Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
27-05-2024 16:59
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-27_f826a4457e7ba87e3d8622d957ffb693_ryuk.exe
Resource
win7-20240221-en
General
-
Target
2024-05-27_f826a4457e7ba87e3d8622d957ffb693_ryuk.exe
-
Size
2.2MB
-
MD5
f826a4457e7ba87e3d8622d957ffb693
-
SHA1
842e790e2db186d5868c51739d1d870ec454a543
-
SHA256
b8b6fed3a278bb46b62f18239ed112e49eaf54ef858d876fa2a737f7296c6cd0
-
SHA512
3d811db665bdb865fea92815d070916c12355014b2924526ed63188d6df4024825ba2e4e67a332cdab957c002f56321c511ebc7f097e52de60e14ea9b78802ea
-
SSDEEP
24576:hOObVw4TaN1wdFukCba4oXtgLhU3wEdmh58YCCdQaqEe0GAlrBuXmU4:hOOh3aN4FuLbegmtG7zdQ77mU4
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 1116 alg.exe 2524 DiagnosticsHub.StandardCollector.Service.exe 368 elevation_service.exe 2992 fxssvc.exe 1088 elevation_service.exe 2796 maintenanceservice.exe 4288 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\System32\alg.exe 2024-05-27_f826a4457e7ba87e3d8622d957ffb693_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-05-27_f826a4457e7ba87e3d8622d957ffb693_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-05-27_f826a4457e7ba87e3d8622d957ffb693_ryuk.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\b8a291f4c3a5208d.bin alg.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-05-27_f826a4457e7ba87e3d8622d957ffb693_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-05-27_f826a4457e7ba87e3d8622d957ffb693_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\dotnet\dotnet.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105437\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe DiagnosticsHub.StandardCollector.Service.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 2524 DiagnosticsHub.StandardCollector.Service.exe 2524 DiagnosticsHub.StandardCollector.Service.exe 2524 DiagnosticsHub.StandardCollector.Service.exe 2524 DiagnosticsHub.StandardCollector.Service.exe 2524 DiagnosticsHub.StandardCollector.Service.exe 2524 DiagnosticsHub.StandardCollector.Service.exe 2524 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 656 Process not Found 656 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2424 2024-05-27_f826a4457e7ba87e3d8622d957ffb693_ryuk.exe Token: SeAuditPrivilege 2992 fxssvc.exe Token: SeDebugPrivilege 1116 alg.exe Token: SeDebugPrivilege 1116 alg.exe Token: SeDebugPrivilege 1116 alg.exe Token: SeDebugPrivilege 2524 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-27_f826a4457e7ba87e3d8622d957ffb693_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-27_f826a4457e7ba87e3d8622d957ffb693_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2424
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1116
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2524
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:8
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:368
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2992
-
C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1088
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:2796
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4288
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4196,i,11266875042087428226,16669718873272757238,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:81⤵PID:1304
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.3MB
MD5c31f086acdd0e439d82c71f856f77bff
SHA1cb01ad8fbef72f5ebe07327cd8087b0ac5d150c1
SHA2560fcf4f2d8a409da912ea5e6f1aaba1655eff1d39bf5b4d8423467660cce2d2e5
SHA51215135789b78aa3593c8827aee587b6ceea5873e508c440352547984ede813c3062a53e1f6082c85eb47fafadf6a61b94cf146ca7392f54a3b0d4120f415c089a
-
Filesize
1.4MB
MD5ef579c8f05cfcef65c0983dab301e7e1
SHA1804deb43a060633f2e22865666a53a91dacbc20d
SHA25624719a87ebe8bb82f8dd4f725947d890e2c25a2be5518b5ed178f32d4c253962
SHA512ba2e00ec10402acb786d3bce101e3dd57f92ffb1504fdc3efe406b11e4f1f0474dfb7e7216e8b565668e4ad2b4c03a9137a0490f46031f75c140d521d30aac1f
-
Filesize
1.7MB
MD561d2ab329c91155bcfd505da72a44b72
SHA137b91039d9d6e0d5c25a5d5e18cec3b03eff5351
SHA2561b7111f2d387eff67455ae3979e3f03a6ca3dc2042f2522929be0a258b9c6aa0
SHA5129a6bd23d494a13d29cd07dfc0f1a490af86ab5d6669e43c9783c4a426e029b9f649142143a50f5c360af128d1f4b22a15aece0a826ff421934d17fcc12788ad2
-
Filesize
1.5MB
MD50f4bbc63204b5fee8f4bf1c3dbc8bfd6
SHA1106b29d47b75240c294965e97deff307c4145b3d
SHA256b3f63e6632848acea497db9adf86a876773158d484cf0002b541b75239dd5fbe
SHA5120b2a0ff3c121cd5435b87ece1ec9b520b0179c6743ff8d5fae8cba0490b58cf088caba3ac0364370a84cab4bf16fae470c98ff6390a3f4751d0f037478bfe3f0
-
Filesize
1.2MB
MD5ca84db3deb6809586058e410c3b67705
SHA1d132248464abf6dfc8480185f0ddbbafadef1d55
SHA2560b9bce2e636467509d67169bade27451d65e8989b9ca82b3da0d27f04c87b5e2
SHA512ece5786fe2eacd73a98b7aa589c02c8b8e011c182028589a5c6238a235518df49081b3fe37279d9f58d059034d7289759005f9a5dd67b24d20708a16ad144d10
-
Filesize
1.2MB
MD5a106a0a811425d79f6541098077ca910
SHA1b18e37d3f4c259e458a2311ef3dd9343ca1aca8e
SHA256d3e13a6d5caf5e4408ae0042b954398cb532e9caa0d39f099229fbf208aecc96
SHA512b6345f724c659001252a57a87609bea9aa747094f4898a0c550726cb95d32795ec0fe801fbe7c6c1ff254da824effb030ef37366c1d4113f9efbb63d89b399fb
-
Filesize
1.4MB
MD5eb6efc39526ca36f6d992a57dcfe9f2a
SHA1fd302c48a3283f862d0c6e39ff3f61a3502c94a4
SHA2560def6e13aa03805fed295ba2cce2c964f2782e28990a7aa25133410d073b9649
SHA512f86736606ed6213c2187a39ed5a982000f3acd28e5132bb08083049748fb774330cc34f39b04facc69151b7c1d31e34a758545e0a0555a335184f677752757d7
-
Filesize
4.6MB
MD5b9c81b273e7faf990ae716e0f82e97e0
SHA1d9ff9f9e8228b6ecc3c2ace84705089d1e5d31b7
SHA256f64eb4abb00053e4f81d1ea912618c0d5d96f0fa8f5cc9ce48eca383a9de0a80
SHA5121be01a658391e42f925944d6d2a11229541d7e41a3c4209a2ff547332154ad2d09933936597e50d427f98ac9ccde9b916af8b10bd2b31d8cce6659d9da280665
-
Filesize
1.5MB
MD5471287749fc8bf9363c78948a08288aa
SHA1a51d55f7463aa0bb6d3f23f3204f8a7fcc2be121
SHA25654768140db0a919e168b235dc3f542440bccb043d81203d1e5c8d366df345763
SHA51222dcc22630b263d108e19d6889a002478bdc64d0d026329963420dd7c0203420f2a0b1e94a5b793573e37896c248011cacc9c22453ba376ea7fa6679290b6abd
-
Filesize
24.0MB
MD55cd9df1e2bdc6a529d3f8462c8e0422b
SHA130b8084025e607198925e267057bc87af339daf9
SHA2569a81bdf915c93b3e6e89cee576650569d5051414d9f13eefb34d0d49ea0fcebf
SHA5120d16e38e327f6a39f3094d995d94b3bdc9a7f88c10f5478d361915e0c7bd947d5b9568e7e0f635a3a59670614e174442991c5a1abdad276551d2965d54a5f603
-
Filesize
2.7MB
MD5d704130925aa9a924887e34c6c096a41
SHA1dff1a129603912a1a93a05dc25a7c4349fe89e23
SHA2562871cd75bfef01e36ee0b59775e392b6ae5eea4b1bdeac370d23d69dbcaaf02a
SHA5123b5910ee16e55541686e50c6de154e957d91d01603ad34816e98b1cd1f561607b0b5caf29fbbf67c35d7529dde9f9b822c9be2f656ae809d92eb1f99e5a94e7c
-
Filesize
1.1MB
MD5e4c0f3b96b083fc94b75a4a126e0e0e3
SHA1d7583f8c5cc282171698f38f64a4779e4313c1a4
SHA2565dcf2d172dedda70389e927462fc4cc463d8fcb8d28558fede5173637bc520cd
SHA5127080b90a71acbf9d98663316ae45618cf2abe15b5e6d3827f4f09783ebcba9ef0f9e2052cb45c1941609c7d02a918bcaa6e9a20f25b97d28d85f0f0efe1468ee
-
Filesize
1.4MB
MD5af99da99bc064ac4b8cc1723dd865903
SHA1cbaea88b7f418fd494e27c395407880b7ef27bc9
SHA256674e62d0e3b39dadf0e3b9ab015270ddf71cc6892d08ca4678a047a42d43925d
SHA5126cf612c8ee1581b40438d69f4e443dc5770b77809133e6e97c85677ed4ab358eed34105e5d13a066aea12408cfee272133eddbeec0db14ccec1b3b5ba39e9700
-
Filesize
1.3MB
MD52dc803e0ea2a504228a111fe4ed86bed
SHA162751d08bb60f9060b5fe84d0b7917af3052864d
SHA2567570581f22367a049f94d2d7ef16beb44b320bd56dc1e6def2163cfbbe9fc0ef
SHA5120ae30fb4d4be147373c50848fb260ddc87aad8fa3391576ed5c11148191bd434f057186a0fff1664980e67323199a1937cb10a874c459ec5ad1590b490076664
-
Filesize
5.4MB
MD53bab5363265b87a717160411f5733ce0
SHA1357497624e3e7313d6a938a16773530c0b0615c5
SHA2569eaf59dd9644b2e09e8fe5b44e8fbca4fecc717b4fb17c220cc6291a08afeb3e
SHA512815f39ba92d4e6e2a7fc99b8c2d7c98dcf09cf66f914e8b244799bb03919e8a7ebfad53127ecd1a451135f84c3dad17238664a5f15965d51741fa81657bf2053
-
Filesize
5.4MB
MD5989181920d4b7bc3e91537a1c268d2f9
SHA146cb4dc189ac4df1f0921be8bc6859e0ec7c0c63
SHA256764f4dbf480e0eaf2c900cf0cec49c61844beaeddd9921409a42e28dfd4b099d
SHA5120d0013c9b6896ed54135b310c29feac715e3e77609f38953233c25a43666336c2b75b7e58e0181694d113a55aa4072979a14a354dfb523f0575da463a4d4033a
-
Filesize
2.0MB
MD5229cb251a7708cb40622c3dc9b862249
SHA131732deccefc1910d172229fc679964cd5721887
SHA25606024888cff7f39d2949747e23c0851b2f285fde837a775fc408a2d8337c121f
SHA512dd6ec7e79c420a57723909c19bda26cd727b482409057dcdd1a7d3eb152189d63a01c244957f3f130da7ba83e36e5ac059096e3c5d08e7e760d048e86b9be876
-
Filesize
2.2MB
MD5249dccdf90b9669ed2e93beb072644ac
SHA14ecf668a304e606d2f65dda6c897b72ffbce901b
SHA256b3ecd030a3dcdbc05796dbc58e723067e4e4077a832c9f5dd3f629305625e05e
SHA51252eb556e11b1c752887ead5017749ac847e49689ecc1a2e606795bf614e817324b413950f7fb220f1e0a2153786fc14cfe841e942359b4f34a966bc79f96b3f7
-
Filesize
1.8MB
MD599308972223db4f11234f3ad22a3f4b4
SHA1d0b53dba0b3387438ff4d217ef0d75337ce1dcbe
SHA256dcaa0a9dc9014ec590aa2bef8c630777bced7bd8bb9bebdc89d2e2f13884f6a7
SHA51244965a39fa99f1c1f9642730f1bdb6156902068f27714e8a0c5baa9c07c2f5909abe05584d4c75d96d332a0e66ce4a838a7fe530ce7f0e9fd2f1e064cb34fdd4
-
Filesize
1.7MB
MD567ad342d10e9ac15a9fde6765d79fcba
SHA1e542bba82e54291c35cc59866ca2bbd2ad98d2c5
SHA25697553bbbfc776d73b63efa557802f183e3ca352e72aa3e8ed829686e8dc7a264
SHA51267c3a572c08ff52c3b91856826246b4abd7a8b8fc395b3856a55138e3b5325254d911d1005873ccc32d526b59980277dd3b70630649484d1d7b0efefff28311c
-
Filesize
1.2MB
MD594d4bda4799807beca2f672e09e7915d
SHA187c79cf0041168e6678809134764fd8ef65752d6
SHA25666d8e98e89fea8d3319c642f1c9420cf44009cf65fdb19cd2b6f923a11994496
SHA5127de5dfbe64b450c4bb87ec92eb7e909ca62994ff88ce0d2a044ef2ffe98ac50fbbc224e5618e81581a809e415bbac9cc6ef353cb2ea32dd120bb4802e6cd0775
-
Filesize
1.2MB
MD522893dd6ac3c0d46124229e5bcc22cef
SHA1283217f1c19f5b545e1aca41259fcf29a8ab3cac
SHA256244163855e38836cfc158ac35bc0b6e374eb5b1d07a09c787cd9a902b42d6bd4
SHA512ea2ae8804307587b57dcb2c7ab2652ee353a90f2e871bffa475a7b5f6df40cf07c87d3b2cf22b151fc10c28484a06797056e0537fc0707f70980e697124ad63b
-
Filesize
1.2MB
MD50afec53a6a1ca4466b6ff9da9dd9d891
SHA11f81d87d55cf14b27b9147853cd6af7c50ad03f8
SHA256d1235eaf53ac7bd815377504f9764aef6e7ca6a5b3e915c4b52431c2c14f171a
SHA51269fdbcfa9bc379d1947b145c19cee5963763fd771ed5e6dbdbd14d53d5cb459a1872a5751746ebf27afc9f28e5a5a776d01a668c3b510565f57189973c08aa33
-
Filesize
1.2MB
MD5af0f7dd3a6b43faee64e31b1da93d216
SHA1b8ad1fabaf6feb12d242e80ab95bb1e3a70959ba
SHA256fa98597604f9a142dce3494c2dfcf6532aa81d423b5c72f88489934db721ca64
SHA5125ba07d3d5742f81618025956aa095f0f8366465de1a0a2c1b972234dc5419ee9c4286a63024544f81edb9ddfc3a82446946905961a69231149b72e6dbe626ae2
-
Filesize
1.2MB
MD5d74fe40b69d65f24fa7bc2295de6cae2
SHA1cc417d5fada28f46070427648ec8701de5fb485a
SHA2563fe757a4d1eabfea7ddd06067b30b5c3ef7229fdfba2d0174a4eaf7803390906
SHA512a455b68a08f18664b8ca346ac0860434e2134b8cffbf4e182b0aacede9994c9b23db4646c1a53ac6f67fd4f07e973ef198625b8be8702bed58fd3d3bb5ba3aaa
-
Filesize
1.2MB
MD518533414ab8190d0545754c3ca24f4a4
SHA1a044f74ce18f6bcc4b4bad7ab64fd3f69666fc13
SHA256e301b615b23c836dfb1d82430c2848903f337ad47b67d88e03f74e2b4827dc60
SHA512b9261aebb0eac31971929fe0668dc5d45deb8fca57f0bfc0c7d3f32fc67a0d4a24a6829229c561563e6fce5e7e158bbd91af93c90faa1691fbf4626a3cd4b0d9
-
Filesize
1.2MB
MD54614fa3822a2a71c77e7e801b52c3bf2
SHA1a3e8b3ff0057990855c4e968fb5bf35d5c33e28b
SHA256dbf9efe25407bd028f8c736aa4ac783ac153c7c3ac5b1c829611759d15e4ca34
SHA51294e525e96d3b970d8bc723fe09bdbc77216746297307e6685e21ffbb3bc8fa9483a94f76c607bdbfe0d3c68ebc8e057256a2824a95f228f9ad362739226a5684
-
Filesize
1.4MB
MD5f3813623cdb27595fcaa820df1fb963c
SHA1bfd86f91082bd9b5377f6b1f815a063ae788b996
SHA256f70c0ad99932e6f9d56f0388656b4a0b59631cf21d21a037d10d60b6e36f2f1f
SHA5129c777bcbfcfad3c2e19a7ed118b9289c0af16c27c1c3494b7d95dadb1a29d4c44798b5ec340f874083f9e413bb787f80638515e3df6e25460d230999446693b3
-
Filesize
1.2MB
MD57ff017f706b55486413d4439a30395ea
SHA1a38c2eb6415f2f642af65fc45d7e2d718ade2fcc
SHA256c050205b5d91df039fd2af41599d8dc58d525bf9dd4e9c9f9c71ae268b1c95d6
SHA5125feab55f510a8e139120008bd46ee39ba10daa11073cda3df16fa015688ee6f8a7dfce7cca1b5b64eff6a4a8aa74c0964c6185fba530b176e0e3fb701c3b1231
-
Filesize
1.2MB
MD5016dd9eadcb419d648320bba1ee50583
SHA107e1e2ea1be03a6915bccb38da383203a7b9c546
SHA256b3246c11e23620053039a9ef6fa6f1b53b43c6841b39091e87afd0fc18a2da86
SHA512cf7ea407bf092009c3ba5eb179fb079335fc1c0350d2bb4fbcc055ac53dd8351c3d63c717a4747448fd3e8edd6aaf87a1a206f423a4937b830ffaa3535539d81
-
Filesize
1.3MB
MD51443619f505d21df0311b894f5490c88
SHA12250c71be073ede1ba4de1b0ecc1fba841bcbc0c
SHA25650a285dac0f19ce50ddf2a8f0bcf44c93bd2b103ef9abc345bd3b3b5eee16581
SHA512c9db2d6cd2fd26b4b103f5bf89d60eb7d863239d4170f87d631c9f86d238c8b98ef2627e9c825377795417ca1967d120084d8109d50c4b74a3494ef2a332544f
-
Filesize
1.2MB
MD5d1227709700fc5328ce1bacc478590d0
SHA133ade959cb11a184a3b60996ad8d41ed20c3c7d5
SHA25607ec381d5906d6e35d45c86ff584760ee0a1fa0d004da07ea20b671149c3f603
SHA51263eef03d03d5edd0ca80d79198e29b6476f6261506d6442020483e917c6d96b3d6b4042fb8b36d0b157ed75dfcf0e4e927ab6d2b212a7dd7e7e8e5a752e45061
-
Filesize
1.2MB
MD532c93697769859d7df3c69bf80e3e4ee
SHA13d2fc4e95cc5f529cfee3292ac51a0ea9c049b79
SHA256fa7671d9e94b58142b45fc177e035435ae2d4ed00a77e9f0e8b86f18ee8efc9c
SHA5126de32c6483bb8ebf17438157e84451b17d6aa5311e7c069008a1eab6fdf826146092c1c9a6cf815b1f1c2d12970d061a8ee75fd490bbf40c30c812226bb387aa
-
Filesize
1.3MB
MD5c2511ad724bfd062eee7ddb385a1866f
SHA1eeedd5b6aa05f81be7608ff6f59f7a8e22c9f25e
SHA256c0e5ad88c6ad91d38714cf171f84c1c87122092c2305f104942a7a536ad229ac
SHA51281fe90b67c755f8804a797cd9193981c845634cff690427072360472500ee9339049497cba91df4ea640fdb105bfe3a86d45353b51c3c872b4c0f401e2261d1a
-
Filesize
1.4MB
MD56128bbae069628ea06063bee4039391a
SHA1e6bf5ee39aa492b97a2922e7b0631b8c2058b341
SHA256ad71995b0f3377457af9dfd5e153a9ca7af967425b13bfcc45425abf698a657e
SHA512da81c95afe522d563bd3e240d871a5d5acffaceb641f878784f7b2cc71f126db9b35c4b38cf1c07f224d58dbda70e00b3ca2442a4fd1ae0ba275f2b457c6f3a5
-
Filesize
1.6MB
MD5744c2bd1f83c24e26faedecb1df9cc8f
SHA16403981e16f35a4e1c416c64fe05e23b9b78198f
SHA256a789f088c8f145f91a050b4c0216bb072233b425fcffef7000e71a276ff53908
SHA51211765eb87b2a6f8c8e50aabf0d60cf8562debf84025d31214aeefdd0c80e9467bf61e61dab5691aea49e8800233f8f20e527c16102d7588563b729010a10d904
-
Filesize
1.2MB
MD59739d4a24ec611be3f2e3feaa994a2f7
SHA187908a2e3ff11a1561b4766103fa27ab2ebae041
SHA256094468928358957965febbf6c366d7803b1d3a520fc08ce5a0b03da0b50a33cf
SHA5125e2b9b3c06e3ce2ac372f75a69e45c95415d2a3713166071f468e6d38a0028974a7a41b59e093444dacc0c88fc4a8f20f09df8c908c8104c4081d56fc0bd50fb
-
Filesize
1.2MB
MD5839aea364a79699a14d687518c3009cd
SHA1e07cf2a5026dd2e542eaf4f0847e7122eb660099
SHA2567dcce32dd1eb6c0b82e425d8f3bff125161521f27198f6fec1bf62557b9a0219
SHA51274de88f5710a15054d7aac23da51a636e108d40b2fb6cd13ec85981f2232ebed8d07eca580a9d54f2af8e0d57b011ff8bdf411a91a34b1f06d5d773c34ada0eb
-
Filesize
1.2MB
MD53fa993fe0927774935af1ba59919e5c1
SHA18f547410c79eb89c9ef743804438d72cf581beeb
SHA2560ad4b097ac49e0d12fd47887727737d26abc5976f69a7641109567a96abdfe04
SHA512c13152c0f65f01e9edacd90ab1775ce587469389be259d46a183ee366226e8469a4a29c446e73e310ad9a30203470ee698463733f0bc3101207af083b29843d4
-
Filesize
1.2MB
MD5eb1c50165e3259ac12fd9de612e5c655
SHA13aa59afb487d6aa038c53b2abaac57499bc7233f
SHA256df376a6b9bb33eef54389f15fdd0c7d99b6c8c9e6dca8520a5abcb34723fd9cf
SHA512db94f4aaa78a8ca1f38943cc089ddff1c9c26c16cc8b581b3cc9cee33befea6cb3912cca70d9f497f06f0474e209bbd6ab246d1174d4024b3456c5394a66f2c1
-
Filesize
1.2MB
MD5d8d87bee23dd4e43dd1b507510956a10
SHA11a4237ad53998585ed390e3d2589f63d4e47338b
SHA256ac5203d00f550e66c72d21043b53dd1d12ebced3976de8869259507c7251a041
SHA5121005023c1afac4d7ad56722552045a691d041f5a321a59dfa69b05753f8f6f10938dcf8b908f77e0b5995277cfa8e315fe1bbbe09aae4cb4e6da6622431e71ec
-
Filesize
1.2MB
MD51d139cc3c63db2230f2cda9b6cb65b12
SHA1dbf209a59bb6bcde85c9558f89159e6ecec31fe4
SHA25626578efb0672d7e9f8fba3c94b01d8ad0890e1543abc40f8818fa8854bc75eea
SHA51209b29461d6e9408f515da85318617ae86f68e64061d4ea52055dc034ab8d350079f75c4984d217081cac09e3d1cbc8497f2d74dab1b83884192a4a63249835ed
-
Filesize
1.2MB
MD5688cf1e077921ea274ebc45768c59d31
SHA1039c7a410c5db213b7f0744d868ec26439b08111
SHA2564b4ed578a8d436e5902de48c4a09821a0efaae8a97604fc6e4edf176af53caa1
SHA5129149e93c3b01c3f7d66e94a7b4d8d7a267a689d7e2d77a9c88727be405f1598dc53d8581a2bd987086ec8f6aa9dbcbb90963725c7bcf3a30888a548f2b3f81a2
-
Filesize
1.2MB
MD57ad89002285abbd4f1a1c642726ff85e
SHA1e58ba3ed98195c3986a094c237e067c10f32dd53
SHA2566c3bc33f036e95461432bf02505ddb747ca070f10c026edf2462284ff97b26be
SHA512779ff1651af3aa22e88ad83ef228ab910380dac197dc991a52aa7deb8e6c28fa97021b720ec199e336565caf48999f3879c40f80bd6ee621a8023c40a695afd6
-
Filesize
1.2MB
MD5902c3ec7c7c4a4e3f958d60c3fb910d9
SHA102f21e70601a23bf9bff190a6c7c6e4915496194
SHA25631210cd53f6b78478f08bb038eeeee18f6f407c1fd8c67f7282f04d6a5eb2aca
SHA5128827d6654d31fb38f069bcc74307e1106aa897f9b33ccdbe3b99310a2a005400039efd730154c437c4bfc878a40f593fa0857f6ea744d35587eca9fb07bb6a78
-
Filesize
1.2MB
MD5e64febd2c3c82f9a2ce4e1c82b9b8c9d
SHA18545e1c5f65a698e2ef0ba6036e9cfdd1a375e10
SHA2563ed1e024387d7f437571febbb868cd3902df6896e81570f226d36ff80c62b992
SHA51215db4cafa80d308f0032c549ab8e47a388d2af61c1840038287017c11c269e9754818ba9e97c85ba9deee3c5cd15f0d6541ea2a815cb59e800cbec1a7c60687b
-
Filesize
1.2MB
MD5f3c00637c31d6763a31c11faeaa5de16
SHA1e3b658bd608db1be72f40bcd2eca64e53a368508
SHA2563540c75a9dafa7de965c0d1f4592ff381ce1fbabcd0cf136ef4797b53d6257c2
SHA512097a4632d9770cd270087d9265277f45ec1a8b209336c5122cc1b68b6e88fb07b34cf8af81174cf459aa034b27c29a83771a3b17044f7120c1aca78bfbf606df
-
Filesize
1.2MB
MD507f92bd8e38e16afa5a775ae88da5ec1
SHA1c38d9bc180dacb0fe180796f06190f5f5a1cc126
SHA25609a723d88a34b66ff2beb11d482f20a764aa886e36b50185b4260e7ae633100c
SHA51209b6a9a36025248b09b879c723897edcd4e851343bbe2c36f998f964065e5c91333e7b68e18d3a4fab16ac86899a99ead83a3e3da9e00ab6a2321ecf7ea46de8
-
Filesize
1.2MB
MD554e96dcb89c8619b12d51946460a932a
SHA1c8e87b6d18d998f3deb06379fa62ba71cb83a399
SHA25632f8a08187770ab31f5c1db590b040b46d65867e01753737a29ac622e5d99acf
SHA512b54287a9555abeb38afc08b36663ae29c8bef66437638ca71dfecbab4d997a1734e444c3052b93357e0513108259147f7c79088462efb1791980c23947b76030
-
Filesize
1.2MB
MD525e78f474f865adc63ccfcb0731cc6db
SHA1792953492e1a805884f0212abd80a731bb45a39c
SHA2561a073902a60831a24ce1de1619ce8bbd3e8b0f604d82e8d2be777d2db82a7ef7
SHA512206cfff6dda09c15947d359aae1bb1ff9daec23cff072df93a1b4041d6134bf4e18881615d7e88057b60d39aa6752632885a5cfd8d91af1f1c318ceb5e4a1078
-
Filesize
1.2MB
MD57ee4ff622c28415efef60b8aa6a5b267
SHA1756be375f4caa7c2458855168468fb740324156d
SHA256be8623b9ab819bc1b1158addda39be08c8533ed3695b6bcfc0efabbc9a4499cc
SHA5123945ad97f9c44850d4b2587a6e68952e05f759eed8a263717acbf52ed9b899b0cc26b82dcd1b94e2778b55c90febe6b2136073eaf1ddc3278110e0ce591c9715
-
Filesize
1.2MB
MD534567a3168a393584b4de9ad212b1c76
SHA102724ebb9ace0c886b06e9e7cc48dd09cba75802
SHA2561515e1a006068cb17b1749587e13ffadc19794d3e1bd792c504f7343e2f73956
SHA51238846c6816bf501ebea30125a2b60d817c11435f5322e4dec96ad64e242e5e2ca18b290b76993593289961c3c1f390a2cbf573f911cc7f80ec19a4f2c408d51e
-
Filesize
1.2MB
MD5ec35807b578a7ef821f62fa6defd3487
SHA1da582db05075e0ff47e4ec5f6d4e46f96fcaad37
SHA2565e9bb05d54f91cb78263960b0c63632b111b664a7b86eca68a72496bebf669e9
SHA5123a77ac01ff848c05d7bbed41bb5f46f8f0294a6aceb5cf018b4c785167114b4195f090123effcdbf6d3d3bcf6d9f2bf955833440067553fd7aafd402846b2ed7
-
Filesize
1.2MB
MD5b04b884cefc112f7be860eb887a7e74c
SHA176b59a5618ea3118399af2a1f7fc7e2c5d264aaf
SHA25659ef3deaea17406bf05cda4b9debda66b1a15a0b62dafe99c88776c76674a5a3
SHA5122e30816b0e0905aa989117b77dce95ba0bd1b16299c773a5e6d441a06c329ebe4edb42828a526e2729e752722ea8fa6a71a710a61cea86ce1ddd20da8048ff43
-
Filesize
1.2MB
MD53aadfcc03c6b3a2a52b3fe8a410cd9dd
SHA1d83ad1566fe965b5f5ad5a6d831247d74c04af95
SHA256fe8f2ebdbeef85dc3e1690c916695f355fffa2f985d5d7072ab752e597ea851b
SHA512d2441eb8c2ff5f11b20a0d7aba9a2b28c4b612b087a7e8ac2b032c27e923abcff57918b1a911c60e701d58e67d3b87daf9104f7a20dc5b8dc53f8e261b5d7573
-
Filesize
1.2MB
MD5ff1c930079b90090e0749fb7ec0657da
SHA1d1b61d76f20a9cec7b705ee44c579c13989c0ad0
SHA2568dac22d17e92d43c63e19da704fdf9d1ea1426c323c5e1bfb10b77d4059621b0
SHA512b27d3fbd8f3b49762261d24081d29b4fe2f79c86aee7f7d960977dea295c2896ebb562b2d367642edb56457acf98e7bdf3edd1792caebc49ee9bebf2892b27e8
-
Filesize
1.2MB
MD5fbe8cb63f2329ff0ab93be2b11926a69
SHA148ef47d94eaeeab20ca65e20666f5257a1b888e8
SHA256a8223b38eda6a986e1f93bd989df7dbbeb9275ccd5b903321974f75ca03b08d8
SHA512a605db39bd0bc4897ef29d6f92aeb3a0fbb83a4e3eb72914c9562f2a249ae39027a1a5675d589554fcf10e718528f9eb0143c465f7936571823c0cf1ff4f32e6
-
Filesize
1.3MB
MD5feb75b7618571034a7a92f13e90f769f
SHA127c6e7b940a3f3a9e033ad21222da122dcabd6cf
SHA256e460ffe0dbc7814a8cbc2ed70a20e29c9e3fe86314987ecf91686ebb21a0f158
SHA512dca001d8e774b8cbc4b2a3424ef2a3995c0f839d8918902708f194a0da5cb08401b3623e89b9b954129402bd4ed1e2d309494a1f156a061b75c6e3c05f9c3b7f
-
Filesize
1.3MB
MD5bbade33595f79ad68d0e93be5a933e46
SHA1b6ed7b720e2e14e585fb2fbde4fb10068e74c9c2
SHA25646932c1af0c888931351a19bd683c8dfa109d11f170b7ff5c750e22769f78545
SHA512e478df9367a5dde6a29cd254beabd10138c23daf145ee72f17ed1d3de8daf126e3ef7c1b379f3c52f8e0ae16dc29699a7e2387da1d0591ff00280d74f9750fcf
-
Filesize
1.3MB
MD5331b3c7415ae73b98ec90f4de19048ef
SHA1bdcfc4aee5ff3564762d9c9ac0ba70e4b81534d3
SHA25648bd0979e2935325c814f06eebf590f569f2d2d181488d8966a42826b6abb9c7
SHA5121f832cd2623c159db5a1a171f11d935e686c60f9a3a068aa6f3fa773d62807ef5042eb64a26799decd92b3a09ae2fb4f7aec04187934d4b8554c6643b6de856f
-
Filesize
1.3MB
MD55f6ee62a69d75ed06b9822aa2b0cf551
SHA13aa721f7ec5b0d32b11afb8f77d4dcd48323d3bd
SHA25652c3833ee096894eaa94e4d145b446805b0ced6df94a7b485d3875548ffe22f1
SHA512258a08d108904b88d0017db706d3a8f3f41cde7fec76e1441b7a7082f5223bf393fd71fa1349d8f7f87482fac3d8f3409a469816e7613c52314d092a974d5f60
-
Filesize
1.2MB
MD5248327c8a53dc013d686d1d41279758c
SHA159ad8b6d1e7cd7737e3db838320387550a933887
SHA256e89aadd63a1c4f728303407e47b79b4d9e8daa8f2671084d5b4b037abd8121e1
SHA5128043743a2b1e5f5496ac64275fe0d0f505649b97fb23a5a0e9d81807106b594f8d745b5b46a5aa1e179e1735b0b574adba3efef541025d8be6d71866d81c4a91