Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
07-06-2024 20:27
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-07_af04cff01eb6471ae09b0c67b51ec56e_ryuk.exe
Resource
win7-20240221-en
General
-
Target
2024-06-07_af04cff01eb6471ae09b0c67b51ec56e_ryuk.exe
-
Size
2.2MB
-
MD5
af04cff01eb6471ae09b0c67b51ec56e
-
SHA1
bedd0714c0f61b63c9456ec2366d52c61514c977
-
SHA256
df92fbfe72407a93388373fa73123befd29e1fc29ecb5fcc929f5107875fd43c
-
SHA512
12448d2dd55863d802696a48d8811fb60745d410c082c23a5dac76f3a2cf803d52202222c22a8b346a7fb80de67c55e05a7b34c201c7c6b3f696072e62fb405f
-
SSDEEP
24576:BOObVw4TaN1wdFukCba4oXtgLhU3wEdmh589RSkr2dw0tbBFWWCKPlpp1IOn:BOOh3aN4FuLbegmtGEl50VB2KPDnIOn
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 712 alg.exe 2028 DiagnosticsHub.StandardCollector.Service.exe 1764 elevation_service.exe 1708 elevation_service.exe 3856 maintenanceservice.exe 1852 OSE.EXE 3108 fxssvc.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\system32\AppVClient.exe 2024-06-07_af04cff01eb6471ae09b0c67b51ec56e_ryuk.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\25153006b3e2edcd.bin alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-06-07_af04cff01eb6471ae09b0c67b51ec56e_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-06-07_af04cff01eb6471ae09b0c67b51ec56e_ryuk.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-06-07_af04cff01eb6471ae09b0c67b51ec56e_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-06-07_af04cff01eb6471ae09b0c67b51ec56e_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe alg.exe File opened for modification C:\Program Files\dotnet\dotnet.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{1342F81A-D5C5-42B4-A5E8-933F7759DA30}\chrome_installer.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{1342F81A-D5C5-42B4-A5E8-933F7759DA30}\chrome_installer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_156609\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log maintenanceservice.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe alg.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 2028 DiagnosticsHub.StandardCollector.Service.exe 2028 DiagnosticsHub.StandardCollector.Service.exe 2028 DiagnosticsHub.StandardCollector.Service.exe 2028 DiagnosticsHub.StandardCollector.Service.exe 2028 DiagnosticsHub.StandardCollector.Service.exe 2028 DiagnosticsHub.StandardCollector.Service.exe 2028 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 660 Process not Found 660 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 656 2024-06-07_af04cff01eb6471ae09b0c67b51ec56e_ryuk.exe Token: SeDebugPrivilege 712 alg.exe Token: SeDebugPrivilege 712 alg.exe Token: SeDebugPrivilege 712 alg.exe Token: SeAuditPrivilege 3108 fxssvc.exe Token: SeDebugPrivilege 2028 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-07_af04cff01eb6471ae09b0c67b51ec56e_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-07_af04cff01eb6471ae09b0c67b51ec56e_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:656
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:712
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2028
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1764
-
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1708
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3856
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:1852
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2232 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:81⤵PID:416
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:3792
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3108
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD578bea8d1f73dcbd1fc232825c16d75c0
SHA1ede11ec1444afb9608a137a71b7ca0c227ed422e
SHA2562557d2147eb260faefbc7ddfb7191d9d9fe902692334acb7fdd32cb2d8d42a2d
SHA512d036a7b84616455c3697d0e40e9da13c5d51abcce427d7bc76935a1745cd55b169a701285ffc1d0863cb008068e79c92533abf513b455fedadba450b75515db3
-
Filesize
1.4MB
MD5b4d261542712680ba828ed6a3dcb72a4
SHA1ada2726d1ec10e6adaa4c96b083429ff0e06744f
SHA256786c85084e8b8bbf3e5a65b37f6d3d60cd2b548cc990b8f4bc411eadb1d16d8e
SHA5121bd1a68774ba0a5f98d8c390d93f3fc71b46e7ec281c0189c924f2c9c66de19f0b973b02e6dc1c69a8620ddd1d612e57e7f8bb69c480e97cefd3c6e1bdaf0615
-
Filesize
1.7MB
MD5700cc5db4171fa9ce442952986ad41b9
SHA18e99e62e35383068e23756e13296ac5ca5f20b51
SHA2560946406eabc88e194e033b10558c34779c49997e592afdb6a32fc8d55a697641
SHA512101ff4bb64e224b2f09185ecf53b480bd8d8d59c690f159e89583e7c4c00934739cb0af312b75a2eab047e179e7f1d369cb662dddf01da81e9986bff40377ac9
-
Filesize
1.5MB
MD5ce78acef1e7dc908247ae42fd3228503
SHA1f321cc9b5e48f5599c9f00400a9e9558a6f57160
SHA256fbd13a8880372feb231763c70e16d769b807ac8615e9f5934f263372f8eb37a2
SHA512506212d76b5069b24bfa344c8b8f09616bb8bdadab136d261768c2901fea77b5096ef1705d867eab836fbf6b5f32aeb78a47a65b8dc34b7fabb45abe45cd24b4
-
Filesize
1.2MB
MD50793f63451718b8f1e4b3308caecc808
SHA16b8283c267621fa012e08e84b17e5e8aea40c3cd
SHA2560b0e6e9879d6c50a0b78953f8a3b3e35397e3df7332066d853ed40c806972f5a
SHA512f8381b99cf47c0428dc238057077c0d23e0f143d634176becfc350d446b45507fd84eecf50308ba55b8c0a72364493d15c64f5c1e18b6881a1241ca21cd0cd3d
-
Filesize
1.2MB
MD5cbfa4898daaa0e44486e9dcae07b24fd
SHA1214dbe8f30d067299789d94665eb897f101b0ffb
SHA25670287a8cb31ad7f9e73a127e38405a52f4b152ab8a702543b3bb89fb8b496421
SHA51259dd07e87a802581ecff4687cd4b9416f769eea1ff50999823f688608b5bda9aa0720523b14dc34ff9419e3e6d37915f33cbb1e6fb638e429e95e4037aa65c8b
-
Filesize
1.4MB
MD5e9325457040f98efdfd5d5e0d40d5ed4
SHA1302836fad55c41b164c1c437b731210383e4eca2
SHA2560ca72f280da07bc875b8da64be9b1721d1a3c948ca84bb0454ad645b6011762c
SHA5122d7ad66d8aef52d901ec9b5725c692f30a7d9b0c153c7cbd2d1ee8e07a0507ca9e3df9ba411cccc8bc0ae20a701060ead94da10ab58a873a22914742a4ebbdf2
-
Filesize
4.6MB
MD5cc4ee79d28ac3cc5977f1743c688b56c
SHA19d13b5bcab788d8ad250300db5c4446a6026afa0
SHA256bd8d4ae5ed0f93a8334a6ee40a8cb310742b63d300f26a180eab09feca0761da
SHA512eef1a5e3d9e7495bfc7fc679f49bc3d669f3a889120bf2c492a0dd7a3bcd99f10ccc863e5352c31f2209bbd03421b958bb11c6725b05eb51ca342efe3d1dc85d
-
Filesize
1.5MB
MD5cb6baaa4a1d653c36d250ed2e7535f50
SHA130e57c680228f076fe439b4b5f29c234346b09fb
SHA2561128ea333b1d4c441c222dbd25153646c2e09bc71e22b8aa573ea77d0022a896
SHA51202503c92eaf2c2d2ab5ebed8f64de30d778c1c800da930071bc6de4e7bf6e504cc7e898f10061875418dc17b8e8ea86d39645606ce6050fb63529f7908a4432a
-
Filesize
24.0MB
MD56c6f483ae2fabb76266c87a1ff4a3fa9
SHA1f252a64ec5a058c1da5e5ec7077b0e5874a0f8c0
SHA256a9b459b563f3c3aa157db367893441153337179389befb366ca5ed362f2712d3
SHA5127445c2e1c69a134424762ee1538ae7fdd978e29ef520e58480234e6cf5a9411cde239a0e6220e94798cb06c1ae6f351dbf0071259689b96dee48a94b2c59a8bc
-
Filesize
2.7MB
MD539cee19b4d215bf6447ea51505e30547
SHA1442584a5236c838b018f49724336f10e0989c897
SHA2569e37bc8748215fdb955ef67b5924363af49571532cddb4859fcc22cfea95e782
SHA5124c480478e0cf9922d43eb15dc94153705af7ac700d7f73be16ff7f5a15cbeb0e45c4ef5f9c413e9ffaf6d2d1c32b32048c620726513e48cf82894df298735cd1
-
Filesize
1.1MB
MD526c4db6203a099d61c4789b950a7c509
SHA1e490b36ecfa37560e3ff7f1431584c4f151be29f
SHA2563ddd90642bb58224abaa3f0264f91d4a9252982e9c7277bb4831351c1e194b99
SHA5124d54ad98b5526d328fb986e8e7fec8f36852350d2b52834651bb1f68a288dccce0e276ddc6632010aded59bce0ef57530957ea2cff48d17b2b035bf55ee83ba5
-
Filesize
1.4MB
MD51eb81dfc6d843627234c7b54fa22d5a4
SHA151f91be40c3ae728fd1e37fad4e44832d372dcb4
SHA256b15e10aad86717a8c6b6801e2f066d2b576d8d1852045f3c397402bf2d9dd455
SHA512a1ab0ce8dd47f4d13d4843fe74d585eb9f1fc0474106863e81cb67562f2f8db67e53e02c6843f31c9ff2b57e6181d4ddf84614a5797c9e68c2c65097e6032b11
-
Filesize
1.3MB
MD51c07e926b64ef7ece741f5a6b970a48a
SHA19c1ef7ffdad58ee8cb4fd5bd0548c8193bba2eb7
SHA25606e1211f0598fd79e45bf53ec5d674b26209e37908b81e22488117eba1796f4a
SHA512072559b9541b43ddaff8359d0fcac410edc555596ca0672e20d87082ac3126639232e82fabd83e2319ce7c85dcf172fd8f893e3313e7e4dd009bfdcbc0d40701
-
Filesize
4.8MB
MD54c554683d0d2cd167d14f7ab9b11c319
SHA1ced36ab7c72731324495f8266465ae2db4af9628
SHA256d615fc7c7d03330d7ebfbba0f8e6121498aca253e977004f90861a1563a6249d
SHA5123528e1ce6aeed894a112e66f3d805f910004e71e76bf5957f89ccdf0d6fdc55ede8fc7608e6d9de62fc751cb8cfb9083b54989e000d6ae09851196ce09ce10f3
-
Filesize
4.8MB
MD524120fb6fdfc177022169fed7b39bf63
SHA1e44e011bd08d56ccb4c18961bee40194aae9273a
SHA2561e698f9a0017b1f82c0d036be0a921e5758a1c8e1d04519147a25b209566d8e1
SHA512ca496a023f433f3f469d90cc898a17cb84784ac45a46e0007e60b0cdb1875a374613f1eb90047c9373df4003e315f044530f1bb20b312d23946ee6d615ead0ee
-
Filesize
2.2MB
MD505f64ae7680c8f92b6151b045ba672a4
SHA1a4a7731f287fda2f6b593cc48c322106cdf6f3af
SHA25646ad01fb4cd17f39e847cda085c70dde2bc756e61ef78db63bdce559fb9a3ac7
SHA5126d88c80692181b12a1b50d2f3c2b8b4df948451b6b9be19075389e421f5290792b7ccb9c19a49b64d743e0d7fe569bf1d3b45c4254424eeefcdb329582a2fa2e
-
Filesize
2.1MB
MD507c15254b3b068c080da4d6a57bb733c
SHA1d833d03f062c7248199f4755bcac362807e89684
SHA256e53f1b4ca4950bad73d8caa21232addf4c405b33f8b4bf6f6dd23ebf754ed0fe
SHA5125cbd5646406ed8d8f135ee596cac0d85fb0982241325666c935fc730023c28222ec11fe058592f481efc1a284289d66a05f7adf9e446bed344797bdcf1c93490
-
Filesize
1.8MB
MD5ade58c83ba5b969c75b44a5b06c6c07f
SHA12e8911c19490798bad5b4de44ae50228506f71b4
SHA256b67d2b54ae4f8eac5df4968c7d481afbc60b6719f78e429acbed6e9b11c38e36
SHA51241c945b20542483f4d2e0e4a89d47d9ad126534d7fe8f2b26a3a3eb388cf48e6dab0b280010a2556cfeba1b4874785f172a39f8f45ba7760c4cc270fc62e30fb
-
Filesize
1.5MB
MD598cfc3461a176ad7d6f4092e30354c8d
SHA12396293605e321a73b21732f2c352414714b0da6
SHA2561e9c97eb63da4d4c33140dd3813fe29db45dcf92e78fdcc653a855782dae448b
SHA5120859402e1d274b9fb1b8369acee5eb6313b4bbf45cab7b88fce9a772089e0d5d26605f215eb3998e672e836c217390b4b99d8feb3d4833011a715c8b2b54979b
-
Filesize
1.2MB
MD56a2bcd7e01c8ec150feb9f23502aed70
SHA181dcd7834b43089b7b1271a50b94ed2486b59972
SHA256a5f52b1519c7690d4a5a8d09d2f6a60a3f0857ad0f2172db75106679788b8544
SHA512f619aafc6b3740c0288dcc7ac96482310c0fa4655c1d84a6edc0bc1291e8a724f97793059cf3529bda8214bb639fe90b2b8c64f99d4b7f4ec573c9f5262ab62e
-
Filesize
1.2MB
MD5a09c9e6968f543a5426baba9a48d5c2a
SHA11d359a3863f51d473e2d94452f6120fbd19a9afd
SHA256aa0c27e35276d1ffbadfee469209117bef4e43bcdde6fdfad6600cfd01259711
SHA51289db34ed8f79ad2e691a790b9c0356205f3834802e9ca5d64ee8b943a0fbe3fc1622fdd0d286d6e8995ede3619039b6bf4af42f4225fef3e93c3e4fefda329c3
-
Filesize
1.2MB
MD51f497cb3dfee3a2b2e002ef719b9ba08
SHA12439aaf86d5d91ce21292e64e49bc80735b4854b
SHA25638cd0d08fc22286272ad0e9c22d9d94743052c12eabc41c2597a94a0e641bb66
SHA512bab4c7c49de085ed2f301147792461e21a3f54a87020070c6fb6dd11edded2c8d91f4f721446f47ac29d7d19808d78cd4c887527a8a6b5bc455f8d6e12bae9c9
-
Filesize
1.2MB
MD59c8dabd8786ace509cd44992ccb00182
SHA1d29f62ffa0316206ad8f242f27e46eb6b5af1142
SHA2568ed50e4acb151a0c23a8d561c95c63ee57cf17715b3a6075e142e0d233e4fb91
SHA5124b4c6622cad8d147e23c2be3a4c85e452cb51716cba15ac5147140a059bd09c2b14f8aac3b2f4ec65ca7624b02e60e2819f710ff02098da7d96c39f083017c69
-
Filesize
1.2MB
MD5b50874c556f996bb4c6680235c2ba29e
SHA13f696f65bcc43ec23d82e21821fd85a4f3422c11
SHA25694410ce3de2b0ed2c6d5f76f86973a52a5c05241952ed319df055eb203855dac
SHA51223d371162f34f5a72dc42aca41e2eb63f8b7c1aab3ac066ce944f64bcbbc9d4c71db910af668d7d8e9c9203e4c7d47340b12446d9b51e22bc55c26235fed4591
-
Filesize
1.2MB
MD57063dce43317ab9c8b7054ecd4846d97
SHA1b0ce7070c9c050a3942be417a7753d67a6992fff
SHA256f5275cbd957044e329cb923e5fe8b3b22e93bc19a2296b6a83f1905485462b8d
SHA5122c1beeb33e99e303625408e7f6f2cc28ec3fa840c88f1acfb11f038f01fafa1d3cb48461e178a9864b064bd0cd19b39371a3f11c57b684a8f8a6f1454d6ca0fc
-
Filesize
1.2MB
MD5f8c4387abda4628a1704b558b9138973
SHA191f1c6de97c4dcf2f3b050acbf993107a663d74d
SHA256b9c4dd4eac75720794959f9979456bbb753462bf6c400dfad1616603e627b626
SHA51266dbfd608bd41b889eabd7758bfb987137846062e855ddc11778eb7ea61f2b1f6af21861ed488a9e689f8b9ede0f97894b31804f39e0a058b32c2fefe052dbe4
-
Filesize
1.4MB
MD5a663f2a9bbe77768ddc71d6ba5f685a8
SHA13dc897b1dd99bd1f36c5902f43d39a705b67a0c4
SHA2566d1b0cf1f929de7cf565a99dd4b6fc63ba8c1cd3b781c8cf49f634e5ce010763
SHA512543af33009c775eff3d1d64dc3036b3e4363a56538fe67ecffb8bb2eec69e9b66f2d6d7d7fa4c4944aa2f63f86c5325ab9d01a19bb2746f043344d5574c4952b
-
Filesize
1.2MB
MD5ff08475be650ff403db45e2c4e6a102a
SHA15858af520bf40053b387e091a81f6c6555951cda
SHA25602002bee54c6a7ce889f06af3c4144bcbb64407fa5c44f6f86667273ac4213c6
SHA51250575b9f5d556f9cac144d6a567f69e83e450d8512093acf78f610d743e550e8a8414294fbf88b7c03e356a532d6894c9418f36386ed04b638edc0448e061c2b
-
Filesize
1.2MB
MD5c859bdc8e720dba2f461a3ced38ee2ad
SHA17d7ef80133c286a180483d598b4cbaf756e72bd0
SHA256e580ff4b9229a5d728ef5e48c446fc426822e98151d9eccbdde271aebf6ba816
SHA512bfd403958027d7c7c55da80ee8b12f7f46a9013de45f4d4a6f49fa519ba67d49d705ae938cdbe2df74d7fa804a2ddd01a7ea1424fdc684c580ff1064c6305774
-
Filesize
1.3MB
MD514d7ad20dc3ef0b5bc7380148f6058a7
SHA10bd504c7759dd45bf738b213df45c45c7e3514f0
SHA2562e83378cdaedb99e21267f5e693157b337d8798912c451b66ff0f20b6fbe6730
SHA51255a30cd3e98cdecf13f6203b627a9153f55c6fe73771c5559d253b424628e07d993f89177a6a61250e6b40a6644cafa93888ca72e5aff043aa8dda38ade8a7f0
-
Filesize
1.2MB
MD5a5c9350288e926d1652eeee27bade76e
SHA170e11bccc65979ea15054fa97b4e2752e60d175a
SHA256984ea47c5a19ad1b73cc31ca55def5f23230953187f16ca4b3b0034c6a041979
SHA51201d4ede470e64088ca11a0e03e1ecb52d2aa654a8cd604ccbf9a94d6092a9db5b2c77d2c1cc0d0c11c953d5ada6e9d5b17cf8422c8924aa70c64af5b14600bbf
-
Filesize
1.2MB
MD59374b440b901e06d95ddbfde6ffecf6b
SHA1c41215c0cda1a80d5e684473d20c3a6bd146dfe3
SHA256295727ff7b1c1c8711cfbf1c0a28637b66ae62772139b190bdc0f3f45480b10d
SHA512f6e55b7c19ce1bfe9925a51a4aed2cc09ab261c32eac5647c328c44d7f40ee48cc2839ad68d086fb43c3feb8e20d5dfcffc9b1745f2697e477398c08d4274253
-
Filesize
1.3MB
MD54c97707ba23cc55135a2524502fe977f
SHA1c10fb08c75ae1039928b75523c40c6c8e21873e9
SHA256ffdc2bbe925e6c0193f144dd7ad0bf4acaffb03565e0e6039b4389e967918c74
SHA5122e5850f2cafd3fee45a0f52af2ad5a847caf4bd1e82cc1eb2e8111a0dc9651a13e65f27809d2671f92cb9165bc9c98770e5508ab20e7de196dd8c8f42ab2181a
-
Filesize
1.4MB
MD5ab6ae2346531b1be09f6ccc9a18ee805
SHA15c9b29e69428b5986f7eb3b52e4eb9c417a107b1
SHA256b38c106f087a718888d45417501847dcb6b0b0c456f8ab01079b62008af4041d
SHA512f8fba6c0c415c4e8a1c06bb016b70d9602cf0c59ad0d1a00f541cad48f2651bfb9ec5cd53ab63a25cedff183abd6a3dbe8d9c23944b70c295952a1cba7da4a97
-
Filesize
1.6MB
MD587a5f7005dbaa88a92342e65a1c47e2a
SHA1884587495af80b328b2aa5236c4b1b8e6bbdec23
SHA2568c05d3dff53ad7f9b3b1d654af509fce2129b8cb286d5b974db6d74e983307cd
SHA512678ab410682ed8c6c703d2c6901a468a54603a84abe8530f0e394f07354f2a5cd9d67efd9ba33d302e15ee5c5a9a55ab25c1bc66e9df79b786ebc6209cfecc11
-
Filesize
1.2MB
MD5f97f4d8b7c0b07e3843139d5ab880493
SHA131ffb6451fb27bfacee27b5e1573218ac36bb89c
SHA256d69e5ce26448ba3c120e8b68de881a6c9d1fae370e1c7a6b3ab3dd984094fff9
SHA512ad6e1c90df9c56ec243d25adb1e233a242907e151d1b218e83a5a0f0cc7c632207be4c3c0f579402d7960f7460d6f08fdd812f5ace2f087a9902dde0702e9890
-
Filesize
1.2MB
MD53e1f83bceb1e7362a57cccbf58995f2a
SHA15b765d88d6b015072f0cc759f1a03e76e6d5e803
SHA25619622a4a12eec1120cab510fa6d7f4870f94641c47cb00190cfb0857ce4e909e
SHA512d475d02f45fc3fdccca7c77768e05821b9cfc265dd0e04fb6106e9f7535fa67ba31c31734f1d5197d0a0da964b829ea646d058e89d5fdec4e6c59c90d7fb0b6b
-
Filesize
1.2MB
MD52e2a7d993e758779bc91d53be9f1fd33
SHA1c3ad78c9a4f12147c72dc3bcd308d4777e9015f8
SHA256408206194568395db59a337ddbaca5d21c7764227f349be9086735b2103c3616
SHA5121f0ebbe003d3fb4aee4c707d413872b105da0b432dbcc59a1454712731d1d6be3548f78645b91464b1e902c8691ac32ee6ddf3e242810a8ec6754e23119584fa
-
Filesize
1.2MB
MD50e9329e9f5ac6a5abcc5e49b9b42c499
SHA14fbe4d01489427708c37d9d3ce2c4c3d71cf6b2c
SHA256d239334da9a286a1676c3d7cfcb707db8ee83965ae97260ecf02ac2eeb6fdeb9
SHA51272e417b4aeb448e680f15b7405892c86de73e088a19388e0a8a0f8de68913e45332e76dc0755b250113be988af3ec0af1bf41c6d6c2a5ecaa00eeb4e5e08c0c8
-
Filesize
1.2MB
MD5dd818f8b6ee12e5fd12819c98307f56e
SHA177f9e1c439fbc5e5c9e9174f7e06a5e6ac305f8c
SHA256a5294de644b981e116523aeeac0746648706c367ea5640d8c9842bf61b3a29fb
SHA512ad6e9fd7c27f0521a71aeffd004d464bdee259103c6dac55586a48f85aabb3d440a3d889956d7caa197b090cc93ff7863b5e3793a51e92209aaafd874667b641
-
Filesize
1.2MB
MD50d3fab0177dc888bcea5df2ac5c12a48
SHA1a15ea468e3b31a0d122b7d36847e7757632078cf
SHA256e663899d8c45ea5411a1b9e0c9f5e4df0638624a447e509bbb70f220367d388e
SHA51290ab4d891c535984aff552bbc8fba237459895c6adeb9828a4c283e5c422772bfc4a093b44ce855277bdbee6cc193c92235b2ce77d8d6a30069bc343e9a7819d
-
Filesize
1.2MB
MD50a81969a96c6b9ec2d3efbc40c3f1689
SHA1a6249acdb7cf78cf0dc3a88abfcf3e30658ca928
SHA256a34d0c721382d88c73a09dfc751c118f470feab382a86cbdd5e75d6904fb82c5
SHA512391ce085425d0d850c0dc7df9be9d23206ee2c87d6e2b8dc4222cc27716be886ef8674df952953e43f7772c670091e284ce6861e1f1866fb863751fdde93ff3f
-
Filesize
1.2MB
MD56c505c2eb661f172707143925dfbfcf5
SHA19bd8bbef6156f65b05697e00836bc623d0f82c23
SHA2561475eee65241e9fe7cb8ab1f90af6b79c1f766e130ff3587fc6a6ac985e5179c
SHA5123d8c3be516c7ce58a7578db3472da318f8822d820b5cf11c5c7a2bca83de25462c5f7b3f06b68093cd9888ce870cbe0da990a1c2c00486ba3549f52f65542acf
-
Filesize
1.2MB
MD56f61b060eb224281c0ab94d748816a97
SHA11f6d250bc7ff500e4ef80c67c668f3e6e0582fa7
SHA2569994d8cb0d50f9f9e259fa2bea04b8b83202d0e01a4be26e84930d5bdb66081c
SHA512dedb0f78fccd29360b5a67528c54de87be89e08338f192fcd9919286069dbb872b8cf0e761f94f71460fb78224065429ef2ece116ad687cda180783412b0a6b4
-
Filesize
1.2MB
MD55a9d60d62ef3653cd0bd76d8a1a634e8
SHA13498ee51d06f7696a9df678e1e3d85db581f3192
SHA256128b02a3b672f00b508d1b3ec9b36b124475ee98e7d44239b89436edc82236e4
SHA5129044a5bc325e43241a16cc3cdc74533a9197843563ce1a82c51b59fe2c0787e201e417c32e66d46ec3dd8e523847ff5e0e54d3f770b7cab1fc35babedf241d7b
-
Filesize
1.2MB
MD517fde72778357dd2d540f754a27c0351
SHA1ab4bfb6d64b5d3b787b64412951b011d1dbab7c1
SHA256acf9251c44f7c516182e31b8d1101978872cfd1c671c30bc90cb80f0705197bc
SHA5122ca4f2d4f9159308accb0b84f91c86263eaee1c1ab2661e968fe11ec523bb227ceda202930b25d8598a754e5bcc8dc429068e5ed66a134df064ee4d1f02aa3d9
-
Filesize
1.2MB
MD5cf03e2d38b59fe64552326708fe8c799
SHA12ef9e4ec0e24ea2ccb7d87fc756932bb111c6ef8
SHA256298edcee0c9122a12ce835c1928a4b9497b5825c80a153cfe9a24741de484b8c
SHA51253aa6ad4437c04c0b6baa0ed523c65b91765de4d999610b08ef2b139c56415df874a9d7879501cc727c8e90c92306c6aecf6d3995dd3a7e247b2c6171bd0783d
-
Filesize
1.2MB
MD5cc97b61ddd24b5e7235aca927831f0a8
SHA19990e32fb63496a1c7105d3fdfb3edadaf3a92b0
SHA256e5e8275b28fda3b9aadfd0fc74cda41c193eacd2d6c603c72ac28f2db6c384f7
SHA5126cfa2d5dc7611a5f263c3bf5e7ec68f1d840a9bb0216f79cd2b9dd4bb7cace3e69991847eab6f16a498fa389dbb2822705b36f98b61f487df312b2d491429879
-
Filesize
1.2MB
MD54a9f971f43c4386cff7b8f98d1fd0f3d
SHA10f6abbbc6395f4c7462293fcd673f43bbc9a7bef
SHA2560d79e30882b0d181564dda2e0e173412d20bcd30a2cf8f8037d340667a5d62e3
SHA51283c3b1f3b188994cd78d5709c6fed3e4a8df2b276d579a9c52da19547e3f844f0a66552584b6f4137b8ed2cc0e99e6a67b26fcc4424bd0b4def24b2be930c8a9
-
Filesize
1.2MB
MD5fe599771bc358d2b44abc6455b5c09ef
SHA1fa73b4b88991aa41f220684d39e8eab2c2f3305b
SHA25625cdc548f410347f5640a31aa52fbf34fde86c883cc945f2f154fd8fd23d9b9d
SHA51213cb73f1a5ec5802b34f1284957187f2a5e0641c9a889b45c785e2c7988843e75f06fb35b2d9bc9f3288095c8d5422007c6976376b469410ca19f87d6fac9c66
-
Filesize
1.2MB
MD57ee9ec84e72ac2a57ef7ee1d43063125
SHA10133231f389f7bcfef8482f44d885883c1a7ba9c
SHA256899f2a2069f3381833a2490474700dfb39c6d0a9d0051dfab4220b4a3aaebbf8
SHA51230628e1a29f97be447d08943d740e2a598914cfa8f957b05178ccf58b6279164c2edbd01c8ea2e35417f2645178058587f47b018ac77657fad28e640e2159950
-
Filesize
1.2MB
MD56d0a0d5f4d1da10851ec10f7984c20f5
SHA1d15ec9dd357f257a73a9af3232457034378b6b74
SHA2560782bc4b1f29b2f01b6874b7e02865439a20863a057dbd002cf89ddb8844acfe
SHA512c922cf476641c1652638cd394146e5883ab07825d965141903440acaa0474410081745ce9897f7c67aaf79e3c59742bf47000f4e5bf58898c96a0df7c14fbf7d
-
Filesize
1.2MB
MD5dffb73e427090061aaa5da7445234473
SHA1b794e10efc671d6eb56911cb89847743dfed143f
SHA256a521d638cdc057a4ff34300790598a4bf182c44411c8922f1f68cdb6b52c97e0
SHA51229ceaa68cb724d1e6d02e6a8db23dcfd6756dd649dd227b5798466255dfc634aa1ede0678627423e13c2193b4a75b45dc6657c1e71f6e57425cf48ab6455f9f9
-
Filesize
1.2MB
MD52dd2cc2827fab752f06fd52978af4e7b
SHA18579a8a171294a24940851411f92dd5dcef9d734
SHA256637bdc623949ce90408a3565e90c47c0030751c658b448e36c5c37cd42eac02c
SHA512c5f21ce44198e76995fb46c7a5ded7c5736c33ed19c8e5ae12a03682908bc9e4c1f83eb6a85bd3e6ce513b9742a60f280a4a17110408fe5cf1c6d5cf3da2c64b
-
Filesize
1.2MB
MD57852240ecc634836e47881eb3db2d54d
SHA105e26d08867635ad98dc46bc45ee9fddd113c203
SHA256b84c265ba9891429da299620cf7e975b0f622b09263c2d378783241be80d9d3c
SHA5126a7eebd7313b784e2cbefb31fa215cd4e71944a8b06e6d0a11ebbe21de828a07bfe7e6c772fb59a7fae65a85585ea7960891a8c0333d3b44da3881908a6a0860
-
Filesize
1.2MB
MD59b7de0d37479a057d413e76300e1cee2
SHA1c57a8044e3cbe3940cfd6720ddf32e4691082c2b
SHA2567066e38795490f18d239809358cdb837b53c4ecb48951c35d5995183e05a30cc
SHA5126d54518856d5a6766649d11dba16edbf9fcd09b0060792778ba5843264a883d6fac9395bf815d76beeb0068b70ba605f18656ba1c7d4d0f175062e97c0700eeb
-
Filesize
1.3MB
MD59104967529440c4f21fca6f21a5ec94b
SHA1556ed304376346ab351d3e4a6eec0284164f1bdb
SHA256aec936498b6a75b9a99d336001330853a61c5da7b337a9bc6e2a9f6c3c17c560
SHA512537660f5c23d2cd45c04aba55e5e8b68e562abe3881611639a9ad0eee47a3e0eca0c262fb93738382cae49e4f435dca8d77c76f992e9fecda9f1560fac60744f
-
Filesize
1.3MB
MD578d3d1fbd474ae409f3bc5b06d9a4d6b
SHA1596f7c53b5509e3f7f30f684a3aa725645b5f64e
SHA256353e4a543d070b1779801b3120a4839302c4083a1794d25e9fe281baa14e7069
SHA512858dd837e1c3793de1d7f209e5dba7999f5a8480b823558c49b5087db1d42230ab994a68a92e31e94642d458b0d78e5539d3797db5e8dab8db4320e7c17d6e20
-
Filesize
1.2MB
MD5d14c898cc071a369153163ab07d024f7
SHA18afefd57e0799f96ffd2d48c75f06be4dde6c416
SHA2568cffd282f84b8ef79c2fff5140fabd6b34c507e815e946a99bf8a11316cfa2df
SHA51206855b3b745138ac31598dd47e5c8c9a304ba6835fc05ba37d24af3427bb9d9f43b1c8a72bcd24d9f4a8547d1aa6a6dec8c281c98df3d5e6067b517769a32335
-
Filesize
1.3MB
MD508aef1eb626bf51783b5b9013be06647
SHA1d3389d085e75d3fd3736a5e1cf7310b45dc0f5de
SHA25615f607f149a07d004c02d6986a59800a7af4f9fab4ce08ef90b2f0925fe782e2
SHA512216278ab540b8bf43fce5d0b6476cef5fc1b13920aa8588a76b2a206bcb9728d7def44adb991c868d5951cc513f1a7cdcc0ccfc9b7272b82e9cb3609d121d95a
-
Filesize
1.3MB
MD5554b3e5d83a123acbaefdd3d00a90b8f
SHA1b119b27da2a33721ad48889b0fc2ef192a54fb5f
SHA256c7a58d8f7a1ca81d67319eaa2eb30a094eb9b406c9a3763be40020bb654036eb
SHA5128892e92befd9d89a551209d8919a367ea35abfef697db34f0a945ec9b43a85e9f37b83ac605f72f50fab523075cb36a09854374a4324b4f5cb17cd9bc551889c
-
Filesize
5.6MB
MD5a02f48c179142413f624759cca6af3c9
SHA1d0353cdb49a00ae5c46b33efa0f73b8e54d0bfcc
SHA25602732faa14c4a9fe570325d1e14d86d7351b36d7b6abf652fcbaf065cc108f51
SHA5124a9d71f68ed1dd662dd8d815db0306e5f8daafb6aa5c0ffc7712e1cf1a2e183db07bd2a650443ad12b1c5ae26e2ce852a570282c539fdb30b65d6cfd2dc969a0