Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
04-05-2024 08:58
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-04_a58a9e491ccf772f78bf94ad8fc303e6_ryuk.exe
Resource
win7-20240221-en
General
-
Target
2024-05-04_a58a9e491ccf772f78bf94ad8fc303e6_ryuk.exe
-
Size
2.2MB
-
MD5
a58a9e491ccf772f78bf94ad8fc303e6
-
SHA1
c80ec9b2d88b86dd86280b84099e6d419bc3bfa7
-
SHA256
21e30bdd24f9cb281877d85dda26e18b7901fe090d16d25a254a1be3c7d64bc5
-
SHA512
91cefc7d3da1919d93eeae07800939e6c097029efcef8c37187e05606593f0e7e3e0d6cf0050e88d7cf6f53663e31fd19c1704352bd57ff4f60f9fe37027fd47
-
SSDEEP
24576:pOObVw4TaN1wdFukCba4oXtgLhU3wEdmh58FsqjnhMgeiCl7G0nehbGZpbD:pOOh3aN4FuLbegmtG6Dmg27RnWGj
Malware Config
Signatures
-
Executes dropped EXE 6 IoCs
pid Process 4684 alg.exe 316 DiagnosticsHub.StandardCollector.Service.exe 4772 fxssvc.exe 3548 elevation_service.exe 4412 maintenanceservice.exe 2400 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\system32\AppVClient.exe 2024-05-04_a58a9e491ccf772f78bf94ad8fc303e6_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-05-04_a58a9e491ccf772f78bf94ad8fc303e6_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-05-04_a58a9e491ccf772f78bf94ad8fc303e6_ryuk.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\6145249085ca13a2.bin alg.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-05-04_a58a9e491ccf772f78bf94ad8fc303e6_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-05-04_a58a9e491ccf772f78bf94ad8fc303e6_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\123.0.6312.106\chrome_installer.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateOnDemand.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.106\notification_helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_98656\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2024-05-04_a58a9e491ccf772f78bf94ad8fc303e6_ryuk.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 316 DiagnosticsHub.StandardCollector.Service.exe 316 DiagnosticsHub.StandardCollector.Service.exe 316 DiagnosticsHub.StandardCollector.Service.exe 316 DiagnosticsHub.StandardCollector.Service.exe 316 DiagnosticsHub.StandardCollector.Service.exe 316 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 656 Process not Found 656 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2684 2024-05-04_a58a9e491ccf772f78bf94ad8fc303e6_ryuk.exe Token: SeAuditPrivilege 4772 fxssvc.exe Token: SeDebugPrivilege 4684 alg.exe Token: SeDebugPrivilege 4684 alg.exe Token: SeDebugPrivilege 4684 alg.exe Token: SeDebugPrivilege 316 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-04_a58a9e491ccf772f78bf94ad8fc303e6_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-04_a58a9e491ccf772f78bf94ad8fc303e6_ryuk.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2684
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4684
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:316
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:2964
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4772
-
C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3548
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4412
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2400
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD59e7c2fdc9f3052fc759301c86e60abea
SHA171d624bd6931dd03409f5cbc87fab13cf1723313
SHA25645883f6fb5af2a4082e0a10dfade9c31596d106624923f48b6258377ad2a2a70
SHA5126286a20a30810269d33b4dd876dfe8e64fde6bf1ef16ead475381949fafb6a852fdafd7ac540ded02cf0830353475629e118a687971f22f8ecdc71776008b391
-
Filesize
1.7MB
MD5d075489448e85fbdfa1d5c4c3edce406
SHA19b236d9ebc2176f892b28924ea176d35e06296c0
SHA2562722fda0ef9051028ffa098ea084adcf5634bc163da96c99f2c1c5aba2f9b714
SHA5120bfa012c6e46b6150dbb84ac16a9fa9392b6bcfbd219e35951632caafafc87f6907c696d5689eb4532219a1ec3b00a1a86cf5a0c0c41d8340482e221a34a3920
-
Filesize
2.0MB
MD57c77f1e398668c31dc4bfc106a0e4467
SHA14ece8907b922b75a4fef89806ca848c0435a886e
SHA256d6d8e5fd78fdd0c0dbb3fa3be5fa1ebdeabb063ba397599a9b1bec6be23a0113
SHA51237a5c0a037af7090b766545c7ef5d0cf79fbd86a62b85a7df4682087a9e2064abb6f38d4730b9b5d29392e2c828a1f90081f7ada3553665303ff5c8a60b46da4
-
Filesize
1.5MB
MD5b0b0a4d519ce977552313aaa40112432
SHA14957bafb02afe2ecb3ae26384c1f23d22db539fb
SHA256492c51a4b932352ecc2de1562b646a182f627dfe1ec99e9bcca2aed9f59f4688
SHA512c6ada73985f9d209f91673b94724420a6afbb2c37b80af58ea6a932c9a208b7a3ab2e7e07ef08e7e18c16318e434f26a174eef4c472d7f30633014d3aae5bddf
-
Filesize
1.2MB
MD577e5b0c58de9f466c1f5a09e56b00b4b
SHA1d2460d05fa1c6e5b704c029cdf386205c8767baa
SHA2569dbbff2e8b80086f22343b0824453a0ee83184a862c07f7dbdbf89869fac43b0
SHA5121c59d7046a1c45aa302ee34c3e251765354487bc5663985073a1bb256f13baecebb92343e61eb45630d1a1815cc6e137580cc14c7e7f65944556357db0727b1e
-
Filesize
1.5MB
MD57324736b8ce2d1831dcdacad302ea3ac
SHA1f34e629e7794517452316c8ece621f023eb4cd2e
SHA2566c031b2954cea38302b551ab8689ed4b395dcc9be339c908e8e32be431e9dada
SHA512f1c4c086dc3b001c192a4269e63de4b2eb806932fa207b59956ee8a6953d0e8b9e8a87c168b1957b0b4bfc3cec87ef6a76da5792b88dc98c5be13dee21ade0f0
-
Filesize
1.8MB
MD515057853f293d4159e91ead1cf650879
SHA15bc969822a917cbf33cb6b6daabba3dd61f1901e
SHA256701fba4124cb90d5f8c13436bedd4c55738643406d9d31ff67b2a7dd11cee916
SHA512d76846fd088ff379b11782ba0d12ba44800ccf94eb0c24ae45fc808fd1ad79440e54f48e8271c644b3371fd55ce973cc035a4f19972445ae60cb4cf65aaa981b
-
Filesize
4.6MB
MD5886853e51a9f1f59d19be821de857f91
SHA19e20fd7deb1862b19b5f3e2a113eb9a76e877c31
SHA2565a42b5f8c1f7e6226068a78571df1513a0797c278cbd215ea5f62485a8a18205
SHA512e994b92ac83f5eb904a2edd8b04d1c8a4745be17d868f1c730feb97c000999baefb181027b2326a58b1318486f0e39b9e5763e18f1ef6bf6ad47a1a5406ad320
-
Filesize
1.8MB
MD5943d263484c3c5edfd1c77b0a6424c46
SHA1d45c3318084db000852ddc4427d640a42e95c53d
SHA256174da6fba139181d9f04cd9015ef93478a2da64b507b49d5daeb183c71947fe5
SHA5122c304c4d481e6b3ad2ca8678595b3e50263f6a63ac44bdacfc478424a5cc470d70721273ca2ae0e484da21d8b2723910245a32bae83827d224c4d88c39baebc3
-
Filesize
24.0MB
MD55d992cff24ddb04d34af1be16a8d3183
SHA1db3b7e1c3c4c8bf19d512a8bce3c3700911a336c
SHA25691f532771071d94c1281c7c8a0a49c1c8d8036a86527bb8414291bc661ba25a6
SHA512dda1e4a332da4b728687b5deea0afef9f5176f58148c71d2c29d147a457e845210ed42adce2b12dc0f2757b5fa47dfce47ba611ab2a2f54a5bf03efc723b0cf4
-
Filesize
2.7MB
MD56a4b4f740c5e7bf9682b857deebe0ced
SHA16c6f47a3fe64fb2224f9bb2dd32d3061b434b973
SHA256710604aff7bf0c33a7edf272a31932f512605a8718b2a51c52ccd18e99360429
SHA512a10df94fae6d47cb1094e7be6b8550bd18059c1e5f72794da1b1afe5118a9b76a7dcdcbee142926ab950af9d5b10b76cee8cededd3ea4a64817cd7bd1a4c4a03
-
Filesize
1.1MB
MD53ba0cd3de84e8ecf91b2095a0e4150ea
SHA14577b83e983d1da61a074dc62ead93454bef2d7b
SHA256ed92a78d57b98483211d897cf39f73e254601dc93f2456d3b991289259be0615
SHA5126136ed3739dafa8fa1c60b1b2f18d71ae2c68106a5c51948afc440f82975ae39fa33666116a676d6ec6473235ae3cd7ac3a213aed5240bb852d9683b45f21431
-
Filesize
1.7MB
MD5d050385c1a447236895efabe3dde01d1
SHA1ba3a3752b1d49220339354a24f0e5f43f5c27dcd
SHA25639fa6465d9fb15c2a93366a7b9e69c450ab774851d007e41ad96b45c8dc4cd2a
SHA512998e5e614a9ea612b451226e2c5d1084e1c9789b658d2efed50083648db0b78d02af1bdecb279eedc3be618c97161fb02447549b8b308e05de0f34304e3edefe
-
Filesize
1.6MB
MD57cc786563935938a5fe3534a0faad5fd
SHA1e118aad9257f4595f45afcab1a7f9875cca25e75
SHA256a994edeeed28eb655630e51e5a7f5c8daebcb13c157f82cd71101de4b122d8c9
SHA512cb55e894e0fcaf49d209342804bc2d757d5e7006f857a7409808d08d25e353e9a721b8f47d8f74bec336d62ccbeb38b657e2cf6adf3beff4a60a6811d14d15eb
-
Filesize
4.6MB
MD53991002a2862490807f0eda2a123df09
SHA18a03bcb45537a71e5e3b94108024f09269214515
SHA25649ee7ed3fe2ca08a0090d96263c1b7e72f736b436120c10c0e6924516cacf83a
SHA512ddc7c334415156c0beabd97015cd7b55be286939fa00c4ddd22c3e2d9f36d61339998bcf3bae8ab6d507024d94f521974fd35bc8aa6d53d3bb2a7b2f2627e3db
-
Filesize
4.6MB
MD5c0c1023c53f35aba1f5dbabe60c1b45b
SHA1f4942869d9c46f98d7740f9ea9d7528c71cee559
SHA25630310dc92ad879bf65175d4b4048484de9358d42a774b7918185ffdae3746466
SHA512df53600e876cfdd42d1c8a4bda8185f1da58539d1b1245fee33e7b7c8a38b306f3e4a796f420f0ac382eb2af30d8d38f97ea87404ade79f0978b9162d0302699
-
Filesize
1.9MB
MD5da4d3d565818ed2f8e61b5b03e7c07d8
SHA1d0c171a695f752df7323ebb039601b8d9929cdb5
SHA2562cf744e732e80f9a9722769a4bc3c0982a4bc4c1b5b462f9e2150118400965a1
SHA512d3e2fd86cd54e3ca2b00039b4343e793d273ed78f577dac55f7c762e29d9948cb2ffd5330fe4ac42993151cb7858e75691b1d5a7d299b9743c364645a40b1871
-
Filesize
2.1MB
MD5c55a09ec08c6a8fd42d21164de1d3030
SHA1afe5592ecf3fd6e859b4a22b7c801d19f7ce1fb2
SHA2565f61e2135ba7d472fbcb141228b095c0a6ac894fb9931b28eadba8598c9a9f44
SHA5126bcc78ca626a9d002a06d38f72244707392ad905d595f6d56f3397a2cb04ab312cde7402cc2477ce35599ad88680da1cd7bde50ea1cb39e9fc1c04b70e633ea2
-
Filesize
1.8MB
MD589568d168c37f570a8cebc167765bcd0
SHA120eb30cc4f3d7725f626b85819ea932ed10a0e41
SHA2562d51434e583a017ac6b61807bce7aa062cba569f67fce1cc89ea5ef4e6cdd273
SHA512ed01d63756b168375b6beffd095ac676dabb26406f8b144b244757b52f8d5fd1a8dacbcd812017e731c293de74933f38314fe8b97a54ad247700416b79172a1d
-
Filesize
1.6MB
MD5ec7bd1dcd457e38e4b270b52c05056ed
SHA1e4eeaf389c28aa70c104037e3792912e6eed3f21
SHA256516a412d0cef2a1412c08d5d4a8758eed21c47b66fea2007528dcdc8542aebbe
SHA5121c63d6aeeb8f0c136c9afbf25c60018d1c772d9255b7489eaef2ea5c5ba92af5136c3f980ebce3919e2afd943c1306e6c608b9b506fa7f11d6829dacb416c73f
-
Filesize
1.5MB
MD556fe450a9221f6f8dba16fb1dabcce45
SHA1581f69d6e7a960a6ce0f41020c98ea240a54d908
SHA2569babf71a7532da41295589856a8bd341f7d8e70038cb489b190213331668d68a
SHA51299fb4a4e58fd0723753bf8804089037e024286ed54846b7d02f78fc6d4b1128120293fa3737b0bcb5041bd97babbabb549e832d3e28dcffc5bae993e408c916c
-
Filesize
1.5MB
MD5c6b3fb5c537982e09aae3352e20a8101
SHA1767b9f76d0174ba38d6515d3e34106b09db07806
SHA256d92d8666a2ccf84586cb2fbd427e3769e3fbbba0288b9825de09587d2883c205
SHA5125fc5c7b5105fa74d6bea5400f161b0874dbe1760d4b0c044be95bfb0feb4fa437e89cf62bb553917271637742a7b4dc02008db143313da66060f984d9aabe244
-
Filesize
1.5MB
MD5dd9c6b9f5fda9855ad98a95d77136e75
SHA1954c6621021fa6410d3e6aab1a81dcf0c8afc51e
SHA256063481a4ca1d299b7208545b7777b1948e950cfd70db52f5b11ffe10bc1c2dfb
SHA512965abeee7ed724959323cd0282f54a6d60442834e3f6733ec02d9c0c813f285da08f3e3a3578a397dc28b03321ae961dd17b86acf1f64e5c7b8970f0e40482f1
-
Filesize
1.5MB
MD53441e7a8d5315be3a5f52959a2dabbe9
SHA186dd8aab458226e217c24921804fae376aa730eb
SHA25683deb55a9789868302108eb264c7c449237d254631c2196dbf375592465d5fa8
SHA512b198f22ccb8e9520ce6b1984016f1898591f0c1a0391b9cdcb46e3045e5974b7e3779617e2638e2708162d76e832ab0d76cc508b12385cf70d89a1d7e5cc3c54
-
Filesize
1.5MB
MD580479c1bb62aef5aa539cd2fb2837ffc
SHA1006068d21a11aa8ade67cd262eacda05f9190726
SHA2565f8a0db6844e5179a409acc9c16f0f53133a8572c0f9aeda96b1f8d9a614bc8e
SHA5122f1671ce54ce6ccde015460eff0618909127554c3dbb76041fd6978ee8b329ead11c2b3e1784ad4034bb21e58c295ae8ef16f3051cd72c6352d342994e2675ac
-
Filesize
1.5MB
MD5fbbcad3a0af2e43a37218784ede72bf7
SHA1479df54c939e5d76da8acf259b3fc5c2a1fa47a4
SHA2564491f1689f09a06529aa8f32ea964bf9cb9bd42a43a0d34b15ed4509c3c66b96
SHA5126d8b632da248b3b7d6b6c87972073b2d0848fae3f94b7af3fa7f5d7db650f083d61dc9ebd5c8a768c11d7af5bb2f5ac386c7742b64ad32a087e23fd18871c1d5
-
Filesize
1.5MB
MD5b572eeb98f9ae07ee7388c0626d5e89b
SHA103a777b3db7f0a7316059563a52074684320afd9
SHA256c2c0ebca2cd4956d8bc0c51962f75d6edb5d8a0798d020d1c99616e32b6b1ea8
SHA512bc7b6be193958f07db5677d7136b14c939670d1354f2ec07e3519c6ff08cdbdcabe931745ac9f11b4685ce5e744101ab1dd8a4f56146db6297a92ccb635a0b0e
-
Filesize
1.8MB
MD5110cfb36b9514a7463d58c47073ae723
SHA1bd0b3c1585f5f7d7de9323d0d2d5657357a9a29a
SHA25679a33cddccd0609abe482e8447dc22a161d1e3b3907694b03e5e4054ea0bed3d
SHA51249fc8c655dcc0d7a5bc1a796fa12a47e5b39f74280487e6193e43750dd281e0410a022d84051d89b3c32101ec36469094b541a788c5fd8fa34ddabb2df4e6019
-
Filesize
1.5MB
MD529f151999b1d8d5beaad6d2a5e7ca8f2
SHA156987b7f523916711f8d719fd54bcf45756b1c73
SHA2567df34db1efd800df81d36c4d82ff192ec6dd38a079d5ea1639f7ebcbcc0baaa1
SHA512403b79116f8e50185d75a9683219cf246b1b9b20509c5b46ec60e2dee3cf0a7d69da8e0fe8fb096755fabd12be29462edcadc86b478c99e1e7457f01369daa0a
-
Filesize
1.5MB
MD5b927763084d6eba04d235f6eafbf67ca
SHA187a015f03b2d7fd9d4f235795b09c1c8d59650e7
SHA2565135b275b6a2a1304a70300523217737530423aca545938b87c9a0524cf5bcc9
SHA512e2fa81c7727d874770f1e53fd1997f050b342ec024914858bdbaf662e00e61325a896e9c1be02bdea5e83dbc49bd7c8ca015aec1c9a27eb93c0e924e76e747c7
-
Filesize
1.6MB
MD545b5d7e22c3d829bd8dce3892284e2ba
SHA1105b55777a326b452ed8c436d6939e0bbfb0396e
SHA25644c696b59ef6a5ea728f94d5d7d69bc37a25ccb8bcb4ec1693507b58f124e651
SHA512a53bd0e4ea2470498bec591f5c86a21d7c58a3f6c810551e919561d12c373fd98526a769425a20172e9ffc74279c282aa57020593c2eeb0c7a8e5effa097f35a
-
Filesize
1.5MB
MD5faaedd7718310a084d29bab4a146fafb
SHA1d3316db0f3a3d121ef0a72a5920dc96c6e924ba3
SHA2567120f7a79a98d6f66619991bc7b9a0c257424e1f8218d48e4e13b0d9f1bfb764
SHA512cfee16b5e91e69099cc11de4c5e5457ac00af3fb2e88d29865b9ca59115bfc52ceb3a43367f859589da8a55547549155923082a29e2e20a8f49eb30620c97f53
-
Filesize
1.5MB
MD5006fb2fe641c0a74a1de331474bfc5cc
SHA11656b8fa75b13f8ead813e50fb1ef1013dca958b
SHA2566632a3806f1c281c8fafc8ba7c19ad5e506108728ee0d8a570a69f14354bdee0
SHA51209a839856cb4e7da5692ba157dd22de41965298f6b5598e2442b62156b590762422f762a079e7c7b7371a5bb24b940ec96fbd1f335fd696ad7ae01ef86bda784
-
Filesize
1.6MB
MD570c92bfd882cd1bd55172f707c3bd8e3
SHA1cf14213ce44d26bdf88d7333cafc71524526e027
SHA256610249933872cc297db4cbdc5aa821bb1f6c6a460590bc752e6f48a5f2fca2d2
SHA51269700b307b897a3f1c78f291cf325f1485ef063f7aa7c2d4110e53e97e70a539b03711547555816aaa5c1f07455e7a3f309b43ba5d56cbe3f0168da22b36ea09
-
Filesize
1.8MB
MD5166054fe28e9fbfa5fb9b8e837399360
SHA1222a87907192e0aac30135b8384c8196e389574a
SHA2564c032f19985d51bba38de7fce96987ea49d7ab5d2c537f72ec72a335667859a8
SHA512a90004772f7f85722a6e5004c87bbc89f2aa846027657beebd94e3cf3464c56d5653ce658e061ed392820206d0245d3e6bb58134c848b955f1f7b5d382589240
-
Filesize
1.9MB
MD521555c9b9bc108f1f28cf97c81b2d6cb
SHA121abce15f3a23778db557a2c3093edf5ae15a807
SHA2560cc959b08eebf82cca2265f59cfa88d874d83de3008d1ebfd374f332f374e382
SHA5128ca1006f99d2d2c0fdf254e328d8d94034c78118823c650dbbc63d3015cb5559f463b4d40bd19f24a9b2aaf4ac7479391e920f95ebd9dc1cd143bad7afa8492c
-
Filesize
1.5MB
MD54b6fcca240ee5de8924b785023fb7907
SHA17f5387c1cff7dc04fb6354e8cfdd9a2cfbd2e99c
SHA256c2a93c5df0f45ed645796bf4de14403606c2afe5bf42abb38b259c5b045872f8
SHA5126db3b58eeeafb2f3066d243985b9445d68f3f51ef1963cb88b9c9a73b6054885f8af342b88e5e418076a6a10611706d3c18d1e2fa205af4afe48a47092fecbdf
-
Filesize
1.5MB
MD5b684a0cf86e44fd581a78d0223ccaba0
SHA16f71665fc8587a00e9328c0e52e821513fc746f3
SHA256f0d6f648a1971a2ba7a567ccf235f4f028275d22fffea8c916ad579f10c27501
SHA512c780156fb1ae4bcbb559fae4045a845abd967b5502f0d03909e29d601be82352a0568185e9edf6f1c30abd7ad6280ece9409eca75286994b6b9a3166da9926ac
-
Filesize
1.5MB
MD5b88ccbabcf93da7fc7e1462c144e99fa
SHA11612284c28af2923ae6177f66c8c678bede7c936
SHA256fec5a64abe948cefd757c38891885a9b16539283b035851ceb8819ab09abd57a
SHA51230daef25499be28c8160f46ec27927bbaf1830a8e27965fb25f24610ab632d741d81f906154a33597c34160540f31c415db8672ed6e7714dafb2f231be0284e6
-
Filesize
1.5MB
MD54090a407c4d3b6fee441d5ec5454a1c2
SHA185a4877315d446e6d71431087014fd08567e92ce
SHA256f9dc99ca29e636fc0d90880d3b078f7783ef95d549b1991827dd1dd7483e9a8d
SHA51286628555df97d39a2b348f4d5d3ff4a425457df0dd9b52823c597ca39e722126123b0f92e6c9bf7a44cf0aed5bc6a2fbb92c00016d07e6611efed7fa1d7b73be
-
Filesize
1.5MB
MD5c76c798b3410adc7df5ccf93c07b9253
SHA16be2aa8cc8d004d0292fe2335264eeb21d8aa52e
SHA25650c364bcfcc596423259933829d24c94e53069449b3ec1754815ec311fec3d31
SHA51251ff83d1b1c874fe404ef8db01719ba17146f912109ac7c9c0772d70ace84da8b04027fcdba9d74287d22edf972a41bb3cfeec0ce7ba1610ac8ead195cf6d602
-
Filesize
1.5MB
MD52aef64225a85178983786b83c0b6eb3a
SHA1f11ff4d31237427f589149ad54f2baea6152e2df
SHA25645b862731e70693d94e58980a6a429c86887e50ad0bac9c1f50a2de98a8acb8b
SHA512b134dca83f02bcb6486e52e51fee68d2db7c68407e5a9d2ec21968b768a3903911efeffda326895ac8c8f6eeb46ecb23fbda74b67045de6933f774b0ca987dcc
-
Filesize
1.5MB
MD5009b856a6f9b04df160d2ffe64456615
SHA192e40db970dcb422fdf52e870073417f1cd0ea85
SHA256077cd6f15b94387eab0757b0a45d2b92851668da1d49f92c73ba6d246fa8cd1a
SHA5122d11e9a884286aaab0a132fdbafc922d989ba6561b65fbaeabf8265d605e59b1f0b7595f16709726d71a75f1b44a125f570dcee6aef99779b225492f280b7bee
-
Filesize
1.5MB
MD5a25ceffb84841035ed296d2d8bc79e1c
SHA1e3f2712538dc8ceccc913ca36dec78188505e1b3
SHA25694fc0a8431da171101d26665660d338a13f8a4954cda2c4f424a77887d40494c
SHA51266de816520524153c0fb4cf94f7bfcfd411518da638faa39186ef852dfef936f5d2cca90f7854a9dce0e1a9850d495e995fa0a8ab810d183d55f61b40b97040a
-
Filesize
1.5MB
MD52bda78ceacec5ef59da3be5f30d41ee3
SHA15bc3c3555b8df0265c8a7051eebddb346bb54903
SHA256e1431f586844d5420c178289fa16652366328be5a082f1716c861c95ffee6b3a
SHA51267d8d8700cfa9aaad04121f6abe85052906d2a3a72de8c4c3cce24d509e0064086af5e4814b943a0f07825c8cb0e80446ec587c73d7ef0a53eededfb823b764f
-
Filesize
1.5MB
MD5ea09aa25b436a73bb7d6a10deabf90dd
SHA11a30a0b7f13c03cfdb139cb185cdeadaa2233f86
SHA2560e8ca0bcb090d3922aa3ab809cc2a9fdc76af8ea0553c4e502d7dfd98d5ea1bb
SHA5128bd9fd0143f4ed4d123ee3d07a5ebae055ab1019aa3de488c67427438769283393d79ee3498ee71de924d5e8155b6f12d8e7ca0b16c2d451fdffd6965f15bc45
-
Filesize
1.5MB
MD5b44196c3884d8cf26a07db5f84c2454d
SHA1015bc0f517a654d2a2edb21f6df4c2668f1eb8a5
SHA256476ff9d9ba68e974c819cdb7544298713bf4a1a4e35ba8a15729d9594934b7ce
SHA5127113f3752ee8c2bbfccc4acdf90a3eaebc16bc3b821a0ccf0c9f02fe4caf20648f4f40d7ed3dfa4f0c8a9f486f50e2c6d1b5bdcce155d55cdbe2b2c332e63b52
-
Filesize
1.5MB
MD51b8110af1681373cfbabe94d884fe45c
SHA1ebd084cacd323446631e97547ccb92ef437c37e1
SHA256cccf422292fac619e9fba77e967fe887237473b9cc58cfef490ea1962ec6847f
SHA51236c5bd493adb60c4a39e1be35f943e31b90acc50c240a168bbd4bfd80f56c59a22ad152cb79d58cf38c362bc0af6b10c56b6da43e94d7dcbfe7b3b6eec200da5
-
Filesize
1.5MB
MD51cbcc62155f62835ed1d5ef8d95c3e22
SHA1cbdb65c06aaedde395d03b6629527ec32d4553b8
SHA256b57a4f4fcbcc8e9b80c86b1d25cd3203797e88705f695f3a595538520a3705d2
SHA512ad287f06e9f5e1240a0113756c11a2952c00893a6dbf63fdbfaf519d81136178beb052e11e76daf73261076f0c57bdc878964b5e410893cdbc873dd89c2117f0
-
Filesize
1.5MB
MD5cb065f249ee89db6925d0b6624799b6d
SHA1c7ef9471567c0b77a9a655a340d1e3ec14ad265d
SHA25608fd38d11eddffb402e3997302ef115672b8c96a664983b6d2329a1dc8ee1a42
SHA5123049ff21595f0ac771ac2875594e0998f306ef0ce8f4d53e88a693ac8c315f0f621b2565fadac193bccf98a517abd4f79ed8961c3b7b9d40819c8951d91dd346
-
Filesize
1.5MB
MD576cf82878bc4bead413f95ce2ee17e64
SHA12693577acc87ef09d9adad0931e5c4ae0be11f25
SHA2569ad968fb36771fd8b78f4a3639d9fdca635d2bae9104f3afde8f3eb25a9b56a8
SHA512f3838f3c5bfbd8a94b39f080ba67ec871369e30c9774bc1fb0e9517653d1dece7b203c7e0d54ecc1ee7510da2bada7897a691f7ba81c54a0116db7af437035a8
-
Filesize
1.5MB
MD55a50d58b0ae54dc3eef138d8c5f8e1e8
SHA1a32d5a130b258c717f25fab638565e7f944d3fd7
SHA256c3568ce93c6704799e2c5679a621824220cd641eb08f04065b1c6bcaea018cfd
SHA512048dceb642a255a5329cca840c16286f02bebd1b732fbd453c8e06740773158de6226557c7dda004a088a39122ac2d8d465b0b66c3180c17648ab2487883ee2b
-
Filesize
1.5MB
MD5c60fe7168285577308318cd330a8cdb4
SHA1160d0d16387d41bb438aa47fdd45e0a092037472
SHA256c4b91eea3a146c2c63ee628f0b4c8244308448dd72c4ce1cef6285b2c39cab4c
SHA512e0091362c31e8c4975033ad2b18e9b9b35c5cc1afca9d82a2ef4b7c3c59ca0fdd0845c8c7073076042816e9970876bbada15db692faa25764093ecdb2ce1cb47
-
Filesize
1.5MB
MD5b17273e78c12342aedd3d0c6453fd0e4
SHA171cc3ccf61bd28868fb84ee92a26695c1e160aa4
SHA256f682bfdd3dd43ee99d103d27b202a6b23e53bc03b935f51ebb222a789915f43e
SHA512d34ebf47e0cb4a285178364035e8ff6be2beb0eafca7398bc3953dc45ee8fd1f84f6fde5e7183ab0f0f5bf8abb49e7133b38a0c441c24261aa0207fadf25c3b4
-
Filesize
1.5MB
MD5e0b778998742e677f33814d148a9d8dc
SHA197cb3285886737c0b99e8847e9dc0d8503febab8
SHA256dafc5144c3e4a29beea5da3b3ee1df3b2761cf8af13ce75aae65d7114187cb05
SHA512085649eaa47b757cbf3f3fb21f470d7656045f7f297702195403143c49c8b6af599b78faefe95d63505bc57748902af93cfa0896ded863cd10db83ecb0987434
-
Filesize
1.5MB
MD5938623ee73f37c2273f187daa8fa182d
SHA1758d2e8d39ee75cd6615f6b85633777c2038e275
SHA256edaf49e2de4a03861e5d562068ed1b209be3651b7567d13806429642c942f053
SHA512cd2e3cf55171b3cd865ecb96ba104314f73e8d38f7f750c32e18fc8ea8e24b040b6d44ae70e4916b11964acb413e2202eb205b02fb3b183e62d3dfad48d599fd
-
Filesize
1.5MB
MD54bcb33715f658954625a673c3e583863
SHA134f30a45be599ad070bb97f81a444f5fab6e1091
SHA256fd5ba8b93eae1fdf9b22972363affe699a7eff3761802369342771ef98091d16
SHA5125d3ece02e5bd3dadaf9894dc5b8415cf01a897b020a40c90b2b8184361c3cf12a57a762474f6df4aa35dc1778b4ddc5299a44bec877c42e0f871ac380b235723
-
Filesize
1.6MB
MD5632e188bc8c9a71b5b4f175fae8f5a5c
SHA1d5fb5359c0f3027f072bee5f06ead1f38541b3cc
SHA2568e8264ff2c5e27ec2c72bd21f2ef08c13dfd7db6ce7966c495bc024f9f398220
SHA5126994e1f8d0d0f6d348a5b0ccb516218cbd9ca8afb9c94fac745f046ae98838f75a1d1a92a0e91538cdf356616957bf7e38fac3ce3be2331dce96c30f04764220
-
Filesize
1.6MB
MD527ba020b493828bd0d38fc7fa4a7d6cb
SHA1dd373c641adc38fb19b06c76fbf6cefea675fd05
SHA2561a907064747526921b769f23b3495dbcd78289ba05dc21670511d34dc03609dc
SHA512ef5f0d67a75ffebb6dfdd2a0a74985c6c0802116c575d0473ab4723d28b396cd05e19ae311c81d1040fbf792b1a65d450c57be409ffdcbfacdc1241a571ab5ca
-
Filesize
1.2MB
MD52f77c79af6813123be16b269bc2da07c
SHA1df5dc32f9c43435dbdb3e6ef713b5e588d8383b3
SHA25623bcb92cf97da64988739ff594c990b21fe060af5a23744f4b3d7d4a37c95e1c
SHA5123cd7b1d465d5e1a258ae878ea112b3faee9f5ec36eb4050064cec7830823375f898b887a1e794ec86d095e0b120308574e6e164dd77f137aef555d437d6f00d8
-
Filesize
1.6MB
MD56893008abedb855d3306c086971943b0
SHA16e5d3fffcb636e388fac6c994800bf061ac82b19
SHA25617dbe54d25e1c2a01b657fba2451fb970d43652455738eeb8a5a36a525ad3bdb
SHA512298f70cd0b5bddd46ed661746a75a522acd0e90d91cc750de325562f7efe18aa4e75c2a9dfc7081791d906a7f77ca833effe0b22c7bd6887f04f526e10e8487c
-
Filesize
1.3MB
MD59f5707374216d9b69da09cbd9ca61364
SHA124ab2461b8aa266d5e809d627581c926900f3485
SHA256c78d328c0ef71ec4f2d5fb28c137138923354b9b446ac5b37661fe4d56f99d4f
SHA5125bcd2e9299d0c2e8285ceb1e9f6d5123f64a4b7f1605a6af6ba8d29bbccd81e2ed0ba1e90fe9d155f565ae31fb64b623325936a6932112e7c75c6f72db0ab3b0