Analysis
-
max time kernel
142s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
15-05-2024 01:27
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-15_218a19a3c268fb3e2c7a58568db8a9bd_ryuk.exe
Resource
win7-20240221-en
General
-
Target
2024-05-15_218a19a3c268fb3e2c7a58568db8a9bd_ryuk.exe
-
Size
2.2MB
-
MD5
218a19a3c268fb3e2c7a58568db8a9bd
-
SHA1
a63738f05e5e842b13427763ea9bcd6aade9cb30
-
SHA256
fef92ce089ca35dc6c2c2c601285955d1e291d5593467853389ac777b41ae623
-
SHA512
352842f60fcf1aa1da3da9701b6edf57b3983ec1388e8d74954f65090fd09758a23c7cd6b43f7cee2fc60a09fe23bac32b768d6e6911e1c7f01830a5072603cc
-
SSDEEP
24576:WOObVw4TaN1wdkukCba4oXtgLhU3wEdmh58NSkQ/7Gb8NLEbeZ:WOOh3aN4kuLbegmtGVkQ/qoLEw
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 4800 alg.exe 1800 DiagnosticsHub.StandardCollector.Service.exe 1084 fxssvc.exe 4940 elevation_service.exe 2624 elevation_service.exe 1932 maintenanceservice.exe 1756 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\System32\alg.exe 2024-05-15_218a19a3c268fb3e2c7a58568db8a9bd_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-05-15_218a19a3c268fb3e2c7a58568db8a9bd_ryuk.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\93dfbbbe1ed82f9f.bin alg.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-05-15_218a19a3c268fb3e2c7a58568db8a9bd_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-05-15_218a19a3c268fb3e2c7a58568db8a9bd_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-05-15_218a19a3c268fb3e2c7a58568db8a9bd_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe alg.exe File opened for modification C:\Program Files\7-Zip\7zG.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log maintenanceservice.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe alg.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1800 DiagnosticsHub.StandardCollector.Service.exe 1800 DiagnosticsHub.StandardCollector.Service.exe 1800 DiagnosticsHub.StandardCollector.Service.exe 1800 DiagnosticsHub.StandardCollector.Service.exe 1800 DiagnosticsHub.StandardCollector.Service.exe 1800 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 664 Process not Found 664 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 976 2024-05-15_218a19a3c268fb3e2c7a58568db8a9bd_ryuk.exe Token: SeAuditPrivilege 1084 fxssvc.exe Token: SeDebugPrivilege 4800 alg.exe Token: SeDebugPrivilege 4800 alg.exe Token: SeDebugPrivilege 4800 alg.exe Token: SeDebugPrivilege 1800 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_218a19a3c268fb3e2c7a58568db8a9bd_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-15_218a19a3c268fb3e2c7a58568db8a9bd_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:976
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4800
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1800
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:1276
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4940
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1084
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2624
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1932
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:1756
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5b29aa562fbccfa47ff126bad3a9fa443
SHA1b4c2f8f9edc42c349a35163041218eed5cd3bd85
SHA2562b88d55fd6dce70105a9278530da19c35d92242b1b3659b5ecf56ee83b9c48f1
SHA5123a82d7499a8a26d7aa363ffeb45403edad843cbbc9b4e3873def191ff03b369adfd532649d69a646e93cac702e1447eb692c5e245978990225554f8c023b6b42
-
Filesize
1.4MB
MD59f278cdf83e1f3919867fab1ba4e6769
SHA1da4ba1303ccfdbd514b7f3409d553656b05bae58
SHA2560b83505f0e57dcf04d90d33a41d98b524e7c06da7c3feeb7310bab02fc2b1488
SHA512e6eddad78fae7ad71883c749651dbcdcbb808573d4124bc475918a9590af2ec672c21e5c5bd3c17e91839bbaf5f6a941c671d99441e638c162e887e6938e5ddf
-
Filesize
1.7MB
MD5c0ebdf0a85a854d0de2812ec6a25700c
SHA1b9e677e6b15813e4e4d0dea8e699b2e8b2b963c1
SHA256eda7e9acf6f28d45a361e7389796ff830fa3bed7ebf1d26e089cb29531c7e413
SHA512b58b6a12342ab27b30b19e656ca16ff8988d299ff73caa0a2b9f655113732be705758bb0dc7de9dc914cad5f9118db655d9c221321ca897fdc05d07908c1cb5b
-
Filesize
1.5MB
MD583c4ec581d9128177511998f479bb8a1
SHA1ce41e695f6ca1192d74e9dfcb7f304ae7050b59a
SHA256f9579cb1a70c71d67083a248c5e222e01b87e9508f1315de4777456ceacece23
SHA512da3b248b64e4c36a94df49a104d18b19637d4ef1d82d2d768e37b1bf07d15bed9e299fbef68017c821a61ef9e63b0f4c1a01ead1b1c5fc51023d775a84137bf7
-
Filesize
1.2MB
MD58fed27f2da3f8134c82ef9a8930f806e
SHA18b432626313aae7ea7d3f18949bcd4ef9009f5d0
SHA2560bd6c1edd005fff63c1c9b0acde57c322530834a5756a1d71598dc9717fef0f5
SHA51267b73ecd6b6a1cb5608531f07db50bcd45aa10fe041177b4be2363078147b5e45c4ef653b13372b50594a5c4ed45cd36dc17c49651147828505275a4ed7a4395
-
Filesize
1.2MB
MD56b7816f1762f00a51f851884eef02e59
SHA15efb51a6662eb7d5ab1c06ae65e1221c08e2e655
SHA2568a9bfa5ad66c32e2b2b97cd94b3f65cc51a758231157260325ccd3946f660a18
SHA512166d08f6aa485efc0fa937c27821d50432da02ee0868c7d096cfde5af021a3ef70e17c1f5d972b74d6810a06ea6566e7233197b579083576bf2da3bc7f3718b2
-
Filesize
1.4MB
MD563ec9b3e5ff495fee7d9f4406211e37d
SHA12018ccd3813ea2cace248f835cb134158285b930
SHA256c641024600e9fbb0a283d45ba132a70b70baefcbe8c7912affb06defad1760a7
SHA5124667e651334be81a7022f98ea1ee2db84a9b3b4825bc0242209239578a316cbb0831db1aa275286c146008602c47b2c2d363704625ee0a3b3d499d37ddc6816b
-
Filesize
4.6MB
MD554eaa803d93a8f235b17f9c97f01e47f
SHA1c98d5899762f17c2150ec28c9dadffb83ec7da56
SHA256c22af96c04eef07a4f434cd46b9991b3c7722ebb9143f713fb68e2cbe78cdfc2
SHA512dad6ee8b39f543faf83a69b5b4e85d0de05bbc90155ea16f1919850bf78b0f779382750ae2a5761fbb5a95e9a3ec588889fded08ab075f1ea0120fc8abba7e52
-
Filesize
1.5MB
MD5a5c44fedb07de5cdebbeab5fdf0c4dd9
SHA1093d1098fc762ef31a4dabb0b034a61ef98d7068
SHA2561bcbae3d47d8424032abf36339ee2bf74b3641f9200e5d5b0338f2d8a996458b
SHA51220d16e094c233d8fa9235c6b8fadeada9cbd410acfc9567cc7c3061d73a43a9646272f1d228d32446a2488122c4266eaf5cea0731ace3337f947d995174addac
-
Filesize
24.0MB
MD52ea403e5083268cac6d4b2c8a3ad45af
SHA1efc3b1e5a3a5df80a935668e145ef88d98a29447
SHA256b2602e1e5d4d56ee095cafc3aee668469391051545cb6141357ffca106943473
SHA5125f0c0075dbe7997e3e51f666cf61ec9e83513c613308e68a37a14b21d2cb0f0215db6e1cabdcc8e7d68cb38425479de35c8b4257d5ac615e13b6e6d470c0dc23
-
Filesize
2.7MB
MD5e04547c2f1a139db071885abb97369da
SHA1b4a14666be86e8fdda352a04e2058455fffe3a3e
SHA25624bf163362b676e271eb0800c4faa86f463abf478630c1228870440f1228b6cc
SHA51246ecb09a2a4dc382437987725d6a05fff52449ff02ca098eb684b7ae52658875d492add9bf708c29c2fbf3171674f18969b65b20e264567eb7f3fab41efd013d
-
Filesize
1.1MB
MD5cf889cccce165548be17633745a870a3
SHA132cd137dd1870dfc200c0f13f5a59b925fb3185d
SHA2563c240a562860cd88651aca1e5001f8f68040d11737788e00a5480c7d59915ad6
SHA51283cee0deceb8c39656e432a43424631cfc87213819438d7bf18bc73b08ad8cca90114bf96e8852f147a57b49c9daac07291273514bfb520898a2c078864848ef
-
Filesize
1.4MB
MD526338d72171003e3ed5b2a4960ceb7d9
SHA134a722706cdbca8d6e118476dfd3eecdadafb178
SHA25659fa7ff16c0a5f90111d5f6d145e21879b424b1f6d601865ed790d7c54ae8310
SHA5128b91dac8c424fdcd8b7d3575ffc8f83edc1cbfad60f0fec7cdf3fdc958db6adab75556291af44598a448899d9aaa403effbd96709510d0a35778c9782d90d588
-
Filesize
1.2MB
MD57d03a68b548b956b60447fa0af37f6e0
SHA1f8d2cea011a794873378c828c8722e0920be0dac
SHA25651263d43793cf6469f53eef4b47110437e5ae71223e727f52b032bd0c9605c83
SHA51225e2bcedd84189631e7bb1bb7815724f3ba3f1c9d8ce5f089c4b1f3b078a64be14efd9f9dab3ac6837672bc15d10be8e69409d4cf1cc0cd57e0daefffd7dd792
-
Filesize
5.4MB
MD54face0a19184c615457a77ab72276811
SHA1dcb04aa7d72e2aac3135f3ac320f706ba53f41f7
SHA2562203e1b30000e375cc9da7307137024f2f483253008f51013d72d6b5e23dc614
SHA512df6d5d6ed31867b6bff0a4b8961dce281ad1c0388feef290160f3337836060c70ba579542f23ff8d9dcaa40c87cf3500dd20da19cfb9051f3748cd21a2bdc0da
-
Filesize
5.4MB
MD5fa5e9d9f6ab3496773e8aca34343ec94
SHA13f1c2b91d49c449b7fa3e41150de86c27b1ff105
SHA2566c4bdd7b4469c6836fbea82e5a3708b331139f53738179051600979773ee07ee
SHA5127b7c19418898d3856f3d3d63a4c5f5fc4b75410a9ef865ad012ee9ba3b15f0cb7a0896df68d7f1297957994a7a6efb7d7a9770a6c1a3c9d1d2b6273666fd6899
-
Filesize
2.0MB
MD5629814a525aa13ba4c9a4227b4af9477
SHA1c070387a92d23fb14d0ec66dae95cbd6faf97f90
SHA256ed6a90eef47491e26913325b0fa556963c8c6c4c91a1762429152ae8cf47fbce
SHA512bd0cdfa8b408db906bd248316612e86ee4094393a027c50ebafbd4a5bfb8a96966a801e48476c7aa3f4c9b556ae569438724cf7492d541e82f5d5fcd51495ea8
-
Filesize
2.2MB
MD51e6f0646fdac655a7cfdd856de2fdf6d
SHA14f6f57b33e1b0709a59a80a426061e8860a3650e
SHA256e4fb39d0cfc49136a4434afcf64486ccf094663640bc23f1939d28cbaf4b63e2
SHA51239c87cd1f157b2e28d6a5bff6382eec6774e87fada6cadc7e300f0eced7fb863e9ace63b8f8a18b6bd447374546c6141ce7ee69388440380659e4b55e26c4a60
-
Filesize
1.8MB
MD506d43fd56521d1de4c31555f36f751a8
SHA1104713b3cbc4b3307fe876034e79ea17211a4c24
SHA25636c034291808a5c98461849e7d4e53ff8040604fd12896fd9196d42ec0b75d64
SHA5128d0933c9515feef453f4f425e0797c6bb7711955269119e13bc3356bb850f2b4871196fc6ae187f0aca96e658e26314ec14389a4612b3715324e5ef9e966ecec
-
Filesize
1.7MB
MD5d2426f3b815e1d76b346c507713762f7
SHA18dd74afc7b1e51733f24f597d2cfe3d166891193
SHA25689b24fe2ef0c67c0640527b76475121d17795afb73424216c04057bde08141db
SHA512c34e4743df68dd0acf6815a70a69c5d1ea9105cdbc220c4b95fe02ecf5fb7e114dad463ff8dc7b731027e3802797113500f94a3459c1f11b3709a9be3f65434d
-
Filesize
1.2MB
MD58278b3bb11c14b7aedf5dc5a11f917d7
SHA1261599592cde3551d849f5078747d6cb035968ea
SHA256de21c399aa85d2366ae2c27c0cfc7c9ce174c3a0ba0bedd32042dc5075f3924b
SHA5126ff0b2b7e0f638ed4cdafdb83f7b126f2951367b4c7f91a8e27b0a8e2f616b43cb9e2f052a9e030473d38146ea384f4999a5d5e2d24b8909a44b59d5819b93ff
-
Filesize
1.2MB
MD5edeaabeeaaea4e3937cf3f03ad2fcc07
SHA1773f3a04a6fb46aa1009f6c5852f0182547f8e4f
SHA256e49d1c694e588d410bacaa5072b8dc816e2b9c281fa8a849c9ab3bafad45b970
SHA5125798864f2f82712e652b39c1fd1bc043c7926f895c7a8fcafdbb2f18b7f0e91cc0006ba5fc8e1f9caa642b707eae3e66e8db2101b0bb787bffe8d7b529bef4a7
-
Filesize
1.2MB
MD546eed0a88112e8a421393b6e3f6dbee5
SHA19e32697a139e8700d490d0504a268ccf7525af55
SHA256b679ea850295bc688b73a29fef7d920603ea9cfb76e2a6426df819ff882441ca
SHA5126a4f3d41a22f4b2b495ac28361027dd4e36e704f6e560852a5b834c28e7e424e6183e892aa110b3e77d4370c2cf31f364ac910d3bbda55ac358766a388e56963
-
Filesize
1.2MB
MD59618bb3c29cad4cd0d937a90bfce3d05
SHA13ad4c1c655ea58ec3d2bf2976689a3ce16fe74e1
SHA2565c17e065bbaf8f75e83e0f8af9e0a637a0582cbec41cdede7c841577c09b0e3b
SHA512aa342379cd14a0780adb80696304f02a0d8a64232d1cf4013b71e0321e06e44cfdbe221f3ce5354ec180bd94fe84ca974b205996327e38d6bd257468da82e270
-
Filesize
1.2MB
MD5a81a08c91fbec8949bd86f6bdb8e55d5
SHA13a13fa2e156f957abe0288b84ec7820096e255a5
SHA256ab50c48ce2fb74e071aad6e680438f685040b066b3f1259812e3cbbd35c4ffcb
SHA512ee7e1e9354c5026b608ed257cf0eeac7ed2fa8a84cd04c1c2474a35e71c6affbb5b6e7f22c37affaa47531ba8249a2534f4f68093c9cdae8fa87931a2979d4ca
-
Filesize
1.2MB
MD58e951604bd6308f8842ec3a79e9decd0
SHA152d7a94da8470b54b9df67858c8fc3661b4aac98
SHA256b7985a6bac06595287cfdbfa1c0521c7ac77627d735673390eef0444d175686d
SHA512c9be227c69464a83cdbad3ade518e5c58e521516af51eb21b56428b82b31cf33aae07328d2bb828710997d53da1d7deb41b71e3de48723feebf2909155b44a6f
-
Filesize
1.2MB
MD5652f10a8bd164e80720c91d3d145dcac
SHA16f5d3dad47e7a2e7e56c022a2acaa3bb76098cfd
SHA256d37bb017a51d5d5b05065f47e17fd9cf26adf2f7db03234e9ef114bdbcbcba8c
SHA51225bd011012d22b7afb6a77219bda3234adec472f0d864282977ecafe0747e1d2dce2e21471472273e959a2f50dccc0bb085c75e81ad78fe91b9e1264bdfc98e4
-
Filesize
1.4MB
MD5b64fc7898ceb1e183897edd0cccab768
SHA10edd16cc005c40730e5d9dc995b555283c5de84e
SHA25630692bbc65685cf493f30cb88134facb2a4a747506a1bd2c08a6cfd67443e2ee
SHA5124caae25145af3c2291666528454dd703d83f71f6a65bc61fa8bf4aa771f1e1e25952d0fbe128b636bb5d2fddc9a91e01806c619ebb6aaf02f1a596f09056a6f4
-
Filesize
1.2MB
MD531310b46f39a2993b3e0b8a7fe2b46fc
SHA139fa823d7ceeab175832aa78f77201369a8a8089
SHA256912273c2c859664afbca55c9faeb5e368510ebc4700226bbe66da6cec361b396
SHA51245f44ce033ab9839c4424368ccaad4463b65cbb64cd94eb2e55855089e785ec78b40257a6d6e4ea54b0052695d65b04ab6517b581f5ed7f2dcc1b93706606949
-
Filesize
1.2MB
MD568833c318d9dd1e17667d01604425874
SHA1d1e2c4cdd0ff8d06c46b1d1dac51b0e65112153a
SHA256e175293d574cb3ed54302ea765d7b90fbe2290644fc6b9681cad5ab3c14b4d5c
SHA51232b70d4a21f83ab7b753ad5c0b8157bec068370001eebc5a9d1dfdb63925b67d1620f3e70fd9ea2d9bf649916ce029a2ff3353740e3f188ec37aa3a9e45d9382
-
Filesize
1.3MB
MD54c373885bd5d82b4478c9335b906945a
SHA1388f3639c977a9b63a166f8267e75aa7158c24a5
SHA256618a189fc72d6630281f35e35ea19c84e3d902816e7b5482996f6b79304f8f80
SHA512a10a5e23e33257f9266771aaf1828a639020e2c2ad2b5c3a5eadadab2243f7b2d569c11467008dc55d094881073e42445e29c7668e7599c0ac0c4727bdbba183
-
Filesize
1.2MB
MD57680d38eaa2f90e74261e518f3e3da8e
SHA1b4d0ca486852c9e2f3b5bc63e3b68d1408c17f4a
SHA2562de2220568f9b8b2b66bba5c65f7cb0c1aa4d07c78303b8ee1be66142ff5a51b
SHA512a9cd2df20c7d507815995cdaee4cba30fff7a02f3d247ba8e2b176f5126ec5402031f205c95e4d7bbcef3e70e5f378b2e36961b1aa3264ebc52758432863e1e2
-
Filesize
1.2MB
MD56e2ea5d75afa36743499737ad1b30478
SHA11b45398c2bf368c715eceed69ded02ecf3e3b527
SHA2562a3920aa763633cd989b182b4dcd91495a000b6c94edb5e93eb7740796d353d4
SHA5121c6db616eb895032123b3c1c8b9aae6d9db6799faed25197a10b5072b8b5178a3182c767c0f5f6ff8f07a809532234f6c545216134284290afb456b52762fb8b
-
Filesize
1.3MB
MD5fb587d2650471a58ce8a3c8523716653
SHA17171631865c730bb5ae26ce6213ef8acce9e67ae
SHA2569d12e07e55a164c0769570a949c174d3c7fe22d0ca4e1e5ccd06081fd2a50560
SHA51279585998edbd23b39c5b0d1a3bb6e4284adf7a90b019e0389623f35c3ee7f2e976c3e36f3c443483f1faaa95643b86bc9f554b86bb90b9a052d04001980560a1
-
Filesize
1.4MB
MD5e5c7ed4e8f8f7795342d05c76e6ac875
SHA1f49c3ba79444300a303998a0073d5654bdc0e302
SHA256abc09ce72d824ae477d9267bb2faac7cb378bc965a39ef3822748a24e95c8a66
SHA51297fce4bfb790613c1e10c4bcb9b6ddc6aecd6b7b7eef9df3ddd412b832918f558c7766b63e6415bd06943d57bf40aed6ccf4073554d12f481dc6530ef7679e34
-
Filesize
1.6MB
MD53920006ee48c2e51cf8495271a2305cd
SHA17edfa0f4d0fbd05695f17395fc481e1d7de65dcb
SHA2560f15093e70a124babe4233751ac5097cfd593ed189cc5585fa4e5436be2c48e9
SHA5124f4bbe156082f80e31790868c4f3a32af09191dc479fa6e5603f63fab2d0b7811368327c0f9fdd993f0ccab87e4e3f4cd3255d425ef44bd633c883c04d83beec
-
Filesize
1.2MB
MD57a92be250fdbd2bac35114ebc794e722
SHA1f97f586e701f985c7beec5117715d052c9a29e80
SHA25685aa76c4b40f4a8570d6af04be1d563a9ced21780fb713a13b335ea48cd2fd25
SHA512948e832b75dd741493ab3e57406510c5b0bc2b2611f92b9f5e674abe3916baa42b2ca5cd93bb7dbbee5dd9e68772b9e8dca0865663457aa4b814f15fd9baef76
-
Filesize
1.2MB
MD550265a933c170de567ac310077f08114
SHA12973fd557049775c587f7b738f51eb6dfc6a80f4
SHA256052b32c9f2b5f9b20e4e856e26808f36202b8f5738a59b190a9d607e6458cfd5
SHA512c5b5752300fb0b2d53fda308d048bee8fd3a767474a63bba1d3fa7bf38fea0add306e99060387ef1e3846454c176d585d113f3f5f8a7fd3dcda04a0fbf9be70f
-
Filesize
1.2MB
MD5ff21b430038810712278b07cdff39236
SHA1013b1dd4e9db16b15067344da458c81eb66f25e3
SHA256faee7bdfb3f44397b99d3d1bfa8911031d76054c4f91d896ec971a5a02b63c48
SHA512d323fceaf01124238a7a477309c302c3bd0c0d4ac2813f4e0f289f3046c79f2c850dbaf825a816a8369d9be6c838298333be501c5b1fd318db6ba246b986af68
-
Filesize
1.2MB
MD5b98b4cd132df1ac494d229618cecc14c
SHA19bfa6cc602e7691eaa9546665d5f4abf6e9fecad
SHA2560de84781670be00fd553455a5f7de052e48f9ec1e9c3bd593e316bea970603bc
SHA512cd7ca7693a366cec6c30e255e57e510b39934f7d5e47965e027377557c3d41069cd7a34040aa448e96bddab1fdfeb7f862aa698e15ddd6f5d1a01bd335c90623
-
Filesize
1.2MB
MD5f1bce39c2d7d6a33070623efee525d63
SHA1516bd80c3067c53f5444c52b9a76dea7655bb68f
SHA25622600ea0cb9f83d0720bcc768c9b1c3bdd1b2d16297ebeb9e150ba8169fafca1
SHA512d3b17a6e029b2faf55b0ac4596b6c94597247b4b59c91869a4fd643499b0eb0f8710cd59258a4c8b0185204f2a64346b47bc1688908abbd4fd4b3df56d32530f
-
Filesize
1.2MB
MD550f358574662cc47e5892361c1f323e4
SHA1ba12c06b1a9fad87c8af98172eb9e05af72db764
SHA2563609257e203dd1b499701ae27098c506a4efc42e7fa3486f78f9c4cdbab01c33
SHA512a6db9edb5aaa8a04f89594fc29d05fda519f962e11122593b56f622dc3a76b7ff68ffd6fe3a1590e1bfea0dfd740fb1cb553df3d735d4850992e2f9a1e27937d
-
Filesize
1.2MB
MD574061ff6b312f1ed1fcd9f355c3f7814
SHA19af11ada864526fcd95ac2f9d268b922ea43b145
SHA2566cfd9df86784f616487f78a2b71b1c8abae2a2661bed7fc5ccc2e66182781814
SHA512d4de05945e00b4a53dbdc5c453d810adf940a52e210ff19627b3c66b3469b50372124d316f4860c28489ed562ecfb99506880e1394a86c898868a4097e9f8622
-
Filesize
1.2MB
MD5c52ac3ba31699c2a700ce40a203f4468
SHA1d5c92aa8039057d721f4fa7a9e9f04fe75a6e10a
SHA256da3e0cac358921fc3d633838ec7843976c3f5516af0b49d7d3eb8a0edb4c6d9a
SHA512d08e1e6d3f317cc7a3fb893e6c6166f8be7e1b64d392f179c3ae4891dd588300ebca7d6820b293f8026d63aa639eb0dabc2af6b21db6463fc141eb0593ff40a8
-
Filesize
1.2MB
MD5a1866ed1fd445d00acd877fba6675ef8
SHA10af020b32bee6c5206ad6f322657fe7c62a68047
SHA25633b905a904898486febf6965e1c525c7e447e0218c2ab29d92aea25453ab403c
SHA512f53461968b43ae986a693bc280ea5ce1fdd6ecaa7634dc9221510d7cb8dd2c2fb4c115e75ecdc61cb837dd13f7ae900d0f99fd3fb3f308a13e1f0c9c18d5e844
-
Filesize
1.2MB
MD599eaa6845af2755086721f961188cb99
SHA12695744bbc107ef079292d01c7b965b39568805f
SHA2568635ad603c5e31c26edbcc66b8e35b4fc61f2a66f792c40667d6bddcc0c7de42
SHA512afbf04883183b0c0aedfe201064f06ef4d81cfb0642702464ef53f2aa3b62bdd3a6450b4d05c304a963481a08ed8dc57dbd3ab0ea44af5d45599324a4ec34e8d
-
Filesize
1.2MB
MD530b67153389dd83cd2d363242b7dda65
SHA1b35c737cc3decbda614beacfea180f52b4df518a
SHA2560c715eb1af05026c7f9377ebf52f6db75cbd0c613041f5b20a4969d8608e8262
SHA512fa83db429d0cc652529ff0e8d98896a52cf7ed8fdcb2376f8c300f10ebd5d8bd93e1705eca8fb78a48ed2be96b682c2b7b32ebad3292d515f57eb4052c99c2cf
-
Filesize
1.2MB
MD5f8383f4095842ba6d1dbc63bac8635fc
SHA14e6949911a51d66f87df028d475711248fd03a41
SHA256b3bc25dd1f4e97c2f5e552f7941d1fe679d1349e626b6e907b46acf62f91202d
SHA512108cc84265e2762fe8e32e2e968495f17e66fd8517fd76333a1fb29923ff943a9d603fc68d21e70d890265556e553d23e2a32b4e25ed7737b9b7b054896d83e1
-
Filesize
1.2MB
MD5f4a0bc327232fc6d04c275293aa378e9
SHA1a0df61887c6cbeed792c1f54aec76e09f3fede2c
SHA256b51f2df5e68447c56b38c7d4c35a67a3acf85b4fc45366109ef0281e50110a76
SHA512af144d4a77d430b76189419831b2d37eeda64267926e109add0e37fbe89b8154dce52f5bddbd7f4dfacf5befc1666f10bd9f41d1fd442de89df35fac70c88102
-
Filesize
1.2MB
MD5f19e28727d75fd3f22f6bdee70177553
SHA105c601abc191d3b446d2ac792c13196ec60127eb
SHA256d9079a66cde2017c4f542a55c94f3fce6222f6464c3ff8f6c7aaf076596febf7
SHA512eb2c781ea0df302d9d9f36010ba5574b98f8244b8b3da8dc954b11687cc8e3cef8a2da265f2c0eada143a69d356655076ad3366214771dfc2a5071a5d7de4119
-
Filesize
1.2MB
MD5a1d5d57039a5324c5e552c3b118a6637
SHA1b9bc5272c4fdf95c25ac0ccbf91c275aef66605f
SHA2567a1835ae994819f86cc5915658b49cbd907428fbbfb64aabfe917091d86efad9
SHA5126a76143006fccbce080eba90677804ab274216a5b8d45c1f4ff4cfb7f7466768be7fe2820cc30368bdeb45789bdf51861e79ef2e4b8b86ab8f193345e99ed3bc
-
Filesize
1.2MB
MD5456399819f073d776a8d0aaf68e9d2ec
SHA113b69421d29300242e32d8ea17133c5e56e331d6
SHA256ddb79bef501da793a8a7c4677980017717608416f0fbb5023e00c5d56c462619
SHA5128353e495bdf84eb484c5db18b4c2e2f82bfca8b3f0bed2a9f1939d44fdeb8877c689b2a705abfb916b5b5d97ef1d55dc1e2bdc5446afd57a08de3d9d6c4b194d
-
Filesize
1.2MB
MD5b81766405a49729c1dd26ce45d24f5b7
SHA134d0af47244d57f1ea958825020177d12cb61fe8
SHA2566825c636bc5e236f5be8e7cf04372104a1242466626939513213f66bb74a086f
SHA5124c4eeed498e7f1317696d1942729edb1f7d034a72556036a7db88768a2bfb753a46ace373f52a5d119fdf29e44417555162294124e70dcd81aad739d75a9d864
-
Filesize
1.2MB
MD580a79403c315ebc90cb5472e5c86fb6e
SHA1b76d71d9a225988eb85386e9a4c80199640b41ec
SHA2565b65824da081a490f72a08de56df78070c99ec71a2ffdb51577a3eaf00f2744e
SHA512ea75302cfd2576ec4775a2d4ec86b8ce2417fd2ef5d85ec9f56944d7ba93ecd5f548ba5be6e1019d7b44925f95ceaf462781de833a47788b6e979148ec45c497
-
Filesize
1.2MB
MD550b9175d8adb99cf3ff2c92e74a3b27f
SHA14d6a35e0b9a1c6a960c0975996fd501e7c0665bd
SHA256f6d390368161447a2ecd68467f0adc055468bdc416699f15010b11c275dd4915
SHA5126dfd29b993b9270d3856210dd4efd9d1ff14d25afc11a9a86d4c32ede8f711c8f839c4a269e290984326f7b989bc6f1f00eef1d35f66cf4791697a8977c127d3
-
Filesize
1.2MB
MD55fd7769bb275ff36e76b462f6bd0614b
SHA1fdfec73919172d2f73f81c7a0c46f28f164c117c
SHA2569789022c64db443ba82f421c25b5d8f861afdfcc6bbf74f5768b27bd2905e9a6
SHA5124d90d96a24c1b67d538fda791d110211ec67fa491a3f2816444c5955eb578cae4629cdf2701af0625df67c47d24066b57d89569b442d8c6dc8d17babff0c1a4e
-
Filesize
1.2MB
MD5744a73909222e015305483a115439a20
SHA101d35ee01ecb3fec27491ed6d6f8616d0f8490bf
SHA256cb674fa35f9fc62b5f77f121cad16c1769484a3a62f89e4ec4b8be3c60b9e260
SHA51216c35a36426f278cca82117cc12e14e16263191997b974e00bd19f4d44050856cae8eda49a37dc7a8812da3dd00f6f8af6189f515974384fac557df272507f11
-
Filesize
1.3MB
MD547025ea90106f45293fca9c226293953
SHA106fff43eeeb7394f4d6c875b7dbd0b07fb60a444
SHA25635d3f5f1fd68359019305c3c904964f051400742547709713979e21ae6d26418
SHA512dd137d6a4766b7fef9e18d465cc59427a728d930f43931d7d603e2b78831547bdad4578e52fd86c9bea94a2da40769834fd3394f39ddaadd1b0c7d33bbad24cf
-
Filesize
1.2MB
MD5d0dc7608be21bb4f1e9b82a167440ec4
SHA17cbd444d3c76bd88d76f609c75204caf419592ec
SHA2568f996d95d9baedde03519c37317f6fa1b41b2e4f6b9f548b1a811b90cd14c1c9
SHA512b497eb54505564660241714bb64bdf2a4db11789d1fe62db26a0a1024636737b02050e1143ceaa65d85be1bc1bd611964a16b7175a1e05ef1f4fb5b23950607c
-
Filesize
1.2MB
MD584c34de485597c4c14870abe0a5fe9e2
SHA19993d8053d97e7326a384c48ccf06a75e0964d45
SHA256978c78daa1a20db0ad9c0862a8ec9978082470989d99a6a2def0714df5c3a142
SHA51248dca79ae35c6839edfca461f4696ce15b68327689c29eff780b7976a8ad0903322b5bdd37e08eefc5c038100a25776088cff0a913248f38d0df5e3eaba62735
-
Filesize
1.3MB
MD551707922a26941d337224faadc7517e8
SHA1c2a27ad3acc58016f0cb442f6fbcf1e99b6114c7
SHA25656014e2a424c6d275468d2c244fcff3f805628331ef3f2050fc47abaf588ad93
SHA512265f4ab64b3efa446711ffffbcbce3bf35e5eb76b811e14c4b452396a51c1c3876852093821cdca64562772299542e4eb2a9e5dc0bc7e8f6709828327ccaadf0
-
Filesize
1.2MB
MD55b1937c1a81552c5654acea07709f547
SHA1cc284e786adbf122b38d48aab3f8eb0379930d63
SHA256149a391803249e1c9d715ade90ddddb5e848da59d4798aa52459caea3f2d3408
SHA512287782a3f69413ea3f16689b26bd85ba682660452b6c66dece98dcf04099f87e58d8a5d2274055dd47a69b641114fdb79cf42bcbbd97b6b0381becb07eeb0e16