff190a645b812e9e86c5e07515ce6fd5f823d9e45fa4474229c7c85d1e3b2af0b8a1744ed7
-
Filesize
581KB
MD5cacecb2108f304df548e9e83a84ffdf9
SHA1295b20e14b4f40b40a6a17a8e95489a0194678a0
SHA2565d6aaf04d1992864f5c7bfc529a89edb410a72f086cc0143743a70c68f2d078a
SHA51252ee39bcbfa407ce26392d77ce3f8d65f40525fd40563a943bc907ddd5b3a6c35b8daaa5d30601ba6c381fe57ee62485b05bb1238ecc98630e82b91af9d455ad
-
Filesize
841KB
MD518cd044ec53d7ec66a6d78faf1d1525f
SHA16425c4691897784d532cb10ed7f4e02de53c91ed
SHA256c18a5bbdac514bf0e92ef5ce57988d19c772ef3ec24c161c9fd31b1c6f51bb8d
SHA5120ccd7c46235b328126600071176798a7fcc41caf09a3d392d27736abf7135e5e08ad571307201ff9d3b8a79fc9eec20da1186d58fa09f148b376699406eefda9
-
Filesize
581KB
MD58fc14c257ea2dc85916862c3435c3b6b
SHA158190f42c05b15701ed9942133d7c4f373d51a6e
SHA256b210250486867ceef538e45b756593e55dd863587387b0a7b617b9f12111e8ce
SHA5128fc9d76e73976d0f04d953d18a0a58329d8c4264f271348d85fbd4b3665bb76b63a5b2a2bbf05ebd60a1aa08e5d53a2ccf7cff9e49345f132cff812f36e25bb3
-
Filesize
581KB
MD560739aa433ebe21f989005bf59158c26
SHA1a998db44fc09c995bb46c1f510dc51b8fd8e977f
SHA256b55d0daf5d6e25a949f142433823c8226077148727d09bbfc86f98e4e2c06566
SHA5125aa7570e23c9fc510b64324ca1fdd6363138a1207e98956d6b3f6f8e16467c2540636d87186900f89692e0d979721e16e0989aa3f8e7d3c426f5b22c9755c20d
-
Filesize
717KB
MD53a8894b6ccaf4dc45d3d4ee352d31caa
SHA1e4c013468fb3ad9c3cbbf4d521db43351345b397
SHA2566dc71950dcf0c8ba21c3175a28b1010433e9282eb835174d2ee4a7c735c16d63
SHA51276766cfb8bd6ebdefffb7c29853e70134b7ef48924934e85b7d092f45d0935669713b89544cdbbaebc12bd4edbcfe15e2ddf623fffe41a8c0d0037ce3b2c331c
-
Filesize
581KB
MD56a757ff5017181ae3b6be76c02235de6
SHA1b5ca620399254d98ae17dbf4a36e6191296986ca
SHA256ade3194a8eb58cc423d94322d719fbc6ab09668df16b6e0ba22f7513f8840f6b
SHA5124144825991fb501817d32c43c97a63d422b519e7d92deee5d270fcf8b0610cbc27081043169b98c58462aeb0f3485a97d21782043f11c870e9bf643ef13a1e96
-
Filesize
581KB
MD5137784d0851043ae87ccdebd09c7b0e1
SHA18f63632def220f62a754f4ad71061c9420897ded
SHA256ee0afe686742878140422df6bf0cc7ee3bf2d2e6e5f8e64217c22d63b9df497c
SHA512e93cd8f44b1cd54962ad2aa9e081e490a8517773c86babbe5fcff2a4f9ba659eca0cb3d4b681060b7b856b4e23b9ffb625ac8788e0ad4409a94614e86d0ebb86
-
Filesize
717KB
MD566c2c76e4113a9b492db3d4f85c646af
SHA1ba5bc52b292a5bccb7e23297785c418aead7d715
SHA256d30bf395ce3cca0c45547739fd1ee6c20bd41bafc43afc9d0d498fd8c35ea642
SHA51291bb094709a8700219c9feb842da6c524ab49bd71153804bb979209a594156faacaf75e9b22ae71701a7e41673a3597ab42e8076c07c6b84414f3977f4a1da08
-
Filesize
841KB
MD58c3e9cae5f50430d80a195743dfddafb
SHA12b40743224ce878f4e8846a44b58bdbee8314d4e
SHA2563f1e14529ba44366a7fcb1d4a4d218432bb17fa5ffdea0429f7646f2e5c8397a
SHA51260a32d9b22f48111aeb7261ef24bd92df9b06703bf2b885e41bf4e817f07717b6dfbc4cf3e46c12a0cf1c9edf85c1aac03d621f831cdaeafe6b8ed33831fce8f
-
Filesize
1020KB
MD5a5307d40b3d7a16b877695320091697b
SHA1543714f386cc65bbe28f73b00b9ff710456f4dd1
SHA2568b562af58e1e98109517e2da7f2b4c78fe3d2d804c0918f8e1e4d74d1d9cb0d1
SHA512220d5990cc6849538d1a81a579cf1512ee4f6393ee1882daaf441e94badab439d96c606c7ad47429b53a1d304f382a4d84dfcee602dd169833a14679b8ae8dfe
-
Filesize
581KB
MD53cda93f13165f18e7d0d8d530201baeb
SHA1bd2790396859bd5c52ce51a3a920bc284b53ae59
SHA25679103211a496167e5a76ecb321b5ed81d7282e4819b116b1f041b8ba7a398efc
SHA51216a991a8d6c9f15d08e6863920cc2774b4e24f6c83bad94923328e852ca97a85518967872274bd27162c97068f5f85193c822dfa95ce7bbe86844690b200e4c1
-
Filesize
581KB
MD594f208d64909145cb5e359a972081128
SHA16f666fe351b578f9a680fa31e32808df544fe5af
SHA2568987a45cb357405a2862d6ba547b7dcff3d1ca354d2bc8372ef07adc545f8b83
SHA5125383d0399147db70dec8526960292d2c7a06d2240da48974e9f135a37214324cce8ec59ef792cb720f9b5ef929180692a5e0422dafd5deabb6b364f580e407c2
-
Filesize
581KB
MD5ea9ff548fef25df0bc0a0d98c766384e
SHA1c716e9141c412475b3cf905907d221b60f230762
SHA2565926d540adf15f0bded5245b6181f887142c72f90ff6bb162f48195b267f2534
SHA512db64930409bb89dcf4d16e3ce9a5279778265535199fe502a36405150cbc3df80515672ade3b04a990c7d700092f77f96a92daf457e93f085fc168e2677083eb
-
Filesize
581KB
MD55f3958e655d43b5e6bee56bd5bc17c6e
SHA13245092f7606fc49472c98034042a47c00a8feaf
SHA256ddd2f112370f88df73fb9014f4383da91fa7e5a6e9473cd7667ed417a5b76e11
SHA512188ae86082015319ca0e75f34b1cebedd142e1c5c889e24f7d3ac3ffbf6b6427d7b90ce80f34790e2c889f5747e7064bf99f3544b7e9b58f8ccafc2c0dfbb81d
-
Filesize
581KB
MD5c2325c45bcfb3da0a9193b29543d3ca5
SHA175a040fdfd6d5c6f2a65052b1ba1e2a9fe01f4fd
SHA2566a5fd3ce8caad73a695f2b0aa9d193cd8c7533365dca5b36e2d57197b5c35ddb
SHA512fe42270717d5a6f75de3b383e161533e0ca4e47708a0635248480b072aad1c0732f08e6391f1cdc31d07cdc46088f2af7a22afa1f97cd8e2edbbc1b9d2eb0631
-
Filesize
581KB
MD5d273242e508f84d2eb5dedb50f203516
SHA112d45fd11754c8ad77eef7b20f467ded837b0d6a
SHA2567e980de43cc7168a20357dd2112c19e3a15c6c0101dedc4ff39d06daa40a58c4
SHA5128791afa4821c02e43e43b5a971cb1b9324c69b4f86046628c9f9cf480c3f0d340824d87c3c5d840d96ceb27ea7c22f3c1f0a3ac281bc9804a7b0d03124744097
-
Filesize
581KB
MD51d7286786bf934e248ca6cfd46215374
SHA17ac9f08dcf36d3b6372476b7650b4e0912a5ee3a
SHA256dad9974e5574248044663ee26bf8f6aa471d1c027621c2d734bf26a5b59ef3ed
SHA5121df16d37909b6b1e34247132559d8ed3aa542be668916f77216db9353d796dbfa1f2b0ae854681485a3c8edd1449441a603235ca423e92e95c76f6e6bc0e464a
-
Filesize
581KB
MD5c97429a59d614367e69aaecbe5a6d4e8
SHA1d2db7518d655887180931582331c481858ce6388
SHA256278250ec98720f34a2ea1f4feb9d66070c057d064bbe8f8ff65ae92a39ce2ad7
SHA5124d46c3a24574019738a5e1a6dc170d9f1fa60da694ac0226c5ed7099193af7a1e96872426d7c8b1081f6ba79c51347ea515decff169fba91f9a0f44eccfb92fa
-
Filesize
581KB
MD5c6dd9be22f46d01ec8eefb72da839924
SHA1fdd949c65a0a96de4837d9f897d302f1a2f5dae0
SHA25685e0ffb60ab060bc1ccd7af76b343364ff4db31220f48c3c022585b5b25cb131
SHA5126875f8baa0ac7660547a21753c9ee882d0c727c8905a2e4283a17d4cd36ac7bd3b83584279e9fdd890b222eb9213f3e1807a994b705fbb7a138a3db582578d44
-
Filesize
581KB
MD5273a1f4262daddc94fd5351ce34494ac
SHA17025e0b98432b5fb5ccfcbad066d56279a6030e8
SHA2568b461346a8e660c8dc1a8fd28fb072849b276556943118c61db7af585d21c1e2
SHA51274a249208aac96a105bbadb6adaa7d8995d30939ba2580a429b30e7d6ad6ba91025332bbc3bdbb7866f330889d169aab41cf24090df36a289c5b9c8e117088b8
-
Filesize
581KB
MD56c353c0ab8400a1c214372212173a75c
SHA121faa24fab229d12eb17241be604ec1142ad2e28
SHA2568c5002e0d75a8bb6ef89d68e680185e706a3a079d083a75b8fde01dd04d439c5
SHA512e4d77d83173f4df49d733982f7730c92902ae7517ca791c48b668be0fe8fcf300ce48d1188afafb25b3d5e1ba9c3d2c194e4e9c2f67ca40a0d3b6de2fe637f9a
-
Filesize
581KB
MD51e75fe875d60bb1f08fb5bfd1bd065eb
SHA19b84f53ed745c36de1a881444307abc0f8de0848
SHA2569fb532be54cf5f4fd9e5373e75cdbf177beaed172a7bd96348dce7f8513d17eb
SHA512c34186e4cf824af8cf6f416deb31e106474e49c984982b2d3e422086fa1d7204ab4fda4586ec11027f9a2b5982fb62ff8b2ac0d3bb38c0e853d7b564074312d1
-
Filesize
581KB
MD58fa0199e211e00ffe7d4a8019d266f43
SHA193f41ab97800882729459cda6b325dc8908cce78
SHA256c2a2bca3fe36cc947651e6c838ef5400827c80b43e2819bddd185032ed94405c
SHA5124bb9eaf74f95864a5fd3d8160b48c0191268d4834204026596d5035d2e60dcc3f6a99c41d8dccb55639a5e27e950f41d1740886572e9cf26da8149228a515b26
-
Filesize
581KB
MD578bd78fa5dc0633bd806f02fff584bf2
SHA1834982364d69d82b9fdad6e95ce72a8a1360976c
SHA25663cd5deb5b36271fe136c7700fa55cac59be7c7fd5f938902fd63ecaa3860cca
SHA5127e8d95ac4373d8001e7bc12ee6dc04e8bf5c02833e9a863bb8c7003f461bf0ecfc89a450d5e0eae7c6c8e2d8f0398203daa56a4bbeb2d5852292d2adfab2f884
-
Filesize
581KB
MD5a3449600d9a74b24c60660f84972e83b
SHA1bd2c87ec661e006885ea5be6108b7162c3179819
SHA256291e1ba5aecb7fcafcada7ca150d3f274977f923af384c29f248fead47d83571
SHA5122463e3e5855690d63490ffcdc4be6c7d0af6b654de86965316f70ccd1b81c987f1b604095d4ac9c8bcdaf9e792cb20b30b5057cb95261612d16e782133627a85
-
Filesize
581KB
MD582d5e915d4d3e61653aa10c3a1ae915a
SHA194cafe556388975b3bba874ec2bf30a0f622b463
SHA2560e5c7b671014689f0776008a7b584f84bb4fcfe64f931a732076ce07bb04c3d8
SHA5121f693878cfa4894e9ebcc7ae54109c80837e0d2d498e3c38ee554670c4bffd8fed0d60e2d1d033f533d23e0fe3258052523807af5e9b41cf4e7cc5e5e7ec552e
-
Filesize
581KB
MD599b35e0aa251b56502d61a7141a6b687
SHA1e18e852a6b7ae194b05c1296f6cb8d46ffa73f07
SHA2560d013505fe8c381b804a23949d0bdfe5a257e896617bbe4cb65bf9bb03ddcd3f
SHA5121758b96bbe6d73101329f2d8c401fef4efb8a7e7f86ec5223e92db9ff58fcc281445593642acdb9fa92b917923ed3c2c6109a5fb2a8acef4b8d73a797f3d02ca
-
Filesize
581KB
MD5028c720ab015a9c89c531c712623cc78
SHA17e0e36454e779d59d3accfdebdd6464203ca2390
SHA256fc5b476879282d7d069a01716c9426f26decc9980e35c179522fd6b4035ab635
SHA5120a201bb9a7b5a9a531dd311178ecb6423eb1875323be660ce99faa71d8a8b21ac20df8e12884feef3c51eae131dd2cf177609056b503437e9993ef674135a8df
-
Filesize
581KB
MD5c4c7c1b42c6b8deb9ad220e221088c03
SHA1bf63f7e44d505cf573863395e34d566c632dae9f
SHA256f5289e4fac6e2639d2beab7386afec0da3987da83a7a73337528b3f7a62b09a5
SHA512cca28456b0b04583fbb34a891bb41b3291170a1ee75461d3d5b8df5f0febf5d38e3a30761901a77c40a03623a745dc06971dc682f6f06de2f4fbefaeb5f76895
-
Filesize
581KB
MD5bd67d4cb6d8c4bc9548cf2ce16706f09
SHA120373c47a5b10250a5edacd1ebc36e9b05f6a4ed
SHA25669af2fb471be1f648ae476f71eb13ca1c6c1c244ae65fc3f71d4b26d9b34bfd6
SHA512e4cc68ec0abacd89309eb44d51e1f98094d6eb972fd260eb43f806cd98487cb2bb27592a640401a158b4b978701fdae627a71cbd8706ba00c289c0a70335a7e8
-
Filesize
581KB
MD51d39db89fde2a8320f1cfaac2fd46c69
SHA179f9b55b05b6da269b8a934cd184eacffb9cecdb
SHA2569b8c45da193d8ba2f6e1d689bd8d3be285461000c966e55eeefb01d7c6bf054b
SHA5124e90621869edf9cb0bf28f1a95c729a0c6f5ef2b4f529f4d9ae2962d8902b625e9a91a24ceb4d56c151a31e5dad97a2ed18fb86bac09d234d8eac1cbe892b069
-
Filesize
701KB
MD59078747b7514e653cf662334408e3396
SHA1ac4957de3e0d0fa16fd58f610832f1cd8eb0d5a7
SHA256e459260cbf26d1fc336a6ec7f943a095e7f033d65e68d6c7b7e955c65d255c49
SHA512bb74afc42ce89887033ac74aed78f850963ab18c2052ffac86a36f14cd20f11467c4cd43e7858c7f1faaa90832922b52618a59b943f6bb16dbbffda34dcb9512
-
Filesize
659KB
MD58163150c070da1163273ba19f2c41f76
SHA180a919153b57e2903b0a00d5ad6d7d69bff464d7
SHA2569881532c6bcd326a2ffd0f24d199ed41b23af45bdafba7d89d7b20beda1ed8a0
SHA512a2aed4deed633f605f65e9e258c124780a7765a61b33f6eabd1e2c26b64e1f8b9faece2d75c1789aa9bdc1ef9bff3f057985746b6e5bc1c9420da6d649d45aa6
-
Filesize
1.2MB
MD5f1de866a26761062019516bc707ffe46
SHA1e65fb4ee10c4a656e96e33d437f5a1b790a5fcae
SHA256f83bbe3ee694baa6679b1003b0f3980e3433e089f00823010641f120c1b6bb65
SHA512cf671a17514937b930589c7566e77c82698d30fd41285d881963e391a7e06b5244a8c2a8c5b4c1d02ce3e7c83675b239daa2d2cc2ccae1e99b2f68a23f0d335d
-
Filesize
661KB
MD5e7545f2bb6abc375bdcd0aec3ea89412
SHA126910d76d91b8e405e423700e68f8ac11f37d3fc
SHA2564c6432f63329fc839bfdecd4ba672c41587d5de380769f1188acc0d3c60def1d
SHA5126a89633fa47310563b06d09b2331ac47184b4f48b1ff390a4a017d157d271c7414340593329fa43b9ecd87f3649a1e687430bf33284adb4c4f148a1f0d767e45
-
Filesize
1.3MB
MD57d60902a400e457a86448428ef6adea1
SHA151e5d57bacd256a379e3c1e8398a292dc364dc46
SHA256168539354e82177d09c40d5a330a8b91023c2dffab1de88cbdfaa0ace0c61f31
SHA512f5b06e9c6c2f0ff247ed6dd5f0a197e2cdd82a75bf50b88eed10819d0e21c37435b90e32dede2cf32953816075b20687efce2164f728800eece5b47a18f07521