Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
09/07/2024, 16:23
Static task
static1
General
-
Target
2024-07-09_9e1352b6ec936fc8d6a2553da052405d_ryuk.exe
-
Size
1.9MB
-
MD5
9e1352b6ec936fc8d6a2553da052405d
-
SHA1
632eaf506522f0b84ecaabcb55511cbbfbac7599
-
SHA256
b2028b47c1f2e43a5909b2167cab900c1830db48f1c6e2cd9d03d546d56b14ca
-
SHA512
d1b4cf089529a51cb3ae4f1cfcfe8a1a682133ce5791bd20b7ef9207e920469545c412981451e0fcc9e7635aa1e113e885807b00eab486cbfd4cfb030e7411c9
-
SSDEEP
24576:Y78r8FfC3F32nUnCdAaKu++nO1SkQ/7Gb8NLEbeZ:Y/fQF37CGaPzkQ/qoLEw
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 4592 alg.exe 3304 DiagnosticsHub.StandardCollector.Service.exe 1448 elevation_service.exe 384 fxssvc.exe 2804 elevation_service.exe 4436 maintenanceservice.exe 3956 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-07-09_9e1352b6ec936fc8d6a2553da052405d_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-07-09_9e1352b6ec936fc8d6a2553da052405d_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-07-09_9e1352b6ec936fc8d6a2553da052405d_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\70db226499ad3704.bin alg.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-07-09_9e1352b6ec936fc8d6a2553da052405d_ryuk.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-07-09_9e1352b6ec936fc8d6a2553da052405d_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{CF62F5D9-6052-41C2-9FF7-4E6A3DAC056D}\chrome_installer.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7z.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_109015\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{CF62F5D9-6052-41C2-9FF7-4E6A3DAC056D}\chrome_installer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\dotnet\dotnet.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe alg.exe File opened for modification C:\Program Files\7-Zip\7zG.exe DiagnosticsHub.StandardCollector.Service.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3304 DiagnosticsHub.StandardCollector.Service.exe 3304 DiagnosticsHub.StandardCollector.Service.exe 3304 DiagnosticsHub.StandardCollector.Service.exe 3304 DiagnosticsHub.StandardCollector.Service.exe 3304 DiagnosticsHub.StandardCollector.Service.exe 3304 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 660 Process not Found 660 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2520 2024-07-09_9e1352b6ec936fc8d6a2553da052405d_ryuk.exe Token: SeAuditPrivilege 384 fxssvc.exe Token: SeDebugPrivilege 4592 alg.exe Token: SeDebugPrivilege 4592 alg.exe Token: SeDebugPrivilege 4592 alg.exe Token: SeDebugPrivilege 3304 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-09_9e1352b6ec936fc8d6a2553da052405d_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-09_9e1352b6ec936fc8d6a2553da052405d_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2520
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4592
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3304
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:2176
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:384
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1448
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2804
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4436
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:3956
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD52b4ac6e15e3cf970bd2526f48a18882d
SHA1e84c35bffebb8a0e30f68995db9626857b7461d5
SHA256a364c5e9523bf720d3771ac148eac2219be851fbf74e41b71b3cd4d6034d281f
SHA5120fb182bd60ff106a01207f9413a2e0ec536bf25022d78b9f7883f1e61de12c93705e12c297908ba047e956f0d42572b3f90d5ed5f358fa8c35aaeee9c3b8a6ef
-
Filesize
1.4MB
MD5a7fd7f4b92d5598965c9b05797b9b1ce
SHA1be5af883235aff1ed67480050ec84d13ec764aec
SHA2560809ebdf3f9c5cd4d8aa5e30d8a8fea687951747537e948bac37f910469f3828
SHA51241215d69ec8dcf4af2493365862bee0e82198cba4e5893e805f3846963795c95f803ffdc9b5a941f73ed012c12fb9c731b53aad970c6c11a0089ebc6288a93f4
-
Filesize
1.7MB
MD5cd0db2463f4b6a32586ccd17416ac187
SHA128a463c982e70b4d306b19bbfb509aa2e4d46f22
SHA2561ee49bef4e48a29a9fa38ae2fd1038530cab08cabd4df0c2409bf31193f2030d
SHA5124d17beda7e42d746981fde0cbc8defe2a1eb9cfaa771fb821c0f25805cb7fd632f31358ab8a7c07c1b3b0be08904937064cc1eeead2b5b41623769702d79899a
-
Filesize
1.5MB
MD555dd9323298f110fb13a5dd320e7fcfb
SHA1b341cd340a9d58467cfaf2b8cdec817c4f819742
SHA25698aeae6fa10fb18a7805d87e0f7226c83fb5c769311a7ac5dc93e882162e7c0e
SHA51245af5d5a52f8f72f400d295d33a600d2efed8d3d5e8f15bfa2142e7ecedbfd0f6ade73288a2e0d2678afc09c9187e21b28674e708a334c44b92ff59f5563d815
-
Filesize
1.2MB
MD5249648c9fa9d2c19f5583c3971a3a4ad
SHA14401c135de8e5a0325d398c94446df4b10339ca8
SHA256e2e7d4bf45fde964e8dff6ab735e92d9c0671df1288c289f0c8a21d3e6d9a075
SHA5120bc0352cdf71164c529ce985ec0e5a24475353c13bab0f5e02430283eb2e592085227be72bfff0cb3f46f31690e92377e29206e477f7a45b8b4c7ae3cedcde51
-
Filesize
1.2MB
MD55f586e08f78c8d7d0cdcc22bc0d25885
SHA1dd8588a95165b5bfed01c9350b7b651275caced0
SHA256c90787ed6635353d973250dd1571831a91af6536e30c5cf190c7da5103951ab6
SHA512faab7444e8bf336f6733005e8a8316da9e43a4759f8255a692a589ad8ec86c8ee43b244deff8f799f11b18d9f3dd0b38f7ffbfdd8b49bb629c8034a3fed6482b
-
Filesize
1.4MB
MD51fee9fa9f9e6efe356ebffd2c133cc49
SHA13d6c51182058eeb7d2c84edc9116e58630fb3bb6
SHA2569db450dca6007ecbb8b7044a11f7be0ba5f782fa0c76a054686762dea1537dad
SHA5123a32932d863d1a6d0ca58bbd7b72107a35c39e2066f3e2f7bad0ffebb9b95baa5804ae86ce10b94c166d65438519f86c1ee77dd934ca64cc5336d999dad288d4
-
Filesize
4.6MB
MD556f189187b397c189e42d9fe64256a57
SHA12fe89ef400e12055eb1d8a0abbe9195687d75a89
SHA256825ed7083ef8a2777b127a5e33596d72be958eebb6c39f39f682b727a3d59970
SHA51297577ee3e4ab24a2d77f45d2016b698a6d19a6a66e85a6f96ca6fd749696a3bcac40c740786619047a6a1e22cd139738d9113e4913c57f24a30224af8e4293dc
-
Filesize
1.5MB
MD574e63b7b8c82c0c670929487e3dab25b
SHA1d409aa8d83edef1d1ad572648e1be6b28b7c6b30
SHA256a351895c288e42d08f174df3878b5abe8f71b0b63feb03c87b2d68dc85e8dd3e
SHA512431a490000322e76bbc11cdee2cd9bb526e10738306856e8e625d127582284e12adfd3a6f2a683ab315f105a0c947f0725410ffc7112024c8bc7d5c9619825ee
-
Filesize
24.0MB
MD5f5f6a5365cf5e30987b564507be4d6d1
SHA1d199f53e095bd1a43ab6244bcfd050b7c40c09af
SHA2562f50b9c188434f1fee6cff2ed10f8c62512538c8826b7c3f5bd141b359e4c367
SHA5122031b2c60ce4dd56dc12ae310df5c30da89a3178f440d442c097b30e7a9d76378377a124a6087b379b51f3752b9a834188087501aeb4039df7db8d18436cabd1
-
Filesize
2.7MB
MD5549d098213ce4cb5542194ff80936066
SHA1f17056988229152b26fb224028624521a724336d
SHA25617ff1af511f873b10a9bd5864c46f737b645299ef7edccec373c9219dc1943c1
SHA51247b2d33385627424320fa2d1295afb9264958b7f1b95a3851797b14ffcce157c3c668d547178a85b30b594f74a95fa37170a318594d7bdf430c455d561471abb
-
Filesize
1.1MB
MD564f2f090978536586273596923282a59
SHA10b1f7f4181914afbc1c65ef0cbd7e48177b1c9ea
SHA256b40faab7ad1a1442600d549e71ba31e1aba218a1d7fab8938d798bb66edfdfb5
SHA512e62ae506038e9a8b9a4dc1dcf1acd4c177c62e39ae575a391009b1ee1fdd59d1386f8ced3eb9ac97e5c8333920596b609f0ca4e451257559c49ae4bea1621e02
-
Filesize
1.4MB
MD5ebc7c62b0f7b7af32cda60ed1707d457
SHA1614a2a3251bd76ebe7b8cdfefd13b7f540aaf265
SHA256e1f06a518195de544fe857646f73ae97f132019d28f875a5cae312b1518848af
SHA5122f4b801d4f938c87e94fe6120cafcf7fda0421fa6524baca5a8ea240707783c80da2bc8df7025dd35fc766b90a5a028d911e22ec553f724b1207373bc168cfb9
-
Filesize
1.2MB
MD573c8e8779b3cf401f874cb4cb1db4c06
SHA177582ceca771e84c19e3bc6336fd2a71528051f9
SHA25687e9487c6b19b897328a60331234b1ebadc2fc17b738dd03662ffedaa8fbd643
SHA512142d2f9fb4958959095e4a1a44a957483f826185d16b41b4c7d355bdd5b040ab44d0c838fc6ca48657b0a616aeca59d80c0a01db3238d9fc03c81a3765412069
-
Filesize
5.4MB
MD57ea919fcd08fe9539dc19cd517fb51a7
SHA184468279b2022193651773b480e32fc9fc76a2c6
SHA256c1dc8cf5a49eeb447a955cca592e0d7f0b1a7963b2dd236abba3acd5560f75de
SHA5124adbaeb3e9f0294e375ef8d47044c5556e883326b16bb494571750ab83b905a8438bbe3a95d7da686aa0fd0a7d91316d42c6228581b44e0d0a86c47221aec877
-
Filesize
5.4MB
MD5cb0b466629c641f80f1079f509075668
SHA17ec15cee3f03a2fa2c210b42e31c22445d2019ca
SHA256ffa889b8bdc44277e9a707f7287631f08ea50734176acc0b373ee76d7397608a
SHA512d3bf37351b751537b5c201d23ad43443ea1f1bcbef6ee89d4a94958283f43678157a3af24d96bd5510d3679a226c3ca3a3bb238b5f288d603327e7db65b9cafc
-
Filesize
2.0MB
MD514396e78826c77f0b0ae620d20706f61
SHA1c3a721aad802df33d5aacb77393c0a400471aaca
SHA25663fcfbeb08b75cdcccdf563731a3e372f552a2c5de21daca37c36f5822ef400e
SHA5123527ba17ea42b58881243b41ab0b404f400d0a7bcd2b0f68ed5c6cc54f7ca932022e699998e5386c547972259b54088ff91046edab84c08d481f235ffa424b1f
-
Filesize
2.2MB
MD562fecfa5172b187579c7fed0c27d9b3f
SHA18951758df9b3acc4ab20197e3a430f6ebd544028
SHA25658eb396afcc85d9fff1b0cc89a4c3813db85bc1dcb44b0f0b0b578a9a797c58e
SHA5127eb6276dbead1601dbdc549649112d1b0ce46de53327d5ec6118a58f4ca7a065e9dbde874c7bf8abb52e82f4a1b77557a3551b4e63311614908726612f6fab44
-
Filesize
1.8MB
MD557ca8d703fdc090bacd77da9c77f4a08
SHA1991888700478b414033123d5f5a88989374ec66f
SHA256cf9d34ffe25683686728b9c47f8df850fcd9698c8c5f125da6a3447c7227e970
SHA512b7c0439f52786ef5abb68987441a6bc7e94e30af87b1d86b0189df86312c0f933b5d1ea4bea2a27dfe5412e82a8cb1741788787d16ab3d411cc1d2364f1e1c84
-
Filesize
1.7MB
MD5c515771dfb0ed4c7554640b138e62a22
SHA18527fd88232e97b647a82f08c1496adfba6cbb81
SHA25634f6bde1da68ae4603d647b6d7a5bca681c9930e4f1c4cf5f259224b2d4b1569
SHA51280bd612cf0d5e68e621c601362402164d594ca43a6fb1a19c65d0adc8e9abc16b859d68dcb930226b554f6c2e90fb89472f3a3383fc4c1ef7b012ec6909e2226
-
Filesize
1.2MB
MD5f6a58e215d5bcba01e95b072dd328709
SHA1004ffb4579f17ef64ebcc6200021a54e630a24bf
SHA2566bc732c7d77be9a07522548a1ca02b7594feb26aa77c26c7601047309dc3529e
SHA512db98dba6d4fe485cb3baf379b055cafe35db46ec3e1a26040b20bd35595cff45697bd40be470a387701a8117aa1dd75ba52283eb6e98a894a697b4628b993eb0
-
Filesize
1.2MB
MD56daa77cdba7bf83b728341de0734e4e2
SHA1d2d2dad38f7a7352acdc328636ad44310241a43b
SHA256901332c9b3cc776892dd8214e62e717fc65c1c4ac471a670b9af8fd603874e80
SHA5128d1c62a747180426c8797574725ef65252c4e016ba44438dcd612f6f745f4b8010cdd817299fc7f3a5da019b2fba571ffc0a855336fec5348e51ee753870c6d4
-
Filesize
1.2MB
MD543192741b88dea57ae552784ccf12065
SHA19ce7b8ab8745092690ffca749b5a1600c4674d41
SHA256691805eebe2afdc588c8f030bde625092c56f5ebcce3e2166ad28646768fc459
SHA512963d312aa9dec494bf241b3731d708234691acc92f3552a2389f64c64aa72d52c077a245c3282bc664c8dd8e02fd7a57b1fe29f346988de7407c6449edcd6c9d
-
Filesize
1.2MB
MD5f5065df277b411de89e90a44515d909b
SHA1bd31f94f7ed10d54d4d4ccfe65d1088b0d49ca5e
SHA25677ee28d8bd628929685f6ac4c23a36ec2ce82d67bf5c60a9a21df40968e34428
SHA512fa041ed4ace8ac320d44ccc78a22b8dc311896a4815fbaa10640029b3689751b96dff5df9ea234aadc93b8ed17a6c6ea5e6a8191c20001c2d4459b75380f6841
-
Filesize
1.2MB
MD509efbd6bce0df92dfc64369b42da390b
SHA13f1c301486369dd48fe311b283bcf5155e3bd2cb
SHA25618222132640b9d5316f3368135e84305bc34876f1363af127fe9ff7902a73de7
SHA5127f902593bc4102e4a25221ec68312028cb43810c002490f9d8778915f7cd94c955d565e4c1df9080aa2d54e1ccfacedfa65fc01a488bb16005c9de60ff618b8a
-
Filesize
1.2MB
MD5e6c094751ce2b6d4cbba8813de42bf13
SHA1d5a40cc1c3446f64b7e078aa3e8f0116c9a8b119
SHA256ad1f0fb814921dee97d44b65207bcd84fc33c4f6f5766919b65d9fd5008eaa9a
SHA512ad3a0584cfd227b022e451e31d8c2f629cbfb2758c9beec95c550da2faef24b02c553bfac7b511b7589d1b2f41a12d131f040429c43904920e65dc1773b4bb01
-
Filesize
1.2MB
MD5ff2f41be04722dea9c7fca202e544580
SHA19884b5114a70b474d4764328ef9101669771d727
SHA25694c41227dbb4f618a096aa467af9906fcdb6537a45a8f34d588fbf2b39d2c03d
SHA51275b4f8d36b0693453a73665bee3d72d86fb2c046d09a340fd60b1ecb03e11ce88d2131ffe52613a74c02570beaaf93466681323fa51cd1dc021673a3c836d52b
-
Filesize
1.4MB
MD50c419d2fb919b3ab726a83b80aa68ce4
SHA11345b26ad3298b577ce126fad245cab4bdbce1f5
SHA256cbae59f8610cc82302d586f134151d371ec3581f214870f41fb4857d06e5452c
SHA5128203295e1105421a7de4c8bc0e8735fc0fdf2db86f6b9e1e11678e868cb330d2f5755a6070d6f204282797d70e26e106a3f0c8af6cdd6490bad32c3552142bd7
-
Filesize
1.2MB
MD5ef995492a5e71e041d3735a5c71069dd
SHA112a0f60d8ad23f2f45612977ef1c8554c1205db8
SHA2568b2110b45150c17ac96d4f8ee542de7d4abdc028e6a6d90bfdafd8be3a9cbe73
SHA512b0b10f19ff59455944fab099c2e44bbe6623b93bb8f283d824b597b6a9977f8e6d29573196f59296ab1842cf014dc91b21957df1fa78853afcfae36567b9e017
-
Filesize
1.2MB
MD5b3c63cdb406bec8aec967190abc7a29c
SHA1942f8ed9333a5013044ba4194b892a56472eb811
SHA256749dec8c9b469bf073c57b1f0eb6b2f860c851d52a1604b8393c03a48881fc39
SHA512fde4a545a93e50b8819da0dfa1e3123261f72ad3336024b4b4ac4a63a76241b9b10579d3adf74009c405f5c8db9aca28005abd539a7a8b26f7e7c2c9a49d00bf
-
Filesize
1.3MB
MD50b73a3902cf06209c1a6a0dce4ca382e
SHA1d28e18970207face2868855fc12b3e0f59cf6773
SHA2569c859572caf764c4123a97d07f140616c3037673950559db5b0489ddb606b466
SHA51283c2e5dd8682d6aa3461c6cf229c0867812224a5538839541162da1ee122760a668470769cc79cd819cb9ed5d8c4b4839e4c987852233ea844b1f827738c1cec
-
Filesize
1.2MB
MD53e48d072ed4bd52e876ff14c4fee21e7
SHA1a34a453d443e0522dd22174d03420cfd94183586
SHA25601906df14627372efe99a227806f4c979e524a1e04a622c3fe47b9d89521b600
SHA51297e201a5a36c70de06f34c7f275ff1c9f506fd5316d30e4cb2b6a9c4f26b6fb7288ebcb13abb389f03de0824aa797ccf50401234e01a37b5b7c6301cd817d51d
-
Filesize
1.2MB
MD5c0dc8f87a35da47fe4d3576917e3b1e7
SHA1eab8d4cd3895e27ba0f2d6d1cc163f1dc8f65765
SHA256d7ede35c84d9c416c5147d665880be10dbcb473d950871d4844184cb26e8fe3f
SHA5127e6bfdb91aa51fe66294c9fc3a1c23ae65b0ff8a7a764cc830a292e611e24c1bce4aade596e51ca3edf69ff7719de9ded6d6cf899ff2e2c8ceba10d4af966df4
-
Filesize
1.3MB
MD51d09b0a37622e00bb5142c81c8bc0be7
SHA1a2ee0d20046019d9974e4ac5a7f20101d4307cc3
SHA2561ac86db2aa4cbdbb9b3aa7bcd7f946fb2845664ec37d7cfcce96864e95f481af
SHA512119e29f736d70e89099763db847094e59605786badf1d51ec69712f7d36b4dd27e4a8209eba4ec997d49ca823bf64707e7b5d0ff3545cb2ace546318391d1441
-
Filesize
1.4MB
MD5b1aef9db57f12e39d5d6083034b483b9
SHA19186fe2d1ef6d023ada32a4ab8c7e5c11f3291f0
SHA2565ba248750c96c46ca17ae75864181b58a9b1e0d03f112f89ef9cd913324d241e
SHA512c89e235ad5c999a7a8c9358f414b1da35a0d1bedd3f5df6c98bdcecfa461097e5d3b3acbf366b44a8bf92d60c9a51623fba339580ed40a871ef8739e3cdd42ea
-
Filesize
1.6MB
MD593d2a744e3f0299d84cb6f1984a4d274
SHA14996da77ee511d17df3ea96dcaa8d9c1c3bd3b98
SHA256502eba6787bd4ee1e164dc640a411d63d88a6829b7afcb8b049bfec212efa1e4
SHA512a9123a7b5e1bd0b780355ec3ee9070d138724012e561033548dde8efa39b95f3f41aed2e51264694d21d1b887b54d96c5badbdbe305eb5a8a7065ec8d7ce31dc
-
Filesize
1.2MB
MD51c2d21ff344a1f59110811f2d0e1ab54
SHA1ddd3a391811ba21032116fae89a4da90f43c3562
SHA2567819c0bf638c7efcc1b6fb522695e853883ea2b1812ad35049ea33481d582237
SHA512db75856b64308c2b7e7072c1ec5913798a467eb75f3ff594100dcce6acba0a32b328914c86a24d66bda14351c174d78da205d92427cd3c6e9ea71b84a62d5bd5
-
Filesize
1.2MB
MD5c0e0e10b2c1810eedafa3b5bc11f2e3c
SHA176bcb38f3853bcd582c1391523c6d2354e8ce179
SHA256f4c1aa72ee4f06239b5c7f8e497bf87333f0050f5e1f51405c54c3e1cbe4e354
SHA512214910e3b7d0ca03f769083ff70ea7647bebf64f51705efa914df2611ff29bf57f621eed5ecda1ac39c6b5a903c66c2da758aa902c76368a4c0a7d107a7828bc
-
Filesize
1.2MB
MD5b26fc2556a51a9e50859222a740767a5
SHA16d54378e3e41dc9c1c9c252834464139b09d447e
SHA256deed1b41d83c5844fafc7411146f6d2ae2e36c81ec8b592a3d5a50665fa9f549
SHA512af2e3d3b3a2d12843f3b8de6a29169eaf1be5cc6f9ca4f8b2b6d7a27c354a51d7e602d05cc4b47a858742cb3dfc2e4f108adf1dbc78c723ceebfb82a75f68447
-
Filesize
1.2MB
MD5ac12ecdee10ec7c58b86e5d7a884f844
SHA191060b57ab4294e81a58a342b8c4188187439202
SHA256f4d0e7e78253072a2fb5f6ff25667ef18369d8b3b7ee6dc48be43a721f948292
SHA512f35d0c35c73eb9e89525c274fc37cfafa5f26a278294c9f54d66c098ffed5e0defc87843289c3a34a4c6a0ae77a77f8e2058d5aa060e83168e851931a363ba5e
-
Filesize
1.2MB
MD55fe59073982844f513191e7a6cd3037a
SHA18721c04393f44da27580d4d61f06c9af28772076
SHA25635b6e1c782ae5f00d3a4a6130f0f193af707ee11f58b8a8a31304fc9359bae1b
SHA5128cb7612d0d64e74db4492a51efd9a232adb2198644e3e98bc134e1190ed60ac7daed6a9b8a250ac5556f9ce83655593841dade81d176ebc236a00eeb8a9b1d52
-
Filesize
1.2MB
MD59c6a89abbcccfdf5e057f8ddba05dcbe
SHA1cde307e07bb957c19209e2e5b1061f4011df398f
SHA25697337e87267ecf9e2ce02b2eef5a775fd4be5d04dac99bb055778d23319017c7
SHA512d2fb20de4a6bad0cc8ea771ceb3d35c6e54b851136b1fffff392e7efa6d0bcb9cef93346dfe11b406e71fd7564487e56191566e548f0ce14a5aa3b247ebab0e2
-
Filesize
1.2MB
MD548456a99c1141cf443cf1a5c7e601850
SHA10dc36a921d11959c790d1fe866e7957b17981d6d
SHA25637c2efa3cb644dedf46559d022086d6b8ade678f823a4196b13b23444be8d2ba
SHA512ce720e0bc4d249699dba1594e8eb5f567b949595f4457f59cbfa49c519aaf559e3eacae2145d37694b1ee2b408539f07443a14240757736b12e620d67432a5b2
-
Filesize
1.2MB
MD54c69ac13df477b2ee84d37d80286e1d4
SHA192373ac44d9ca187f963399ba3c04835f9cd9f3c
SHA256191b9e6c8a4a8de0c4c7f3cfb48c9466629f1bd4a8ab3f0339fb2360606728c4
SHA51281d326e6d09c4f602b864a36078f565bc7ac5b5de735e30bc3e70abaa8476ef947e6db3fff591dab3cc65fac601b64045d53b5bd85f95ea5bbb6d21da325815d
-
Filesize
1.2MB
MD5286c7f29ffad646d8e40b9cb76a24a99
SHA191a781ac39da66fd2e32f8b8bef680b19ce52352
SHA256ea323c77e36f06ccca7370c6dfb697f5da6f6be2a51610d7ec40a787f32cc2b5
SHA5123397c3afb9ce07a74caf596202586f5110ce3b6e50f74684b41afb2f099d23b4ca15119861ececdc6c9f8aab70818f103f6546add0c7829e3c0e2e129e845675
-
Filesize
1.2MB
MD50880d9e9050e500a6998cd1c1dca866b
SHA154bfb9af7884c927d0ef9603572f4cd3383a8cd3
SHA256bb60b8ace9d28bbf3a51584c6873147ddce9d4943213774c1addd65cf8d01f34
SHA512e07eb2473cbf2ddfa46c8ae8204d427b31592fa69e116535404b78c4ff3a3cb9f47cc7fc682211571052f8559daebbde227150c1dc77ed0de1580b5149a839d6
-
Filesize
1.2MB
MD568f4ae829a2b770ba2f429dd0114fb4d
SHA1e339adf2abbf6b5808a93c3972e9c500c3b9db90
SHA256d34e1048d670a7b286b37a5348740bc8fff2d473c88e250f25d7b50d44507111
SHA512abb73fd03f576da80700417cdc0b203afcf9ed6831b060e2478cbd101447be41ef3658bd038f2aeebb678624e21b425a34cae0123226b79eb2778a0cdbad4659
-
Filesize
1.2MB
MD5f81bf65b6d30fda6a27f589b7403fbfd
SHA1004a66129e4b3b74d4bfabe19a2da0e6ce020679
SHA256abff6bae70c41f475a9c618f7b60d06b8449bc45d09841aca2a2febd7a2e0f21
SHA5125f4f5e7b3d55d67cf64d668fbe2b86a0e7c8c08fe8b49dfe7690bc02cbc734c598e723e95fb7cc8d34d2a832b8a579bd34520dd74f4fcdd29c605a6a6a0b33d5
-
Filesize
1.2MB
MD58ce41d07441e4ac2276c652457cbbb31
SHA115945b0c8e27db33cd13b9afd7acb1fe72f6ac86
SHA256be21ccffdeea31cf36af904f875e94050cee739d3181792f1112ddce493095a0
SHA51288b4aa9fb6934b792d585d5ccbec84fbf1344c2f73788919b6d3373337cd957ccf616b594230333cdfc34b6fd0811a312b6d87d850d9d0f66122083d20214b92
-
Filesize
1.2MB
MD56db5444497581b6ae405823ccec89a70
SHA1758dfac3d978bd5c286371f7bb6492fde4469c1a
SHA256e84c7b94f1553c8a56d49d07375cd2c8dc16a0d52ac236526447cf21b37149d2
SHA512cd0edcc6282f5ad03dca6431e942d1394037e6e5c4c8d22a8816b04e93021ef43a9c2e7e573970f504e2f13771b38e027aa41c508bfe15e2d80b5cfeb4ea8c9e
-
Filesize
1.2MB
MD55dd95c87286697f616223431ba16a5a9
SHA19cc47ae7be1807bc275e430d9122ab4052946edd
SHA256e9abe699ad50ec6745695a0fa4d118233d2781e1ae67962ac992c899a09f08e9
SHA512ffbb4a9a355d5a072a48d061ccdb11523bda3675d52c0257ccc9554fa8aa76b0083a392e5ac98341f710129c0b0d387cde1af63dabb702871d89646d817df26c
-
Filesize
1.2MB
MD58c699eaad05c0dd8820adcf0c8705206
SHA179f451ccb658137231d2974aeb61f1f9ed4069ab
SHA256835f68da051b3f66f6194120d50010c9b321df40c14c4c3ba689cbcd4536807c
SHA5127ae070648de02bde8721919e8b803296f3202f80c649a0bd35502ffaabb773bc61d72d4971cd25b80bf37a4cb7e13adb2b668aa7a0338e8c330e7d2d500383bc
-
Filesize
1.2MB
MD586e780022551214ff39b67b842c8ce05
SHA1c8453f3a382ccab7fcfc381f27a3505325fb4c93
SHA25615d531e378bfd55c4feb9cf08cdbc0b169c84e34750b18f8619a101737bb3999
SHA51287b33fd8c2d5b9c4fe350cf85af7e90e8c738f8e3fc611f005e0deaaa9311dc7bce35f7a14b3c426d4028bdd95f63d251a07dc3ef1d6b640448b54938955812a
-
Filesize
1.2MB
MD540ad0cdd0df26a7a0821d68242e1fcd2
SHA18e229a55435858e498073ca169ffe32e56e9a6b0
SHA25606e51791c07275630f36e7a00622276ca415dd4ef31fa44eb9f730362933b21f
SHA512bf4c6faa9e308ea6e557bd163cbfeeb4b19ad2e401eb0d4dfaabd25576683ed1bdfad7e4159e8b9390649c0ec565d24e4d1f02432710dca7dad6cf64805823f3
-
Filesize
1.2MB
MD5f32e1d07127a01aca149cd2e9f4b14e4
SHA1072d40e48454328255922eb6b2b4754bb38cdc1e
SHA2569d412719fbd63f86fa138dc774b486512a8c9adb9bbda40e04cd219a76cab061
SHA512ae5b252aeb550e571228aef925a05a029258de3cb10a7bb49ad5004f8a3f3be8d3f2325cf79bf74d7388ac3b6c91c2b2f90de4e98ce0d501c58e7a5ba382abca
-
Filesize
1.2MB
MD5c858dfb4a6493c5d826603ae2410c109
SHA16c4a4e218cdacc7afc610c58f5a150ff685adbf6
SHA2563c3747be276f824ad9be774f531d1c7ca986edbe7759f8a5517314edf00e5685
SHA5120b8f41d1e5919c3f3fca0a2b03eb034df560ea9af37a5d960c2f133abb9ce5b4f71914cf140243ae716c8ab09a461972f38605d40ad5ab7ed0662dcfe27ee23e
-
Filesize
1.2MB
MD51fe9eb9e1c3ace18531338238dfbdb6e
SHA1b57d265d1afb47fbc8cac465bff4360e19f03b23
SHA256d20f83622de72e9fbab8c25f84aae1e58c46f14d1fffaa15a1cc40de7cb556b4
SHA5126c1c8e34d389803eb937a899ac6976bc7aaf04ddf46ee3f55c57daa903978b306f4adf365ac69a60f6571da1236b75fee95969ef2d3a0b191a74a0a260862ad1
-
Filesize
1.3MB
MD5f7718315631ec6d33548fc51979530ef
SHA185f2f3c3494d9e114c651e713abe2c445413baa7
SHA256127999a7ef4d94c91bb0e33d14bd49c407d72050e279cf2e9f0dd6d53ab8f87f
SHA51231dff88f17c50f7e3ed7d6dd7310b0355c8b0b3e93dc6b121006188c623559d22d96d40e4121518feb2b4c9c424984a948d30e2f5e7a4c72574db977c48ac054
-
Filesize
1.2MB
MD55ba22ace662d8f284c86965bf33d0491
SHA1af25fb5a37edcfc16e01016c41d3d151213349fa
SHA256c59404d6e9c79559bdcdad7d6c61363a6bd44ba8ff971f2482b6e1d83a9a7c71
SHA512d7b297a5f3d078395f2970f9349d0ad3a7286422d26f300a8ec17b8646d7ccb196aa9daace3f16f9689db0b3074dbd54e310c85261b136de96e61e23f3f05d87
-
Filesize
1.2MB
MD5c9a0b562d9bde7353162c82ce8d95dbf
SHA158b018a532e098284356458caa8393c4a2cafd7e
SHA2568862039eba8d50635fdc3084f85d77ddb5909ecbdcb58940a685b129711cfd88
SHA51254eed684ccbe8b34ae1d45d6b16435c05b82401fa257157230db690907341b46bd254d9d63995e90bfd836302232c30b096f0b168c4507df557cbc76ac7bbaed
-
Filesize
1.3MB
MD5cf69e4da8930e4cc2ef8a8c222fbc922
SHA1261f470dc916e2dec2f479fa9f18a0b618240e87
SHA256950efd45c29541619d532e01652a04e4156aa4a512f9870fc45f54093b3a2b46
SHA51289b56b8bd5e7400d7179f52a19f43302490e1f1c0fa6e5dcccbd6a2579b5caf143f906dcffc6a849abe5166d08e1855f213652acded4474f92b20fd6a21f7df8
-
Filesize
1.2MB
MD5a2950eb78b5c3eee90b3c24ae909fa00
SHA137aec72631afea65b0466b73925ed0177d46aa88
SHA256c840657ecf23087a575158d07023e62bb30e0a84fd0be72c96b7670f7e53e95a
SHA5125b3af03bd149b17ff1574be859fc274dee7ce9307ad7ab1a08d216f47e827482853e458eb57d0c9eea57d5f694e707bebc66bbe401f2dad236a06ed959f2c7b1