Analysis
-
max time kernel
149s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25-05-2024 13:25
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-25_c07eea6686d600c8746635a88175d839_ryuk.exe
Resource
win7-20240220-en
General
-
Target
2024-05-25_c07eea6686d600c8746635a88175d839_ryuk.exe
-
Size
2.2MB
-
MD5
c07eea6686d600c8746635a88175d839
-
SHA1
0f0c40636db9d1b0d3b45f1e959b77564ce8cc6b
-
SHA256
2d55520124d387858273b52da84ec377b8752e0c493ae32a1bee4fa749c7c23e
-
SHA512
c6eef78de5ab2dc41c163bf6f3724568451527d1c99d336e17a11b74615e7654bb52bbcc496099f9c0da2e472f4566047f4e409c177b73c6037c5a044875b7a9
-
SSDEEP
24576:iOObVw4TaN1wdkukCba4oXtgLhU3wEdmh583ksIuHa53YUS9wLDFRW:iOOh3aN4kuLbegmtG+vHs3M9sR
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 996 alg.exe 3940 DiagnosticsHub.StandardCollector.Service.exe 840 fxssvc.exe 2540 elevation_service.exe 3272 elevation_service.exe 748 maintenanceservice.exe 4920 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\system32\AppVClient.exe 2024-05-25_c07eea6686d600c8746635a88175d839_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-05-25_c07eea6686d600c8746635a88175d839_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-05-25_c07eea6686d600c8746635a88175d839_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-05-25_c07eea6686d600c8746635a88175d839_ryuk.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\5a2ec5bcb4b1389a.bin alg.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-05-25_c07eea6686d600c8746635a88175d839_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_99718\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe alg.exe File opened for modification C:\Program Files\7-Zip\7zG.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe alg.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2024-05-25_c07eea6686d600c8746635a88175d839_ryuk.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3940 DiagnosticsHub.StandardCollector.Service.exe 3940 DiagnosticsHub.StandardCollector.Service.exe 3940 DiagnosticsHub.StandardCollector.Service.exe 3940 DiagnosticsHub.StandardCollector.Service.exe 3940 DiagnosticsHub.StandardCollector.Service.exe 3940 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 660 Process not Found 660 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3428 2024-05-25_c07eea6686d600c8746635a88175d839_ryuk.exe Token: SeAuditPrivilege 840 fxssvc.exe Token: SeDebugPrivilege 996 alg.exe Token: SeDebugPrivilege 996 alg.exe Token: SeDebugPrivilege 996 alg.exe Token: SeDebugPrivilege 3940 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_c07eea6686d600c8746635a88175d839_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-25_c07eea6686d600c8746635a88175d839_ryuk.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3428
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:996
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3940
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:4648
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:840
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2540
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3272
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:748
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4920
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD51d310f247226dc949bd7bdb9a8cd95cc
SHA1aafefdf21257557e7d184eb67444cfa8f3509410
SHA256e8fec360cd27cfc6a8b91e92ffff66ced3f51c2a1d5ffc1f6c66e659ee4ac1a7
SHA512726b9c7a262bfbc9d3b629988063b5525d93b0e844dfde92738257c1cbeb1f41f0c220b0ca0c2053145001591eca4926f62a6e173c8d500a92f8b738df35e55f
-
Filesize
1.7MB
MD537f6a5f294f9573922855c1851bb14ed
SHA1e60d058cb7d6a80dd0692996da123ad698b747a1
SHA2569e4edb9bfc57de9ca42b75b69ddef82bdfe5048e94a390cd6d222bc2ab6e0b91
SHA51247705d282aa2dcdbdcf051e350f24a007f9bb46a335032df9b24f0d93c1105393892a00078c638588d0a209062cbe6cb54cd27c88d7d776c596a5e0968d7e9c4
-
Filesize
2.0MB
MD57aa228ed826e1fb8abb5f74c92a802ec
SHA115e0298995e6a1db02835fc9cf7c18dd47b9be87
SHA2569bc8ea21265366f89af9292f8240e6765b64cfd1ddeac1433a7ba10dbc69d0dc
SHA512ba2a160a6145ca344afe4f5d4c458a1b0ff1a7d9cb78d6f51ab09fecb15f166c939f7c1f4c6293568cc411ce59b91f14cca00a263dc6d99edf06ac135c5237c1
-
Filesize
1.5MB
MD56ac6c320b80f0128585eddd6d7d4178b
SHA1e6c176772005593780476f2538feab92afb96d2d
SHA25603e6d1698aa59f37bc7bcaf55653700225dbaf7934946a8be0c6ede0411500fa
SHA5127300162cb8d8c8894cb858342e4e93d1b120fe3a0b01f32c32eeb2b3a7f913270e8d356e811e745aa98a56f7d923ae46ba10c2a90fbdb9da6e32248c11e124e6
-
Filesize
1.2MB
MD5e70acbb0fb7b20a533d83150caed4fe4
SHA137d44d2e414d28d38c867006bf1d18c9ceab1f69
SHA25637e80cf440c81e95929736accf1190af1e233d444ec4244ddae320566ac0f51a
SHA51220cfef72aece91ca90e7ef7c2f1c77ef16881b4c8e06e5d76abf66ce89b13d805b693ee6baaa08cfaebb03298133c6e8057c04b3a81a61b126078a1747f0b97a
-
Filesize
1.4MB
MD5704c675b64d0dd1a18b73135c9b9aacf
SHA1f36732f793853104affb21d648a4adaf7d3769d2
SHA2562f235da2d4d1ab3b3d9bb9e80eee58f0e3771a4d7d5145dabb263d05bfa1d0a3
SHA5125d4b57cd925d6632dac5c25d3dacfa2e43c92c7d812ed1cf732706d7fc5e896e8a6a7c6233b7a403d94bbe38711e176247cbb1b3c18a0532df612717aeb85c54
-
Filesize
1.7MB
MD568b6408b99949c4b84df3327a5030be5
SHA18aeebba034e73930adb5718c59d66614da6c285e
SHA256ceb47c3258dbe9a9d257c1e3d3379f9b57f37e57deb68b04f42e74be598bbf91
SHA512cafc9c2a0e225fd39d1c6addaa8896c00ff2c33e390066f391e8b8cffbbfd129bff273a029aaa1db7192ccefbbfbe3e4d342a048a3ae710c924385499a33eabe
-
Filesize
4.6MB
MD5a9fe63bfed2c0b38b35a016dd5cc623e
SHA168d1c1892c58fdf129bebe72f0ebb941bd3c9178
SHA256be143925aff3f54bc795e6e38bb44c2cc19efaa7fc761c3d15a5423a33c9995d
SHA5129a43e098adc1115f7f200320911c6b3577bbb0b9d04dbe1fca34e894a2b796c81cbf9aa9b082d885e23689a61863f36ec0243b43947adb3491ece798d3095e25
-
Filesize
1.8MB
MD589952391e328465ff0ebb73596e3eed1
SHA1ef7f1fa5503749570a257f2452cc46a1b042a8ba
SHA256a393cb9e9c40b0b648001cf661caa3a48d08e6e740d8ea18a3b1d976f0310d1d
SHA5120000473064da8034967df87ac1e52d634bf9181bc53b99429ba2b55ef5683df3530ab9e491818e24d39532b5c2ee061cc9e963512e19eb185e81504fd2b1b67a
-
Filesize
24.0MB
MD5e11c57766d8d778e921b2f3169b0bdb8
SHA1c019e7b109bfcd7ea6a9cd3964eb48f6b8bde567
SHA256f20e9bb45fbd2533079ddf84aa287832e440c616182da4787ec189179b4dd55c
SHA512e88930e681eca8b4bca30271517194e15ed3d0294ee990610624645df25c290ddf42ff797146cff45ef973bec9856a837a6d0601fc28d5441aafd989c824d583
-
Filesize
2.7MB
MD52fdfa4a295a33e1fc60e7b983735b45f
SHA1606e7d0984dcb4a4ce08769ff7dc5be0013408e2
SHA2560135e75a9028f7fb76f3a31d52b17ae2e90b842393f5a1c9bfe013848cbaa07e
SHA5127c0323e03c9e4a7b9fbe20eb96c8481c3d00755f68d810754808e9de4b66ab374bacdfd6707ac7a121b79a37d611f52435ad306b7c86f0465d612ac1ed5eff0d
-
Filesize
1.1MB
MD5e29345724a5f5f57e9f4668bf2695300
SHA121d87061637cb0e5f40903bf5a25a7a7840b01f7
SHA256204d084b7b92639a1f4b71e470efa282fcdf14882b7aa2ab511c40e6416df737
SHA512c12a335a05ccbd43003dc6269c5b929f9a5be9a70a647f5b1a820e656b60eea27fe1d43a8f6403709aaf6ca260089d36c9f328f0c04d8ec517739d2546a3f5f7
-
Filesize
1.7MB
MD580e7e77a131efa9d77836548a1ac0ef9
SHA1698f7911d038a0a5163c7acfeeeaf8c8550c28da
SHA25690f4133f9d3332385b52a904897592db07a43f7d8fd0796d0b5722af8a14165e
SHA5122ee36a239561c2a137a07fad8350f2f7d8fc25f4eb6899d877c39f942c48e8b9e7dab01bf94cf245e4776769c7b5795c21ee2e763a99e66041e1019fe04f1338
-
Filesize
1.5MB
MD5a2c960468e82c5b3224e148e62f31dfe
SHA10c036a5889b1da786007ab1b654d5a4750e65c79
SHA256709b2819b3424c2bdb66d8f26fa1be8758dac102652111f3dac587b2896f0ee3
SHA5121c8f531ed3ccef0281244b9bd1139d8a89337318f82b5f9bad338712b453daf5de3825798d9e33d849631daf4d9024ced59142e76a956909dbeedfb3ad7184f8
-
Filesize
5.4MB
MD5f939cd38d8d231c8525852c30a681f79
SHA1e9cf7ae022baf2c5bdd4dda11865e29b9792c544
SHA25618d29d70bb2c46b01bc2a7cf92ce22752dedf32c3d94a4b55924ba9d459204a0
SHA512a06bda01b5540b1d7ecb9c1400542934d235717f29733029066d476df55fb5fd07f80217d51c0f8b708b6be5cf6882ba3bb19cb2e100d429424a90eac5487f33
-
Filesize
5.4MB
MD5a83f36bfbffa1e46b551506c8d9954b2
SHA1a45fc251f0b7b533375c1aa1e880b48cff7646da
SHA2568dd046056706c0c9ff4d59c9c7873ded8633b884bfcc46981ec3b6994d63995b
SHA512cf1a038fe2142ac2c93a78f69e65768595c37747173593f72552ea6c84f6cdfea64a9c99bc77268d5f069b04fbb6640c4775afbd786b75cf7bc80f3cd60b90c1
-
Filesize
2.0MB
MD50dcdc880f337fe62480a85dd390d4e51
SHA11f42eb696a97277e0eafbbc0fbc924b109211689
SHA2567ced1225f251a2da9fe3b7b97a06ed77369c473e5867efc97531bb4283d115c3
SHA5125a69aaa9e9f958fc6e0faff138b7a4825519c852a729919358d73ce01da7d9ea1f53a8ae05532de9e74a0f6b72476422de704a63a99d2121672e81d8f8f94f45
-
Filesize
2.2MB
MD556a869c6fcbfb409f8e1cc6aee6048e8
SHA1ae3d4c7be9190522a1a53766a09322db626a21d9
SHA256a564c21bca33fca4c4f63cfe7d9169825d81b14905f9a79c41c74c5af345bd80
SHA51285283c344888e78f92d445e012e162d3723014cb8e744ca8aba4db62062e44ff43f1e84516a77753bfca04bac39bc056583bf3748200f5edbcc357b82a7b498a
-
Filesize
1.8MB
MD5fde56f6d661ce3455087f0ba2be731d8
SHA1825a68f41f5f68a953293b7914ee7c5bfc1d1b4b
SHA2562efdbcd68a0c25bc56b0d3dbe1b22c05b9b6c22a9625241f0d8c0a276dc155f3
SHA51206deb4886581c5bf5d1fd21ce3c3b77032589bb59bbfdcec85dbfe4bddbe99b1851283054dfde972521d9ba5ace6beb75368688c5f49d6e87e3bfbf61fea0edc
-
Filesize
1.7MB
MD5c2685e57dbba041fc49996a4194c95be
SHA177eab103094448c2baf81d7392400b15c69dac86
SHA2567b13b9f899f85d94fb8a25e064d39a61c8739df6a38927a337ce416df3d68cef
SHA51230758b816f37d8f831241e1c6e2a38c6b21d347049bd14444b21755c7d47018a7240edbceb57bcd887f7f73ede0067dcce820dc692d4ab8d8e96592da08065eb
-
Filesize
1.4MB
MD5313f411d9e2afd76a740cf40da981607
SHA19c051bf46e788f40834cd5409af13f3e13f8bbe8
SHA25631c8f127b7f6f98265748be0d542f40f7d82060b9518f00a764c39d060d9ff68
SHA51280a981446217adc337cd5ae6d43ca3ce343aa0525e7dda86b3362e4ea2061d485258e1e37cd4454ca1448ab0346e01cfcd0fe447efa978d653b22f071e99d1eb
-
Filesize
1.4MB
MD5b3e48929a5e5564f83f0edbb328cf032
SHA17e9d9733416c547b53b4856bd95b70749fc64633
SHA25603b08544c626507c623d3b30c3b91a3cac156a4a1ba2e4d7f7b47739890e6b4a
SHA51230189f9f9d82ca1298809ee6c3ace77b84d8dd5d09f94f2d6d4a0f81177acb44e0228cecca83b4f6c43219dc6d5e8cb3526de0ff2093660bcda2714ec17bdc83
-
Filesize
1.4MB
MD5bb5a2e8fdbc2e4e4315073188db731f1
SHA1da91d3219a4cc564a8914a40406b3f813567a336
SHA256f2825eef217c1b3cb8b3c2c9de79416e7ff2a0c3bfa668a74ab1d37ba3d3128f
SHA5123fcd735341e8dbddd57a34418d4a0ed9490cb15282dad2000e7a6639ee2776de54d3e375345c18d67c0dd56a4f007a9ffe9eb43a65e02b38f1b5890c811a2cba
-
Filesize
1.5MB
MD5cd97dc2688c6581fe56e84e44b03e4dc
SHA10dcc23f969d716234e73c4a3743c5ba6c9dbab40
SHA256ab15bf7052b535c67f8ed2f5a8db465b2b63b1238e77824740ffd3a73519e73f
SHA512ad1723dd27e4603df255fc4a3c53f4b6eaf269c6d625caae5cecd363755cf13454851d0f4520cafb769aceab734adbdd92e73e10b96293606128a5cf3fe523f4
-
Filesize
1.4MB
MD59c84881ca6ba394357290497e97379af
SHA162643bf9bff9ba666dfd7ed7643ffb69de0148fd
SHA25655789b7e4a7af0f77b935edbc6ff25901a0b49d6d0f8cfb281cd19da66926819
SHA512398777ccf98b1ee8b64ed611ff3f9a63fca6dfc852c9344bb3cc701f34d08bffdd95ec35ec69a6c81b72d8cd352f1f1d15cf0337593fc6ba0b35a39185cb15e5
-
Filesize
1.4MB
MD5e2cf61f21d7d957422140c30a11bcce7
SHA1b8560af4cacfbdc13ba455c76791617c6b0515c2
SHA256e1c3f347ff56f4558dabac53939ce195b1a26df683f26c142e8f3aafcbc30ec6
SHA512fc6aee876e76d06176d24741e858c7583cbd7283c3cc3af4bda8758eb15170d4e426c3430307e2044ada8c05db6b4f17303698fd3f3de3c6b7ccb9e7868c3001
-
Filesize
1.4MB
MD5dba4a4665c06a703154d4cc28dc2ddeb
SHA19db7b2cded65fba1b8edc409e8462a292f8d1a05
SHA256daa646dd681db6f61abab465cfd645cdba6addd6b1a9eaaa3f9a633614c3050f
SHA5121ae07a8a4c89923bd7da5686f2af0ab49e54cfdee6a8a77744f684b1fa0a94fe5fa62b99b9fb68108847c20a6a71f226e8f4a0e46e8de6941d8429275a7e76a5
-
Filesize
1.7MB
MD539a3455a3163b53479339b6a1867b966
SHA1180a1e109a5de39471532e2072ade2b6500f6213
SHA256dddc32e786d7374682217c45a4378200c626878428693dc74668b79d512bb9d0
SHA5129d716a17cc0fbfe1c900bfdff65f39d2a57406d15433a0c29180ded0d33b5ba36db32b7e4a5e4fd647689affb00fa45b053b9818f217251f25c3f935ade5abb0
-
Filesize
1.4MB
MD58f5b8593d975998d61b553ecfe3a65d3
SHA117e68ad67e7753a13b4b6ab813f0ed94a5e6ca56
SHA256e2cb8ce8db7dcf91700cb4806e6ae32e1c3fa8c53ab99cc539933f01904fb24d
SHA512d6dcf4ea175ffc9db898400472e6001053a14da4c28e4f43f3881db82b661297780ff7cdc28a85938baf2f2dfb3add9c7fb957b77dcbf93fccf626010de7ceb4
-
Filesize
1.4MB
MD57baafaf4301e3f0e4cf7573252c9c856
SHA1125686b0523dfd58172c97d94f6b738de4d0ca36
SHA2562b8921cdb6f01b698c2dee87ae63439d9aba19ec238956fca366d8af7f36eb11
SHA5127e9357c1c37008bcd76391a1ecc2e5abbbf066682795edbc89e34b6b591d306d32d03d9b63715c4f18571b0ff0748aec462fdd3883870bc1f2cdfa0925a2fd17
-
Filesize
1.6MB
MD56f82504e997b79edb135e0c0afc99b70
SHA19ca63aa6740ec776e333889702c73e5b79695e2d
SHA25694f05f483b174f38a7a6af274269fd727435f6b9a09310c63452ca7f47c2e011
SHA512c8a158f5a7ae99035c1e038cea858d67c0bdc9b00c638a517bb14571c470e46ff344cb51c3c9e28eb3b48cd845ef83478f8fbe6193008ea5bf6d34f1f866ba3a
-
Filesize
1.4MB
MD5f7bf7a79f71d6707426fa9503b38197c
SHA165415a7e5e5bde64117512a327724042efbe0a6a
SHA256bf6c426b12ad2977232dc2f8b2d9d06e5b32baeee6e3bd93aaa36fe6ece5a1bd
SHA512be15d86ae9f804bdae51152e6aa1e1811c6116562c7d79692a4ccdde12be9aa44181d7104f4020a7753036bda67715fceb53d0fe384da331c5db296b337e27cf
-
Filesize
1.4MB
MD5cf2424743a3c250b73db73f4f2a4e47c
SHA1179d60309fff852d9642e8d474fc83bd669a904c
SHA256f6edade3e40149f26dccd396d9cb0b00eb90e49d879815aaccd36339497bd869
SHA512469c4d935a6bc5c133ce7fd1b20ef2a3f6c4644ce824088bfeac71f5f32ba0fddf7accaeefad45a277acd09807afeb6b7fcf85d83a38481f8e35cb7c7b1ceed5
-
Filesize
1.6MB
MD5b50b7fa1f713a7f1d4cb0e01825c89cb
SHA1ceb957d74a78a332dec10491b2d6507290f54f93
SHA2566dca53bd05af3c6d3386a30fe4ba6812309a2a77a652fbfe88473229e99ffa1f
SHA512860f94d93a3a80abcee21bb5d751070381ace8c1df664a077197ea0efc7aecb1c87b414e31be2b497e2f08293334e11923cc967a77d447f4ea5bfd2c32083f3d
-
Filesize
1.7MB
MD5da53ed2e3e6b8d4efd56b0acabbe7837
SHA185a6b452d3e228a449f9c4bfecf1ee66c3d76f0f
SHA2563d2e9f5685c1c1cafc1dff8dff2a5f06ddf674453efb59d03d1876f809cfb593
SHA51268d53496826ffaf3a3dc3c177c9619646467ecafac7e9baadca19d47c3e5cb26566b8bd07938cdd0994b5a048b5fcc6f497f4336be17b8c35b0a5faa75b6ecd5
-
Filesize
1.9MB
MD51a2762e8f15e07d80fe5d74a34dcf641
SHA1b325620400417d6a230ba007e50168a917c818ad
SHA256eed1680b9a3f3c7fc3af63625ceaed18cc54a8c2dca6d68eda142bbb280be108
SHA512e2c29d3ae51c8bcb66ba9726c9c867bb870d3dedfb1cf80ff2fa53be826f8317c73f5528da9a3a76f1d7c93dba17167fdceaa13e87f289f846e8f00b4a397cfd
-
Filesize
1.4MB
MD5dc53e4c4d94592298b5ffd2e50e527ae
SHA1d795ab8311eeb038767dc7abf7b4c0e3852ae381
SHA2566c3cb8a8c4a4cc6c7cde78bb067459beb5c5689dcc0385b765462fd2b5e0f6a2
SHA51254d8405646f02a954ef9fe861f982b270abe4767efd5e211139503063b579e76e783f8d36df18b88f91d5f4c8298cc3dcff76376f9553c9ee0a062a4cabca77d
-
Filesize
1.4MB
MD5239306d0012d8e6f505767510da5b545
SHA137ae7f4d95a20be627b312762fdae5b7672bcd6c
SHA256cae1de9cf133ef30994fd3ed965444cf206f3c49cfe13ec7b0de4479907c2269
SHA5122c8159d40248bf84456d895446d415c61e40fd2a64aba26894510f512ea7675423c460800fcd5fae25e922d2efa9d862c8bfb2a881c1d5a246eda23d7793ccba
-
Filesize
1.4MB
MD5e6d391e9897894754d5bc85d0c706b7e
SHA1fbcb075a0be298248751470a27de09eeae26a43a
SHA2567ee2a08fbb6d2532927060368d0e730917b69ff2ad3a80190f47efb0ac9cd6b8
SHA5129b256f7f5dbdf87077d425d22c00f5f19c277d086293e6d6989f5a6275dbce0ffa8d67a324713d2737916f2222eef6164ef213e5604cc5e030881147bb478e81
-
Filesize
1.4MB
MD5320a0a171962a107ca9fa6ab6df18af3
SHA1957902d33f0837e7615f29f8824857b90e83bf41
SHA256c81fada056330b5422ab0ded9ca0df77f4a2a38a0461a3c9bf5ab220006aca0c
SHA51227dedd46f3f9bae5faacd72d6255801bb41ae9272af6adad2dd73a31d39c2efb7a1556bd895d60516bcf6e4abafe74fd5fccc51816bfbcceba539dbeace671d2
-
Filesize
1.4MB
MD54af12f68a84ad21545ff6e555061c0ff
SHA1a3c6d0c8d9bb4749ae32e8b965cbd34f8d5b0662
SHA25635eda1275ffb69fd3f7c3c6dda3b45b7cf50e733e97691ea245981c70990d231
SHA5123d1afc79bd948c0844f78bd23a93b1776e91d366b715f83f49fda3bfdbdd0f5c024c8ce9aec215170c6bfdb090a4f823ea3b118535e7932b65da3f543319e7d0
-
Filesize
1.4MB
MD5ad6b4f9171370bc10b26606e84b6d126
SHA110b02c7602eb099fb79af43a8e265cf8547be5f6
SHA2565d76095282bddb99865b6d514ee4e5c5932fe9eb2693f919f8f34ee5a089e4d5
SHA51288f3492676161fa776356b9159113ff4c547a79021a1b42ca488918e827b0570d149cfbc7a46319ac84a2767d09d7f0c5ea6bb19855fbfad2b0aa13548c2e002
-
Filesize
1.4MB
MD570175aa5e51c75c90de97286cf93a843
SHA1567410ff462c8e371078185d07a604e010b7aa95
SHA256157c32941abec1b41d9beffe806b3a2af1fd8fe97968060d2349a300a4f77f0c
SHA512be5168de02ad0df9f314c50391dcd6b8d5d4b20aa65845bf2651eba05e8b52220b5e1ff389923f8f52dc9c1ef864cfae6b7d5f83b492238a3987f090c6661e82
-
Filesize
1.4MB
MD5a2b64ab56ee4efc44434a9dd44554a03
SHA187df17e661c3253588769bd2555fb76d16f23073
SHA256845ead05fadba5c7987689f0815db3b809312a3917db6727cacff463ce6ff928
SHA51282032076a1052fd61af89e75f18c341d72889a817ca58d4442e73951a19d2cc1ba50617ff8e598c73c70e334e7b7e075137706abc3a32c47424356e6c28daf51
-
Filesize
1.4MB
MD5ccadad03a0b8f599b0ea670267d55561
SHA1716c4c19143304bcc4290a3955f9920ed40f71a6
SHA25690ab6b94b747ea9f19e65dc04e221ce329f7117a864c03d61ff9382e3a1e2c98
SHA5120353bc39db34cc16814196b77bb2248e4c88a3dc90cbcd0c4e3db99541f8b38b232bf72938d92b78f50f4b4178138817141524929c3a6383c0c95d8db1d0580f
-
Filesize
1.4MB
MD56209a7d2a6fc2094f0e6e1e01157d541
SHA1d3e24ab352ce3c48bfb4bbd202f0ff60038dc470
SHA25683d40e25325dcb232628d199c5e1f447e69d14169b92d4efd4238d8da79069e7
SHA51228f6415f26e298cec3225b3bda4eed9fea5e2f1026ff5005266a92e810c857659f7f8bd603a2ea3f2d50be7072817e1d372a39292ea6d061649095a1bf190f98
-
Filesize
1.4MB
MD5caf3f9cedc5ecedf92e0bb1317202dce
SHA1b1006ef19e415fb1f1ef5933607ecd1f1769d8b0
SHA256cf3e9254fc315f79f7b4ec8cd61151a29d35bc15fc18ef8f07d58bacdd754d66
SHA51234982473e825287171d590001c40b62f62c09ea2b8fb4d2b7b246eca23b0ed55065ee97390e1d0d1c2e3754a7e9d62f0b589c3e1d2c01e8b1e795dbf27e1cec0
-
Filesize
1.4MB
MD57a81c892cec8b66c7209892b1db08894
SHA1b556457d16cb3a745d989a58078485a311be36a7
SHA25616200f93a738813da62e4c33468a75f74ad21eb2e2a94747585a1f55cc026b8f
SHA512697fa4edf5973e7cc4adb8b7e87a66d1ac2ee5430a8f05d7f02e887a9870e05fe860f22c0976ba60dbc4ca42fc78739a59ad5d2df6d6c77fdf1264ad946baf9d
-
Filesize
1.4MB
MD52fe012a04de024089b74fe048ef6994e
SHA1ce2473fd2bc1a050276b13960e17d4fd1e85581a
SHA25681cf333016234ca6e9f9442cf6437b7b5c80912ffc2809962a7a6a5f85f4e870
SHA512c821ef70b49e6bb12b2eca61a54e1869b7e050bd5568daf8537628b7464cb5f8e82c82a14b09d175d0409f1850a2bb0dab9cd8cb2eaaee845e309bd24b025496
-
Filesize
1.4MB
MD5445e6181781c583d900e46d766c8c91d
SHA11bd4ce766331ccc9960382773d578e936a3b0a15
SHA256215c408356ff35ffff9009027b9c8eb7a85e70e094109d490edfef8fea7471d7
SHA512177f88269b5888e534e66747253db7f2a2693de68da8eedd77f598040d2bfcc0637b5e452946a3b3e4bed56b71a75c4fd373a1ac3b131aa17528838588980f9b
-
Filesize
1.4MB
MD5b3fb25bf2609977c157455b12cc44d49
SHA137757d2afe92551cf258474e198590f8eeb16aa1
SHA256c17d5a8aff2eb587c4a184d82005855f4fa92f71e66a3e5686c0aa997ff05b0d
SHA5127ccf789f62f90ca1c6e0b06e5147da5eff930b0970985f77bf8677ba32835864bd1e47ebb9e5fe92901747cb66eb76c7647cb6cc20d81db0dc32b7efa777382d
-
Filesize
1.4MB
MD58e08f3223ff32e19574863063e4ce764
SHA17a4c3eac6774da6b81d87f0d9866c0f8938f6922
SHA2567b23c2f1940c307b878d52e98c85fade6ce2761b3f5bb1a93876f9c8aff25cba
SHA51266f7cc60d310984b1f0abfaa575439e523a9e8b75c18492af409319b3abc3abb07ba00863f25850cd64f5cd736ec74daa9e1258e14a6717ff80c5c13123b206d
-
Filesize
1.4MB
MD58755a7ebb5460815a039742fb2cc4211
SHA1bf35e566148e7ea93c86e82f75c93b0cc9edbc5f
SHA25654f20ac0a8b6caf6c5ff326b4c09117470a320fa996016f618f6f6616727cb2f
SHA5126a21317e800bea369226863d7697d4c5d2f566f77a298c650098f007ef417d5caf276aa0abcbf6d71e99a52b214ef9c0caa5faf4f4e6ae01dbd4d1e713023acf
-
Filesize
1.4MB
MD52d6fc12ef619411d54b1da7c50e4f238
SHA1f6d38bd175db2f64d54d2976ad9b1e80f7f13346
SHA25676cd18ac0d7d4bbf4f9cf53aaeb984bcc1dc85a849d3c7c2085f9cb44f16fd92
SHA512566d728ca878eed7c13407b665e6c14a001addb8fbe7ee33f72a7c5567885e9c9dfa37df3a8cdd179fdeb22a72783a3dc9989017b836bacf85f6417e0285949f
-
Filesize
1.4MB
MD50a5d20daafa77731eec49cb5f3e0938c
SHA16bd8c435f2a01bcfec46ed406c825587d6ea7ef9
SHA256caca2c1114e608abdc263cffb0b393cb37e70d30ce8a42145c0771122e7998eb
SHA5120fe1756f1084d2aca8d49e223ce9ed84ec02e2900c754bac0c523232de66f7791976f9bc6549264485a964bfa21c708a08e05af08c82bda994cfcc516dd7308e
-
Filesize
1.4MB
MD59a8387fe536bb192e7a391f7678f7144
SHA18fd65a67c8b09f0264c5bf056c65c4d84eaa9ee8
SHA256972cc3bf8a5eb0d10a41d6a0b418bfa3d9d4e22769e1edc86c61f2dce13c7505
SHA512128c10843efcb77cfa8d21fb9e217ebff7ec64061c2ee6643127ab95d614712d813c69948d21eec076b015082be948f33436bdef547d05292d42a6f333b4dac6
-
Filesize
1.4MB
MD51bcc407537058bb1eaed102f8dbbd85d
SHA108172561dd3b0cd674c448bce15c26f10b5b0d98
SHA256e3abf0752fcd18e8a2f61a52966bdff8bfd35b71663b780d81c512789c63e0e4
SHA512e7f4e4e133f61b2cf90822252e0d38cf3ce43389e202f64f553634f1b62354dfcfec18cdff370bb5597b273a60d012b58426c1a2a5e6e1c5c8a5f38075d4743f
-
Filesize
1.6MB
MD550fa29abf414baa3c017d8907c7747e2
SHA1cbddded9419b7301a6c397f29cd5c95bfa3e72ef
SHA25624532e78a6bacb54706e86f856e2687e03e927c09e5b8c3a57583b0c85fcb928
SHA512820ccbed299453934c598ca5fe4d0b5437cc32b3a21b659bb6d0c93bd4ea52d613d5c16a03104e5b20736a367fe89b9dba35dfc618429df44ee5702eb61cafcc
-
Filesize
1.5MB
MD5de36937567939cf39942d48fdc0b773b
SHA1d1ac91f1a4a556f7cdfcc6162f7a156ca283616e
SHA256be4bf6dc942ac3c692e4a1d86b54ab639ba8fb8b2f948699b6538351bdef4e81
SHA5125907301b8760345fe68ac7c6d1a81005e91d50aaa1ea8fd6a409837ceae6fc2fe66415e6fcd2651d348cf1cbf9e150edbda7aac5f504a48285129c95b47c559c
-
Filesize
1.2MB
MD5cc6889db771b027619699759972f0838
SHA1f7e09344d64e96eec67b4daf2f03cc826e1892e7
SHA256e60cb2e7027913ddbc271fdf6a9e5f73bb6da61d80d8e9d763e2fc39c590d0af
SHA512484acf9c593cf2a3636a3e860aa3f023fa076ee8ad35aadd389065ed14411c5b45b6f8b11fb54cb0000638a1cd0b6cda59b277c939586cc8e22c731ec6fd707e
-
Filesize
1.5MB
MD5b9742d1ac97f86f58463f859c3dfb4f5
SHA1e494fe76e47195809b9db5c78cec9e2c26c66714
SHA2568b6544fc088488df41e704697f7938de019b7c69e7343da7612cf3c246e6fac1
SHA512982e9dbcc3ef948f06a1b975681f77d3279a37e16523a109bdd60bfc832d4258c84014397f04af0a5843fcad54ceab759732ed8705fe65865409a3ea308a0510
-
Filesize
1.3MB
MD54dec4f79b197cff332afbfa8e11a47e4
SHA1daf7be68e8870d27ca71a8abb554019d143907dd
SHA25626ad62e19152e0f6a569f8dfac252650fe5d11d1d9ed7c868081d22ab3da3d13
SHA5122fb6060f6e23da24bf0cf42dddd536e8a53830de0658ea9cdb153626a1fc9bc8983823ae7ae495e9e4fba0dc6e634135e902c929a7b4f9a1c815c8ea15806aa9