Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 08:32
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-23_3c68109d582e12d13b75785f9f4fc292_ryuk.exe
Resource
win7-20240508-en
General
-
Target
2024-05-23_3c68109d582e12d13b75785f9f4fc292_ryuk.exe
-
Size
2.2MB
-
MD5
3c68109d582e12d13b75785f9f4fc292
-
SHA1
31b3793046ff4bf2d34b9b14866e942fa49ee183
-
SHA256
21ccf0377f47815a128230871627fb2bca98c95519cc335328b17a60c5d8084b
-
SHA512
6de0db121e28a265a54e240f5e0e3178b5afb4a57de1edaa75a669e6340ab1e2838296cc5e410bc0f59a1150056af681b058add1174a77a393444c083139943a
-
SSDEEP
24576:6OObVw4TaN1wdkukCba4oXtgLhU3wEdmh58uSkQ/7Gb8NLEbeZ:6OOh3aN4kuLbegmtG2kQ/qoLEw
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
Processes:
alg.exeDiagnosticsHub.StandardCollector.Service.exefxssvc.exeelevation_service.exeelevation_service.exemaintenanceservice.exeOSE.EXEpid process 932 alg.exe 3864 DiagnosticsHub.StandardCollector.Service.exe 3628 fxssvc.exe 2612 elevation_service.exe 2688 elevation_service.exe 3276 maintenanceservice.exe 4368 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 11 IoCs
Processes:
2024-05-23_3c68109d582e12d13b75785f9f4fc292_ryuk.exealg.exeDiagnosticsHub.StandardCollector.Service.exedescription ioc process File opened for modification C:\Windows\System32\alg.exe 2024-05-23_3c68109d582e12d13b75785f9f4fc292_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-05-23_3c68109d582e12d13b75785f9f4fc292_ryuk.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\171f462bc8648821.bin alg.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-05-23_3c68109d582e12d13b75785f9f4fc292_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-05-23_3c68109d582e12d13b75785f9f4fc292_ryuk.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-05-23_3c68109d582e12d13b75785f9f4fc292_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
Processes:
DiagnosticsHub.StandardCollector.Service.exealg.exedescription ioc process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_96109\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe alg.exe -
Modifies data under HKEY_USERS 5 IoCs
Processes:
fxssvc.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
DiagnosticsHub.StandardCollector.Service.exepid process 3864 DiagnosticsHub.StandardCollector.Service.exe 3864 DiagnosticsHub.StandardCollector.Service.exe 3864 DiagnosticsHub.StandardCollector.Service.exe 3864 DiagnosticsHub.StandardCollector.Service.exe 3864 DiagnosticsHub.StandardCollector.Service.exe 3864 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
Processes:
pid process 672 672 -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
2024-05-23_3c68109d582e12d13b75785f9f4fc292_ryuk.exefxssvc.exealg.exeDiagnosticsHub.StandardCollector.Service.exedescription pid process Token: SeTakeOwnershipPrivilege 1304 2024-05-23_3c68109d582e12d13b75785f9f4fc292_ryuk.exe Token: SeAuditPrivilege 3628 fxssvc.exe Token: SeDebugPrivilege 932 alg.exe Token: SeDebugPrivilege 932 alg.exe Token: SeDebugPrivilege 932 alg.exe Token: SeDebugPrivilege 3864 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_3c68109d582e12d13b75785f9f4fc292_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-23_3c68109d582e12d13b75785f9f4fc292_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1304
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:932
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3864
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:3472
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3628
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2612
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2688
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:3276
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4368
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5dd09041db97a45313948ba175abfb207
SHA1beacd70946398e3d9500cb636277e9c7230fb20b
SHA2568cfd1bc4ec9fd0a38949d9ccff875622604a00b71988e778d2945244263c7ea2
SHA51220bb6b1492f775fd5763fd9f3c6f9bbe9f911f153ba228f4d093f23adb8e83ae51137d0c004362c22e19ca6eb54bf6f4996609779149b4b28de8e349a8d71293
-
Filesize
1.4MB
MD526e3ac284a071f7bd4c2c85b00b005f2
SHA1d236c9532891db73542993f4e1978968de1d9e04
SHA256ca466c4e9403a7db68a70f73978b66c23bc5c9e907cd14ad6260c5e236ac8c08
SHA5123219e8b0748258ffc08464540e6aa047d792ce0a5c52699fd63c6151f0566d9cdd9f7e882599bf77e63b8188de01fdc02d97fc4e0f12461150a86f6697c52fa6
-
Filesize
1.7MB
MD5a1ede9f68c16eaaac638ba1065d479ae
SHA1545c56bea0f54c10ed99790d145b9409a956f08a
SHA256d45e1362e2a34dbded9d952337b83010910fea25f8029accc68e365484abdb89
SHA512b31a9354c7469b6b9c45037de9cf0d2826e1de0f1b7c942a1d43972f3fb1432d316e1e1e7f6321c01136d0b309456808b4ec7fa7482cf1d10ed838acaea80a9c
-
Filesize
1.5MB
MD5af1b57e549dc8b151404853cf074aecc
SHA1bee960736264d929396a973fde3404190114acfd
SHA25646d1a06b29509ebd47a289d106e8f5bbb673ee2915e0f79791ebb06ef308be87
SHA5122754898609e18aac92561b76456c2b39363b447e231e17bb0d90d6fd8c1d7c832f10d2a7640a3d2379a2d1c8a543ef14469bb10a6d94cc1cfe98e14620d66a1a
-
Filesize
1.2MB
MD5162ec2705d9cab36a0972044139d4f41
SHA1f2b39c1f26a93968f495057f03960d6e890c6504
SHA256c32e7396d66092423da37857bd1af710d66e40a129dc7beb67c579efd873cf47
SHA51234286a3d4a620ba4d9553b193f013e9b6839c6f3f387ad371f458da6d17833f09aaaa29872757ad96d1dc0c60aceae265e952dc02d890afb2ee275530c22e58c
-
Filesize
1.2MB
MD5caa3093dfa55907378578ff6e46a86b2
SHA1df067c6fdf0cba60eb015d2fc561684ee67d4d52
SHA2565fa1bbbcc4b95b27f91caf6bd2e4f10862439c6f142efd79b9b4f32646c055f3
SHA512ab2ed0dbe58edb003306408e49870c7b907baa5cfc6a9ff042d64b5fa84e452ed156b1768b7d9428b34ab331a81fc5bd66c0b05c7e587957ad828aae2558afcb
-
Filesize
1.4MB
MD5b4510735790cbea321706aab7661bb69
SHA17b2b00b76b154c9f54e72ce8da90701efe432ee3
SHA25601f120eca0c5059518c3f13b363852ee1a21589f771b90b40bf1b41c743d4ea1
SHA51279dd64e95689b3b40c384d478688fcbbe8e471c5ab7d34640738ea32fd75d667c413aad4dc800bc5c71aa2096436965dee84565b9a82f05155709a6bbdcd922e
-
Filesize
4.6MB
MD5859bf1114cf4b1026fdd4d717a69c455
SHA1dbc4c0fe12e708ae5ec0864838eb713ce328bc86
SHA25600dc043f9ae3c63dc8b142cd6c67a08d68bc97a9b4b9f9ccb18592e070ffe453
SHA5124a2fd3442cf5300221b93a2293d3b2d17f0dba365757b1dafbac69134c0e1d79ac2c19503a16e96f85b1d628420afaa6933dc1ddfe309675da955fed69cd509c
-
Filesize
1.5MB
MD59c1b48328818aeef894ea02739801b5b
SHA17b6b7e345d87c277dc697923193984cc5b25ca90
SHA2565f391d71615a207dd6509ee475e4753e031a3c698a52e9c0705b21f29732eed9
SHA51240e8fbc1d48f7a0217d9f78aeb4f42d3e377a20353e59a918773089062bedb9df58eb6dad1a1bcfd6f2968e90c99c5be5cb5b7dc69f2b4fb28e82f3b90239b53
-
Filesize
24.0MB
MD503c941078469d6510fd766822cbce275
SHA1967a3048e08f2932611fb4c1b546a781fca892d8
SHA2561e34ef2c190b280afc55d677da567e8f534121dd9e04e6e7dad02bd094860922
SHA5129fd05179f71c4b4e0eac94ed31beebf77b2f3fc82f8fb0b59bc5b41b12226a13bca13e52f4f357c66401693bd43d3bdfcfb425d63c5038deb95d6dc81d4606c3
-
Filesize
2.7MB
MD54e02c8d085858f4872b1d347707440f5
SHA1f187e6c1b4b85e8860eaf946fd50a5342308ce98
SHA2560f3e3ab8dca65767c1fceb38f72c5378dde48842ed51cc6d1c1254c243d910ef
SHA512fcef4b717179b0e14c60bceb9c5663ff0a093c625f4ec7c39b1d99db1fe2b429b6dec7679b138f828a4c54fa5b07d4747898958534ea96eaeb8f728bbd4cbc77
-
Filesize
1.1MB
MD55a67cd7b8ef184a7093af040aae23526
SHA16c60089b5dcb9b6214e3cf16cbd8ee8a5174e22d
SHA2566d21bd935835b4b1dd0fc1a92df1b49aa8359f462ccca46ca3446bc4ea822264
SHA512e64ef584d0e07daa65ad63165fa4aa9ea9f70aeeadde2c6c7632fa4b3b421350e3a1501e01bdcefccc8b674ec3dc6f0af9bb3da7177309ad11bd2b69bc73b0c5
-
Filesize
1.4MB
MD5c2b84fa653a80aca956adeb5ed4edcee
SHA1603efec0d641ec791db0ce28100d3d7bc8f8f2b7
SHA2567f5de5fe3b5ade52ccc52dbcad513697eed008d3ce6043d156e202b79d5e688b
SHA5120cafc7fd978c1a7eedd2f0ed717175a63c92e4260a7945634628dcc9315a73b3e8f7ae9b4c7f44ee824da49a05718c126c876ca15b50fda69fe23fcbb627bf8f
-
Filesize
1.2MB
MD5434fb391224cbb858cb3676dc60da9c9
SHA13e12d5f89afb66f60f730d7b394ffee4b8ba8c32
SHA25691c896a8ff5ecfd6b2c8abf71cc209d4ac2958558aa5d14da80dcc6213c3aef0
SHA5125f1b41373524e33ef3aaba5afdcb9c75d7b7dc05c8bb43ac8cc9bf5fe40b83f479a0773e221e254ea0f3d8fb675c4e8fb3acdd10482ac26a1699325900ba4eb2
-
Filesize
5.4MB
MD575bfeaca086b18fcb6fe6a3d716b390c
SHA16ccb9b4f2051441e082a3cc7d5818cbb54dd500e
SHA2567b13d273ed0d9585e03367342dc0743e75b27c924b392d11c9297cb437da5b18
SHA5125dd60e73ffe1e66c5bb9ade38e8d1e724f084ce15284be513c92786cddfbf2b7ca84f02b5702f0e8316c6c2b7d508477908e7f46716013d833e54cecdefb86ff
-
Filesize
5.4MB
MD5eb7d4d90205d5df351934bda186d7f53
SHA1a4e33d933bd11e9feee1eba08ef26a2f2d35b1f3
SHA2566b9db6a616ab8c52ff901a086baaf60098818b7dad7d7ef2242a4810195c9574
SHA512efc2b999150c734cbc8904701435b9895c10d05e10dd22ee80528ebc7184204959319968a27f21f40408483d459471e3a4efe1f90092181e0ca76c9630a1bd4d
-
Filesize
2.0MB
MD5c56abbd718da0f6b795dc13a8988003a
SHA141799b5c748ff762a776a06fa4ea0063ea9ab429
SHA256d968b1448bbcf5cb943e7a594de0d910b0cc5fddda7d64ca40de626956b932cb
SHA5121178c3bc4e634007e01ed23be68179b9da825f949b26886079b2082be353bd460e465ac592fd6b2032f5f28408eea7b00dbea2542e0bdfd3fa3a54568a6a6d5b
-
Filesize
2.2MB
MD5d373a1271398463bbad38e98a2ca8c9a
SHA16edfc06d2e8813a68caf83b2fc896a2bc28fcd0b
SHA256badffd14e01261542719f2f3360341fcf95f18f7be30b04c75daf94a9733ac27
SHA512a588bf2f0d83865fa847bc74672321069aed6a49355a48bc95560d287f2a0e5cdf0b0615b019b4ce6cbe2242a3f762422c4e8401cdd0b2eae6262bcf6a381770
-
Filesize
1.8MB
MD52ebc989443a3e777e4e790ae0df2e480
SHA1a7dea5a9233f09a73140ff261e1025cb8935cbda
SHA256f15e6c96df1e06c74dea3158c13db544a7b3d32dfb254a77460cdfdff0757099
SHA5127e06269a0d9ea253ba26cf649f614a37583dbbc7912dd552139d0eef2d9f9a94d3d8ed87c5ee3ba379acc8d19d33bd92e92f72b68eb07478409097410535cf56
-
Filesize
1.7MB
MD5a097b8d715275f2c8c25ebe2d006f093
SHA1e75482313944a2d4283f30d14e779ab633085d07
SHA2562074e026a2500651567f9839184588dfa4b2c0160391aceac7bdf789b4c6835d
SHA5123d7368739b3f68850ff6b855d6dfae604bfbdb952f7cf832c0921dce56444f064a332bee9e97275fcafebe22dbed189393953069332bd930ff7524ddca4ab883
-
Filesize
1.2MB
MD51cab2abd0ea3b48342f1ca6779a7e67a
SHA13d9bb3b3827bad21b9abc59deeea02cd56440c77
SHA256b0437c889db015013c655638bff5b132d050c191c4a8831364bdad60e5c0acca
SHA512aab8ce5139d53f7102c8d13856dda909eebd5a0ef442b33d67c81b6a6d8728483af4e0cb7bd0c7ed321732d0eea1c36f925c4ebc1e4abbfb48319342c8e3221f
-
Filesize
1.2MB
MD51cc02b222d21fd1b6c0144babff957c6
SHA1c2e37437bc991321021c9b52b160d95d518b60d1
SHA2562cee47391fc733d8278d90146a31c74637825ed13e1a762476ffa36030c8fddb
SHA5125d6fadceedd13dd34157c66ac65f2dc710bca7f1dcca4840be47aef51a8c33fcb64430f5135d8d893a5b8b5902cd4ba7436cfb308a118b5ab553997187737a4e
-
Filesize
1.2MB
MD53d541266b67923e772ca2091e3721586
SHA1f5c59ac769afae7ad1b1a45f020875c89908a6eb
SHA2563d1fcf698b8f3f5b5d1aa0dfd2597781abed8b5dcf2db7ce5c56e244ecd25a46
SHA512e2d4e97e08af4e5a5aaa83825634057794f182c61b6f623eae98a8778695e4a2532fe66890fda5bc9f4689c0f6bd8dc8ff8c36a17099b97cc7c05f673b8d3dd3
-
Filesize
1.2MB
MD576a79cfba1982afc5ee4f9ac2c6f20fe
SHA120aa3a73d11dfdd5bdd05a3ea4e2d9fbff7a7a7b
SHA256c99c02c18e5d72d3f053fc791b122b381f83ea06e921049a4c865b214d43bc7d
SHA5129f051f1cadff2d71ffafe5f5ad566ffe2fbbb36b54a96fc23a39a4f8f9884d34b348ba62d34b1fbb517f6340cb013ff805bd19dbb243023ae6bf45df00fd0cd4
-
Filesize
1.2MB
MD57adffc7ebb14b6f303a3ed1ebe35e786
SHA1a0b38e9f320296cd2180cc6a5c48e89140e8e145
SHA256e0f390f63f165b401c8bb215cb3682cd66a8e0b4cff6a9194c35dd2df0583409
SHA512595fb34c958b38dabbd087f0cb602f15cd60c52b3d2c5cb53cd6515a401814e786eb1ffa411d51e9eee872262a99ad71db62ac53519028e017595825b64412b7
-
Filesize
1.2MB
MD50c2565f22688301b3500001388bca6df
SHA1d4a2622face471284900279953f54542ed9aef6f
SHA256ad678e31f77e3c409751ea0786e7a4ba3faa64f9aefb4add9c84e5dddfe752e3
SHA512f8a5317d65ecdb802a3f74fd3a8f735d9ba17930ebd3224604cacf18d4be73ad6d61e38f83829e02af63d2f65749feab7646814b0720e9f6bb7d8fe5a24b3837
-
Filesize
1.2MB
MD5857bfbb664e153129c398190e416a040
SHA1ed0a8b8f3bc4992accee99052c3070133caaa667
SHA25674c0919155ef7fc2f5629504bcdbbf9b465cf586cd54b2d7cc546e739bceb92e
SHA5127f3c0cc15c538d5a2e3b28fae4e557c845f55775ad95f3c3c28b5c7121420e3afa12d2556c90c59813dee0ac76d3e4d974f9f1ce047a298a256f6e6aaae91282
-
Filesize
1.4MB
MD568fb9cb605ac62e6414d3b7ee4de7830
SHA14609bb260ea9d6511212f2c1147513717c9aaaf2
SHA2562563a7ee5022adbc9199bfffa1a7eaf97f9d239d9cd926f21f5192a5faaae3a8
SHA5120e6a10e9f9fc95e6aecadd6d60b976348cfee9a8538937d91eb95c3809a59650fdbdfb8a1d5309483cc6452b40bf70e53acee8f736f75f6591b9f6d5f9001dca
-
Filesize
1.2MB
MD5c1c6687f096442cf987e94a17c555b1d
SHA113610b4b4dfa65edbb6a270280f51aa12ea4072b
SHA256a3005fce3bdb501ed2923295d961fe5c03f957704792c3899904c166b40f78e0
SHA5123d6cf29d1f6c89671683bc7b3dee6414130287415d9e8079dd638f858ed92ccdfa11958b403b8660ea2d683afdf434d9cb84287321d5ba682926f44c63a5d0d4
-
Filesize
1.2MB
MD5649fdc92b07fcdb08a64684c1cca165b
SHA1393ff9de7cbf0287ab29734947d20bea00efe88c
SHA256cdc4a13dc9ce71a7e494797324da53dde4971910b04c3e9093e0101962cc6cc9
SHA512b10b20397e7edf485a01e78b01a90cc3a67866da6ffbf0e998022363db644475c0082274d6c53ca9773f5f5176ab3be7b6c24212d4cacc6bfac8b53793b8c33c
-
Filesize
1.3MB
MD5303c0c7c5a189d2e00ec846e24bd3bcb
SHA15a0eb10b9b5f04f833af567c5c9f60199d044232
SHA256728b6d80eb2f95970c87e3555b4fe61785c8a727eeea03309d1cfb15db25be91
SHA512ce2e2c6a56a2c2c14ddabb1437b4cc8b6e2ed5d72b897ae324c215067859410a43c3c3fce2db5a0893bc0356fc53e1ef23a1324b1120e3ec9aeddc83e4b2da05
-
Filesize
1.2MB
MD50a6a5bafd5657c233b8862a23aff348c
SHA1494040c691c3449c7d8a167bb57be2551ab51d26
SHA25658582324a5c94b51f01be4a8440f0fa36a250573e13d4128aff352f9d9ed6c06
SHA512c700d066e72506eb65312f84f191b40192790e7fdbcc0939b21e765d443724e3e355aa82b557a4a367775c77515c2320858651918a30cfa6f9b36d9f44709054
-
Filesize
1.2MB
MD5b5f8b5e029650d7ca7e944e27be8a9c2
SHA18b57ab87977c220356c5ebf2051ccb244ef91a2f
SHA256a18eea3d24efb45b05c87189b86e953851b072d5ea402dcf4768f4fcdab02273
SHA512718338b037208dfabf70f9dfae71ed3ad2f9c0fb4095fa7c1763e9ab650d2cb98501462080662e6f9ae4254bdf089d0f2aff26d07f0915f271675bb53bef254e
-
Filesize
1.3MB
MD589c5b0729b61f900335ee51eb2022cbb
SHA1e3d7a2243f420856bf4a370e43ccd3792346d854
SHA25697ef95173ef4fcfbc4a2077bb4a2d6c7d2d7995067f654ddc2a153ac36936546
SHA512cc0e3f52debcee2c9131451a344c8bb572d2fea2b6409be6693e098526fc6ba70fd90dc84713f924d4a5101a650c24faf90cc79829d756fd7e53463cbb3f8cca
-
Filesize
1.4MB
MD503c25197839a1e5dc1a27e93541832c6
SHA16a76e49e45dbaa811ddb5fd35d04f02124a7b737
SHA256d16d6261b832a4d99b400d1a0ad6b52cbb1a9df8280fb1a3c5641b680663d8ed
SHA5123efd4bc0be25a1edc862ac73da0c2af56762e9bb2c25f0dbdcbe87a09e2bc50a82160fa834cdd99936a82b2de84bb644263c9717d4b5eab8a2595fe554f57122
-
Filesize
1.6MB
MD545bb446baf23f0dbf211198fe93f9c44
SHA148823149a482e2c7b698b2a4f34464a4a3542cd1
SHA2564d85cb5a35bf14bd8679260378c8f18820134103955f7225bfdaee0fc69f8c0a
SHA5126f0423391932f723e3b9e76b4dd11c4e44a13d8b9c67d7477ad95ac41ec4bf09dce4b3117d74c4ce83a7cd2fe93b64be0c831f71f6257d73f636edad3db166b9
-
Filesize
1.2MB
MD513b6e318c7b5c185d648d92c221274ce
SHA1465e31e1946a9c98f22cd53735521b9384efb270
SHA25684db39bb99debf881dc9aa6d9eaab481f9875a18d346349ac76bada0cf9ec95b
SHA512fec53ebd0f99ea54e9aa911324443b87fb04a4c5e0c8e7fc85eb69dc5f52ed23ec7dc47b37f19ec26ce396f8da06b831744c1893294df6754dc79921784864ae
-
Filesize
1.2MB
MD53f85166a34391e94942cbda148383147
SHA1d1f9be7f84d9bd548f5feef2186add27382ac286
SHA256006c8e8cd0a42fb2b77575f6da24c6cb2078224ac019fafcaee1918ab5d3ba9f
SHA512df51566ea3dd2c76853ec596300578f8b9f331de3c24a54046193d9836d83f643a9db6a27de394c933e3b0294c4285ac0892ca059b66c10ea433b7373fcbc672
-
Filesize
1.2MB
MD57c29f867d912346f7dc665aa81658635
SHA1143a9666d20f65ab0b36233d235bce25075a594c
SHA256c069b7a3ee325b55391b7f219627d774ec8cabe44387917898ebf95c5690faba
SHA512cbc648130e425832afd3d49daa26cee6246f12e458d4e03cdbb3cdf24e2817dd5f433ed7ea22426f2bc2a61ddf9e012faf4af413aa1d7adba9155307af8a3a35
-
Filesize
1.2MB
MD5c3ed6bfe3f6ab625e74c4e3e094d58c6
SHA14f467a932f309ab2bf3084c6c137e323e3c7b50f
SHA256a1b53398bbf33315225736b6df70dc3878584f567927670c68063c691fe501ed
SHA5128e8a66b6160014dc0abb2bef75149b777edee2d1baa9a9ae5e293c632f02338e344b94b52806e5dafbea27524c07f44c3a497baab416736aec9965d0b2ff34ba
-
Filesize
1.2MB
MD557e215b991aecccf8d81ee86b58b3176
SHA10605d808c675baee12b673c38141b7cc2446a758
SHA256ffbb840a194663af11044b74df93099e6b4778a9b47f6e390a98cc173cd0faf5
SHA512f700f1611b45a8ce13936e4c9e20926820485ebf5938c3dbac98dc6e8c28a6ba1186a53e0c1ab126a7d5005a92d7868dead5d270ba917ed8bd94a367608a47f8
-
Filesize
1.2MB
MD51aa84af4b181cf733e642c95d1feec38
SHA199a75dc1476877c0c2854bb9d2c98be7e7fae528
SHA256a3cefaae2f684a75343d3fb882e56902f740a8581d3aff022deaba0509192f2d
SHA51275efd87b4542ecb232801d3933c0dc814379af1b43f684fcaa0a65c382a8510766d589c959d4410863eb960e43392c4d052d6aad2ad65d20174d5c895a6174c1
-
Filesize
1.2MB
MD586d787713fed4275268175fb8beeae3a
SHA15353ee5419db5a8240230a48b23122f0636e0c40
SHA256cdc2e94d854545f2159c01ccc6b5b9c46805d75c8204aaf9e3ff18640d64aed7
SHA512196ae916c381f3b9d9859981ed1e33e65b1b55fb917ecde0e0579489d89e9ece84220ce0ffebc62d6ef0a3d36350f5ec3090be5f1d435daae9a7dc4123c83af7
-
Filesize
1.2MB
MD50bc1272acc201cd3076171bf5fff6986
SHA1d4fb2ecdffce60dab7b385337b010e8f9c95f71b
SHA256aa76dc802b19872edad0d6c1a1a0770c82fa7e5e46605c06f63d28d65fe4d88a
SHA512fe2ada9c6eee373d945f612c0f5c4afa76e00046c52b1dba4ac77e1adf5cabe14014248540813f5b31905cc05a49b258796423c8ab67c4b3bb883af917cc7f1f
-
Filesize
1.2MB
MD5c878edb83ac3631f9c331f4e62b3118f
SHA110daa1813f1e7ee0aca4d8b83fbb054dddeee3ac
SHA256b144cd83acceabea80720ba22039918fee4710c7e6f8ef4b1d1123f5c405a66c
SHA5123e88d1d80a8f64079c6848ce09cbcc71720b538023edf0b4f94d5e4e9c87213901916b687afcec60e53dd34f4f4e8a0a0fbd41d5d13b4601a1cd66f3785d16a0
-
Filesize
1.2MB
MD5f9b6c9b1166fe037d5db9d348abfc24f
SHA18fdbe72f8c69ff3fc7917ec89387d5383e0da9fa
SHA256abf8bb839842b51bae068c075515c80f0cadc6f5f7f59addda687b0a18aa8e16
SHA512703ea8f6471d830deb8e75d2ca247eb7aa3fbd6652b676d1ac0a889ee185b9635ea7145be12b7cf16ff771a68e3c461d1ccc079b38c13bf88e20c4807de813c0
-
Filesize
1.2MB
MD5ecb9d6678f15befe1a5b23302b1cfc76
SHA1737d2900b5b68f4a1a584c825acc84ba2f072fb8
SHA2561d75e1fd246fa3981f240feb40bb3fd4061bcf463a349037ed3b3f8c3efd7afd
SHA5128169e7d860919042645787717cc2dcf2bb1c7b54124cc9b363e2dd27532dbd25507678c3e8473388dc21f639ef194e22ff429fce3fd42f60498020f22de97486
-
Filesize
1.2MB
MD526ab002a74d976a2f5ba68c2c8454b2f
SHA1b1e782d959c031c820d26eff303df37e8db3221c
SHA256e3979ad839d1d212da7bd269fc4cb9183e517b88d7f7d0f93764342f0d022369
SHA5120402a6b77111e6aaf5790862972d0b34fea6657dc081a4ab4720443e426846fdd4cfe91c6f81881f984fd37c23bb514258e87af7b3f5abef06d5bdda4be3b8eb
-
Filesize
1.2MB
MD5816a34d876cf0d27d5b9b3f86987736b
SHA11bcef767c285754b27a2f9e98b087ec52be06f01
SHA256cbce24736a1f903a40d7b7e301816a413303777c13c3206690627480689932ea
SHA5125a18b009c2ab18a37ebf7cf7521ab11c42114270ad6193257adfeb6a59aaaedc9ad85a18c3f8561473bc22c93b37cb5dca1b5f49232e151e88efa43678d35a5c
-
Filesize
1.2MB
MD599c160e9c209f16f9fc115eeada08b2c
SHA12ddabbd388cb8d99493149a87d9cf3e8012d5cca
SHA256b8ced0023a5c9ad02af5f974725cc5e55abac6475571975e897d76ba1743841a
SHA512a23ea38d16e001d1362a86927cc4991637cfa61100e88a06b3ab699b24ace5998dd3a344bb59a2ffe5c43eee65cecd9f7160003b1b6723b076badbb0da8de4dc
-
Filesize
1.2MB
MD549033c0fbc460da3bd9e862adff581a5
SHA1eaa92bb8347f3244e2538489d14c088dd22791cd
SHA25690df22c5fc18dec66f8a9c374750b2791cfb7d6590ef65e6d8b32bde67743d2f
SHA5123c57bb7caaeaeecff752d89bb9ac2a0e1b8193b0f6f303a8f84114ca415e4b8d068977ab37a55573fca0190d64c856fb3b2188db7d08d6e98d127facf985083a
-
Filesize
1.2MB
MD5b4f19c596bee7efb87f147c695c7c6eb
SHA1d8bb06a8470a7a742ff669027a08932d9cab1358
SHA2560d17d53315df0832f74126ef1bc0e13787da88524fb95ec3a8dac186f9cd8475
SHA5124a17b2ca96bdfb1fa3f608fed0dcd789f01eebb9c29fa9d2137b5a4dc0e32b2def05c0635998bd47e155b0a0e61bd46c5d1808d2416e6ab12fc170baf14f0d76
-
Filesize
1.2MB
MD57d2dda5ec5d27e24ad258535aa1548d8
SHA1403fcad35d71e8b59226197c8d6f6c70a62a0bd1
SHA256d244d577d7496d2a561288d9d94e9c143a3621f89d43ed4cf14a642a49d1ad09
SHA51201b9ce18ed7e6c72eb338425972639cb36595af7939fb577041cb14d5da282d83fab81c62ab227b68f4f42f723419497c7dc165a5fccb6aed298da933aa6e2ff
-
Filesize
1.2MB
MD549a1cf0a31c33febf0dfd980010a6d08
SHA14229d10efd1aa2b8bdd0a6cc1dc92d2f73b1d4db
SHA2569053202e6ca8f09822e8293d2c3a3afacb44a9d9136aed5960b64c5cf5d233e7
SHA51274952b3f970c7283b2bc7030298cf3dd29e016706f1be91b192b8fb5586724320c514c47494b25efbcf6da7056181e92c80ae499a36ac51614db957b029a7d9e
-
Filesize
1.2MB
MD50051bd5325762921f322232c3351da33
SHA16198925896dd03b3574c2beadcf1dc08fefead85
SHA2563d98f5fb9af97907cf3ebce5de68e3397795eff89c692341e67d1e0ec8f493c0
SHA51290a2690b695c622fe97d403778749b9e0a2ad348f3821508b346547257f5055c42baa6a63b48a577a3f7145aaaf3e890accbc2b37c41bd9c7416c91dc71dd70d
-
Filesize
1.2MB
MD5606b540d7188043aca7d87afe5aa9984
SHA139639ce8314a04085e63e2a0fd6e4b5002ba5ed7
SHA2566ee37adfc5387c95f4f8dd0f605c08bd60663ecc7f49b3892e7066b61dc1167a
SHA512184a63b2d1a8f628a8d1f7e75cb3b9ced55a1538b9221ac5f301203eb6401fcecb5d55e93e32f35b6e6603626372ed4787915f112d7d5652b08d57baf7f870db
-
Filesize
1.2MB
MD5d180136ae1f9d89404c155110e507b0c
SHA1cee22886820045eea586abecac34441a0e622f1a
SHA25641a3279a7a272d53f884461d987abf3f7716b75f782b9682b81ecc71cd502847
SHA5125bdd8c8b6f9695b42f90b9dc21a8876f9ce91357107af55250ee57e04f4478f31056b5aa80e1672dab6a370cd445a861786b3ff4936e6aa02c2c2f111b3805c0
-
Filesize
1.3MB
MD5d95ceb1ed8cf61716f2aaaf17aae03bc
SHA1a23cab7c36a32cf3e5b2ca5240484469f3753e71
SHA2569266b20f6a93e0398c58f4dff51491fe62609f6f4cb1d43a2b9633297c892281
SHA512d5015322c7704ffcba8a0ce51deec50c5825996e34b38a1f7e73400f1b725a177efe51ea75d271646d6075ba4c087ed4e7f6d07f77005036af8305f3f6caefc6
-
Filesize
1.2MB
MD59724a088254a3eedf660be6200a479f5
SHA10c7b60c82aaf7ec598228d730ef8e611b05aaf28
SHA256588d95b24995ad0737eebf898b135071ce0e42bd60582ce9beb74cc68411dfb2
SHA512a7cb8230da1f3d42bd832ec5a845d1ee5faba54e3fbbae032cad41bf9b72322295d89835ff0abb8497e758f718bb978efba5779cdc2de9c83539791c03cbbd02
-
Filesize
1.2MB
MD56e35eb1be7ee79dff88913ee416c7dbd
SHA1ef3dccdef77450aecf848799d579469b6d7eafb1
SHA25640a41ee00bd17154ed7fe21015c68560868c7d45b4c091a7ff242eefb86ed00e
SHA5120daaac235b7fafab3c7920d60d8b231e03487aeaab67b2784a2f00d91e88762345273c7b928b448ac76c1364a87ed936ef90e8fda3d465c6f529f6181e419d0b
-
Filesize
1.2MB
MD5cfb9165c715c9b68fe0867831880312f
SHA1ab98947c15b728b7c311d1e0c918b619df4ebd52
SHA2568248d80ba1c8b02104987bae9107c2022f13846b4fe22e970335a8adba10f7ab
SHA51257110350e915a1da24458a9e2c22b7fe7cce022886f86899d3da7d114d0ef37231cf3ee49ac9eecc484b84bfc36ac2ea27d3221404c62998958daa58e8ef0b66
-
Filesize
1.3MB
MD54b56c4e665c3414dbaaa24400fef593f
SHA155c9f5e2ee78ac5b1aa883af0285db6207b12243
SHA256eeee9e7ae613b67d55fe15e7e5b72517e74f2b14462f0a5f88a5a5bebbf2612a
SHA51252298ab5ceb05f1bbd193938234e663567e952872a0d5e34f36a25f6de55f3fd28cf6dd477dd74959c14cd6c452155c92b79d852e23f74cf55e387b2d7ed3674