Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
08-06-2024 03:28
Static task
static1
General
-
Target
2024-06-08_2201dd6259af45f32742d885d5e2a965_ryuk.exe
-
Size
1.9MB
-
MD5
2201dd6259af45f32742d885d5e2a965
-
SHA1
1bcaf90849dff43d836ead7de8e28870470e2c9f
-
SHA256
5b7de261a2057ef50d14d4d12a51038846b8c86161e5db4e42557f9be58c6f72
-
SHA512
bba2173e1fcd421907e2812de0fb2cec33483a6029987ab74868915e8d119d8398c192fa8709b9a24f4a526a15aca5783bc9a5ac53a9825e94b045efbb9f7583
-
SSDEEP
24576:Z78r8FfC3332nUnCdAaKu++nOpZGXkHu7gi05yu5:Z/fQ337CGaPyZe2u7gisV5
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 1260 alg.exe 3936 DiagnosticsHub.StandardCollector.Service.exe 2820 fxssvc.exe 5068 elevation_service.exe 3856 elevation_service.exe 1068 maintenanceservice.exe 4776 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 11 IoCs
description ioc Process File opened for modification C:\Windows\System32\alg.exe 2024-06-08_2201dd6259af45f32742d885d5e2a965_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-06-08_2201dd6259af45f32742d885d5e2a965_ryuk.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-06-08_2201dd6259af45f32742d885d5e2a965_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-06-08_2201dd6259af45f32742d885d5e2a965_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-06-08_2201dd6259af45f32742d885d5e2a965_ryuk.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\fbb2fcdeb4b1389a.bin alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE alg.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_99718\javaws.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{28C8484C-303E-4CB2-A704-E3FF47E10F7C}\chrome_installer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_99718\java.exe DiagnosticsHub.StandardCollector.Service.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3936 DiagnosticsHub.StandardCollector.Service.exe 3936 DiagnosticsHub.StandardCollector.Service.exe 3936 DiagnosticsHub.StandardCollector.Service.exe 3936 DiagnosticsHub.StandardCollector.Service.exe 3936 DiagnosticsHub.StandardCollector.Service.exe 3936 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 668 Process not Found 668 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4288 2024-06-08_2201dd6259af45f32742d885d5e2a965_ryuk.exe Token: SeAuditPrivilege 2820 fxssvc.exe Token: SeDebugPrivilege 1260 alg.exe Token: SeDebugPrivilege 1260 alg.exe Token: SeDebugPrivilege 1260 alg.exe Token: SeDebugPrivilege 3936 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-08_2201dd6259af45f32742d885d5e2a965_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-08_2201dd6259af45f32742d885d5e2a965_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4288
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1260
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3936
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:3528
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2820
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:5068
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3856
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:1068
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4776
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5dc6a7cfa4262aa4b16d01f76480e32dc
SHA19d8d97faaf82f4dd03fc6962f40a4c3cf3f6c70e
SHA2568d69f70f54fda59bac2a9110c9d98ca39ef704091f8e3d3b601f01c8e92fce59
SHA512cb7f1e9cd26211d4f43680a4214124cdc66e87eb25e7d4e35a9ff841da5bb842a81aa291e1c24ca423edc1a74a35261f565ed85f44f9909d62181b88a17fde21
-
Filesize
1.7MB
MD555af22aaef1a0189ddc5806b0b70b096
SHA102de0944d3a62d5f554b5484516b7114cc13bdbf
SHA25682b71a7d562acb65053ede5f3dd23ba6d63211979f2c5acb44a6e0e637172ff8
SHA51218b1ab4ef790eb4f380dbb4214da91e6823170988ddd89b388eee3179bc97820f94603a1e114c4ba363be745fc45fc53d5a4b80175fba66d6de7d0a77db957c9
-
Filesize
2.0MB
MD5de7d50a92756ab65e4b5adcf77eb61e1
SHA164bd80e2ad304a185ec287539422c9c8f31347c1
SHA25661b6e75ab6dcb3ec4eb9788ffed926ff08619378142069aded3b247ccdc7dce4
SHA512e3336bf45d66df342d1299e428fd52189387f8d3c54440fd160d71e331ce764b73fa611e34e60bc773c9d1b9a1a714b4ec2e18db044357df465b840a4e5f6c92
-
Filesize
1.5MB
MD5503ad575bb5cc144336f4320aff1ee32
SHA1c5803081aa0426caa018b611c2d9502474f18f5d
SHA256d219daf6f2bb4af6da336595d9a7cb7a759e0dfd3463865cda6bf0c47e3221ad
SHA5129d137bae35347bd2ed464e863c982cddc2ec9598aca2294b4d186e47f435300c50c86a430dd670bae1fc535b3fb3cb17af37613f6975ab6f9b4d3ac31b5f319a
-
Filesize
1.2MB
MD576d4a78af9a850491034d5094c592e77
SHA198f5ad4e5ad23f5ead345fa8e3fa62e3a30ff39e
SHA256cd28d5bc9372cf2aa52527476d46a458ef917e7ecc65fcdfed2098a8e1914459
SHA5124493b847f3b40253dba78505466b470015f21e4deca7551d458ff9dd560c3d3fa6b13846774cdfb73cd1009e6a4d342e94adc1b978f72716cdf730406543f614
-
Filesize
1.4MB
MD50cd58e7cb85acfa1b83726b7a1f4f8a8
SHA13955bdfadc3b5b08eff1f5369e2fe2fac101f175
SHA2569b50b371f03e5255d3b7e06778ba8ad6d0e8404d8e6d6dfe5e2e3ec77fedc6d5
SHA512856d366608159ed471b6fbe9c74cfdb0b0a6c48a9bcf1acab2996b3bcffc5ebc85ff779e7bb3f91dd47e04f822abc1ae31e39d98adaf839daf49029b7c8812af
-
Filesize
1.7MB
MD5e3eadbbdcd4b3ebb5817c4d56d2b18ab
SHA151fdc2e685418d1570f88ed886872e1dbc93d781
SHA2561753ecae78630c357e373aaf40ec705acf18dd04d01a7b27fd8edd83ce78770e
SHA51299ff65be51d836f39069ad441b10e76b5468b347e529c950ebee37d9460f27c8bc8227b769d68c4e291fa6cca20767aef91ec420590de49c35eee5ffda480bca
-
Filesize
4.6MB
MD5ebc524d27c96c6bb4259681d523e3562
SHA194b2dd38c493ecf7d24fb36491a1dea392f01c82
SHA2563e7f8814f12bf77d59536e7d1c823d26e26031b3e8782dc7ccc18f397a4f1032
SHA512ff70ddc810bbdd3a855e2687806abb4a20cdf3d5fe5507deee3e21f4b647dc7831581b4f695fd3a15e125f391c7017b5d70fdd8ab2823b748028c4b9d7262e5d
-
Filesize
1.8MB
MD59b70dc975e45c75dc349d3b6f36db09b
SHA1a5f812a610fd87d8aa20a61e75590c040d1ecbf4
SHA256e807b115476c1a4e76a982e005ec7a4770edc72f723178e27364ceabe11727e7
SHA5123cc78c9e9c9f3abfc3ddd3e34bd9896a5fa7c6535aea89a2cbcd5823741bce3acdbae5722b949805d43eef5f74abe353c25606b9bb685f2cc5d76984d9b084b6
-
Filesize
24.0MB
MD5f972ad2b2fa7cf8a238f01b26cfb7031
SHA146e88261726ab4ceaffa918738266f61eb407cfb
SHA2561bc5e78838f29d298b033b228072d52a57adc902dbdfc7506d44914f249c5d1a
SHA512308c9705ff0af0c712e50bff1be4330f5e73e892523957c1383c168a25bd9e7ee32378c5d865017e9d179f737a3e179b473854ecb78fb8ace4f82eee561709f1
-
Filesize
2.7MB
MD5aa10b55671946c96ae1e6101a65e9639
SHA1b096bc98f673633cf07ca06066a239b56310323a
SHA256aca4b031f7cd9086d73397b3052c8fc281694eafdf0aab4873319100fcd54151
SHA51237ce7519b642395b2847a24a0761b71c71f834723e1f20f3d3718afd4af23bb55358e070fe6af3841612b25416f29cb27bbc8640b2e0495d35b4fdbf19f975bb
-
Filesize
1.1MB
MD5825e8892102dd98647b1226a1c5b26ed
SHA167d91362f0d198da9ccc672f43c53d0fe4abd3c7
SHA256bd46818d8d6fb63770c632c8eb9be20bddd1c00ec790e1e6919fcb735a56d614
SHA512b7e3b7696f74584376fe76d643cb3d3bec3901d933400e2d31714a6eaf9b87df142735bf40a61df3d78abf5811a8965a3aed97adf24a5a79d45885aff5afec70
-
Filesize
1.7MB
MD504cf1d55050b32b164d716836c0f1aee
SHA124d9c606e6882f48e405dcd3cf16c7e861adcd08
SHA25671576fbdff1f00288415c9153492147b1471f5e72c205b3b075faa11812471ac
SHA51251292c06533ce57bbde83cad0e125a1de22b3d47c61f7b8b234a28414b9c5189562511e8178e5c1ccadf242e85551a022fb3c4dc47c7de3719cbd1e052f3ae62
-
Filesize
1.5MB
MD570c867dd64c1f2769a8be694eff864f2
SHA19d8cc967d69ef9b093c9ede7ff2c8e65a75463d2
SHA256d795f51266d3de6d551fcb68141cfe990950e556dc9c1cbb6d28a72ba7eea0bf
SHA512307bee1357548d187a5c5722adff5419319cac52dfb4986ceb87c37e7632408074b55a62d140f4c4b9299c6da38248941d16643c7b2a7ba1c4ca5d0d5e861500
-
Filesize
5.4MB
MD55e20a125a3327de2016cd51cf426ea18
SHA1fcc4e70e866e912d47bb543470f990e2e087cb26
SHA2564d3ee9cfb8872f426ef5905cb15772fabedce1b749ec690e35050ca4b1d9d6eb
SHA51258721bb6bdfbd59053e8f6fd6596cde6970a2d13afbb3a3efe7204185bf58d7f2656ccc5b93b5d5488fa963aebe5499256f7df653ecf7fdac7322c19623e52a0
-
Filesize
5.4MB
MD54a79002511ee707545e64df1ff819d49
SHA1f3200cb56904a79ef63ba3c690b3d21c4ce540d2
SHA256b8cca166fd1577f67ba38e278c814c295ab2d6748bef2f6901117a14e6d2298b
SHA512e10fdc87af9760a4dcabf9c5faf8072bb3f6402a7824a4f17e295fc7c10370029f24f54cc1f05754c41a89b0db7009fe9e48d1a1b50293b110be8ca940a7c5f7
-
Filesize
2.0MB
MD5584226dab58588c98a12780de23b953f
SHA146f673efdbdd380e831073a24166e081f8991d6f
SHA256202aea85a17c1e5d2ad71c7ad8131859eabacde93a6b2154ea039341941cfee0
SHA512e3f94e04a9132a8bdc45145a6b56641aad3af7831943ccab7ece8045757e6efcda9346a9eae5ea70c3c0ae8846987c8e44fe1a611678558ca04402cef3393048
-
Filesize
2.2MB
MD5e16269819c43c5af4ef4ae63c2419d54
SHA14ebcf5d9239a7f27965af3eca04e9f4cc2c74126
SHA2567f4f84b0e1b82e919ede06062eee01bb3a18fd2a952f3f24d9a95ef4c8ddf354
SHA512fea514ace0f141a86a5bbe42b4ca213202cdaa6f80ff95b65111274d59ce3f64dc717ad40ca30fc8f0967b7c415b475b9a5d00b50e21d340d8fcf74aaf4f05f2
-
Filesize
1.8MB
MD5e4ea243703fef1e912fae7da9ccece2b
SHA1c50f660f4227fa316e9bc9eb834c363ac8dd1e2e
SHA2563eacd3df63f2d9c3c7ebdb87024c672a25f8314192847bcdb7f91fbb49839f83
SHA51284e76b4257fdedb453cccdfafed6fbe9c061c17fce088c5f0faa49d7c9616b3157c12b87c1347fe57528f88bdfc670ffedb9b34d5440c9823462e358e737b489
-
Filesize
1.7MB
MD54691f9359a5d973fd77b9fc79c991e6a
SHA190a84e647b51ce24f3a2dc07cae0653b4912e1d3
SHA25635b3e6ee000a35adefe75dd23e1e4805a0bbb53c4f8f2f22f251d94dabec2b37
SHA512084af2db70c724274e12c44dc4e159e7641d5086c4693aca09a737e82248601dbac58c7bc746ec4bfc3f91324fadb61dc4ff191d4f4ea79c26fdc8eac8615173
-
Filesize
1.4MB
MD54957f1216741e603dc21e69a5881a327
SHA1d7c38a250ea5cc5b79a69bde3d06c216ccb97368
SHA25647f469b45175b2545ba16c2406d3abbf754bce680ef8a3aa65a1985d7f784d74
SHA512e17ec828cd7946e45b10ab8dc7f98dad7b4eef970ae9a74f8e974d3c0235c4da99db249aed719533bf1252139edcc57ddb3b37aee9009cf92d473d613982fe9c
-
Filesize
1.4MB
MD59c18d1571f9aa8643ec3deb14a8072cc
SHA17620722e49a2a61416fac3d17eda96ade79f1b70
SHA256e9cf251c86f8210e63fe962bbb82e370fc10e48ca58e32207318c845f296739c
SHA512ef6d82da71938ce0631c454299e144f5e98f5c667f294460cd8855c8b7029c31bf00adb75bb6ef85f36f9134faf292f52e36b16fffd92b8c345f4ca6a5106ef2
-
Filesize
1.4MB
MD5f787a6db8bf1dde291fa813f80deff4c
SHA160201866c2c3b4b5c884e20cc8388a7e70c01f07
SHA256c9ed0ab655d6d36f5e20e1d2f9445876a9ee409666a406bd72e02eaf43d6427b
SHA512fa91062d3776639f11aadab6589cf1cc88175bbbd197c81815892b94a0202bcfe7eb43c547363ffd871c2cea34601d596c8c356ff7c0253a592caf39ce36a773
-
Filesize
1.5MB
MD5355769111788d6a321aae0c27d9a1599
SHA18b3fa89dfa93efbf5252563c34fef80c1c605866
SHA256e9cf028280aebaeb6578a545afa64c19ebdbda068a18053311c3c6d5e24aa803
SHA5121980e7fe1b6ceb120ea1f4af1eb058f5bd441f5600c2809ad389a2c9fe6c3b36059515e792edf93bfaa3ce9b6c5842390e12ccc42cfba6de0f797f1011d69c20
-
Filesize
1.4MB
MD5d198ff3b0371b8e6b290bd13e5f76a6f
SHA1778d01810391dbc68d4a3021e93090200ca6093f
SHA256fe3e9c6b2519e1cc0d6c850f7d0246ae0f1132b6e4cd6b0d9b09631680f10009
SHA5128e35de6be676a49d942381dc55d63198981197d95620dcc22d4917739d4cac67731d8bb2fd4070344b9355a4878c479518ee819da176f3e06c0f8235c5d54f2f
-
Filesize
1.4MB
MD53fd6cf10b4ead9dd5290d8f20d8e4248
SHA1a9992803325e74faa4f6192569cf1eedbaf2dca7
SHA2562b3a2232babaf1c4c7ce6e7361a47a060176ec5247e5485c1ac0404cc76ed99d
SHA512cd7ad7ebce581ce16e42cd0fbd928be1075042cfe5e5eaf885c7e373c43917425f2f6b218512543dd28da9c07f9a384decd40f9c2ba0d1ba1bc9225ab5a5e307
-
Filesize
1.4MB
MD5a4db6c5dc61f64911cd7dcb611318e75
SHA12b25450ce9bd219625ff1a12abf6fddf2e9b18d4
SHA25674c2f9994734c7bfcbe0159bb2b6eea7da1fbb3dcb9974d568dded580a49a123
SHA5129c604defaa582efa197e686426ed93412a3faf2a76faefa0cc86ee235fa7de4dfc308184ebeacae4709dc667807b6c0e2cbf5445d7100c86a7754b5e6c7fda7e
-
Filesize
1.7MB
MD51fc9946c419573cdd4746bf8eae8119b
SHA1f396a2d7799b05e258e214df724e83adda5a54c2
SHA256e0dc0355902d8af9d1cf344f95e0c699b1ef3c058e77ad56d88e617119fbd127
SHA512f8b3be26cf77df8d8705dc5bd367532f12ae5b210c736bca904c7a9a808375bb33cf3d3d81b3c2599c7f3a44827091de02450bf70504c6849c66478cf3e52057
-
Filesize
1.4MB
MD59180c04b9f533649d2d14614ce878a4b
SHA188c5e6ab5530395e7f19f3cb7351f5621672178d
SHA256b121f103e73f53c1961d780b87f512b9a775443195a9a1ac8b5bcd121d5ebe0a
SHA51219a9438cf53d2e2f3b6400255084f00ffe6631e37105c7514409c411d0d774db883c2ab895c412b4fe6dbcac0fb12c594950f83c4b202f92e38f8ff9c458b7de
-
Filesize
1.4MB
MD585ba9a63b6da2f5e9a918c1c6553f914
SHA17ba861599309775c0a6d8ba93f9cae2aa96577dd
SHA256e3b6e37fe60a7d8dfdf3051348619b77eb7ad290b51f1ac1f17329b427dbd023
SHA5127a46f4e48789cbd731711e072ba34b9fd8ef3afd9f8dce0a060bec1bf10b7e11b21b7f3fbed4a991e8a8177053952f313909118855c0ebb1df6fbe66d6d541e3
-
Filesize
1.6MB
MD5e7fd8779926291fbe87bd5979d4b76ea
SHA100cc1dfb1bb87b1b7c5504e424f5abfa294f8bad
SHA256e5662e45209aac48a8b144a36a3fa9479076d0615b678e53f056d2ff74c06e6a
SHA512f44114b9682747472afb149b36b8fc288876ef9ea1097ce40b8810f7451f00a49d1162bbe63564d6166d1322e051662e4741c94617ef255db3b78799c85aae4c
-
Filesize
1.4MB
MD52e9159ddbb60042eae03c56fb8045b1f
SHA13801b90cb8ae416e55c75c8647ba1a3b07687ab3
SHA256356574599832acfe1c6b72f4f811b7ee0bead9a23afc1e06b89219ea0d1e16ed
SHA512de3fef2b75d5d301235e9ad2367a5dcaa7eca650acaf91741d5259f533d465f32a6d1e07b21bd47f8649c50fd3e368f0813cf5e2be61d585c9cf07069d2fb8a8
-
Filesize
1.4MB
MD5a3192c6f3fb5820f6a7ff6eba8957b26
SHA1871de2a82cd289eac20182c5fa7dff8c85045c2e
SHA256b4ca04baf8b369d2089a306be29afa0c9a5ae015fc03deb22f24464bbf33b73a
SHA512d73c68001c94e1cb808dfd3e6e3aafe856105afa15a95c094effc65e760598d56018b77b74b42529430f0fa8b07837003117796d08727bbd78263c92de3ad8b7
-
Filesize
1.6MB
MD5d6cc17bb22f17046580035785b5958c3
SHA1da9853649452533310504bf377ec83d1f0e1a956
SHA25619226d83f0da22ea79df8a678f54e46b15351047d9b838b214be342f6ce9d839
SHA5124f325b617b615a1f56bbee54e1c71b13ebbc3e3719f717a9c8333814899d01aea806969406b2d6f9a0a69d679f41771afcfcf2ca60c5bf2b42fe2ed7d1ef6671
-
Filesize
1.7MB
MD55e7179bbe228b4acecd51dd0c16bddbe
SHA1fa94aac8eb3646dda3f26145c082fd2625f7ea9e
SHA2564b1ed6deae51bb7ffbea3b9351b2758600cf1500210135ffe19d8a3d380d019d
SHA5123111505b6ba49bc6902ef1f8052620f5c24cc6364dd6a0aee4216d71ce3d4caed14abaf7d871eefc056e057d992c77a3b732adaa95f7c5e34acb3bced5ed9718
-
Filesize
1.9MB
MD513b39bd15e1e24ad0d8b29b284060a9b
SHA1edd2777626db3d486f1fe65ce81d530ceabf50d8
SHA256e1d98e33e8d981f03d34bb2624f4a89316cff5baec66a4c21f64fa215ad26a7d
SHA512bf264c083ca507e38caf322310190ad45a6c40ab679afc3059988a882f317efff61bf9d209d04dbc631ffb69f4b8161e0b469e9877524b27dcd3afbd1a76ffd0
-
Filesize
1.4MB
MD5fd091fe87c53a7c2196812dc8dfa2536
SHA1dcb07bb80338428a1411a40dda79cb4b11760863
SHA25653f6ed702cefc23ac44b864b4d572c4625aaeeac2e0d8944cdcc14fe0279e980
SHA512a929465846ed80d1fbce2c33e755cf6cfd78bbdcd13a100166cd8d91515eed0621604c946655265b86b80c1a9e7099973ee6bf0ac969946034e0b9fbafbba514
-
Filesize
1.4MB
MD54bd0cf36e6a854a048ee439297e93285
SHA13ce1f2e3031a82779b3cd23d0295b94dee3545db
SHA2566241d1eee5b3fe7fcc2979ddaa28bb192fd6287525f2ff7a3a72ee103c45907c
SHA512408bab050c6bcfb4c66c5c63665f210cc152601aab593b3022123f88cbcbb726c9943fbac82eae3057180fd0ee07b59239e3c5f6a065620fd91c4f49c036476d
-
Filesize
1.4MB
MD5a87d08dc173da701049ecc9bfc9f7d55
SHA1998c1e8d8b03074a9ccd5f22c409e7c09a68931e
SHA25629d2bb0553f1aef17dd0a9d7a2c46e08e66b855bd3bd9309f8a91dac2be3cbac
SHA512fabdf17445f5fb98c784e224a9f754995f7d4930f0d6ae9bf98e467e3c77a8fc62b50552653642cfe368741ba376974c9a9cfd93dcd07e078e86e2d5dc75ea61
-
Filesize
1.4MB
MD578008cf1fdfa0bd56c10c663bdf7f0c0
SHA12a54382516802a155d104a95c8eae200ba851271
SHA2561032aa8b0f415b0db05ea4f11bd7b0f3cf109c778b26d1ca0f25f119a489497d
SHA5126b926f6f9e7576fe507414b0007e8e1347911bc8eb97fe5eeae1177bfac988b768dd330cbb9b86f46d33663bcc5273f510e92b8306245f0d069e3029d3e494aa
-
Filesize
1.4MB
MD5206aee301f2fa857c68ad0eaecb24be2
SHA152779c1d05e0d96f5898b4e9f45b5b04edc62021
SHA256f7ff6279af2aa1ce3628bb2c35a667b1bb092ad51c262ceada725bbd3b671486
SHA51210e6c1a429d89563f4202d7773159d5d81c27addab7c4624799e61a52441158cc48d3177587809f66cb6e48f2a159d82c5c1b20945bb4293829bc8a6f378c219
-
Filesize
1.4MB
MD5907f4ff41da585dde76bef11e8db8f19
SHA1d851f4bbde0a1cd430ecfbaa9d7618af76ad6859
SHA256d3e541a1f5f661813e2b1ab8031eaef5720ad098b949516fab63ba6c50342bd4
SHA512e12b1be8dd9f11b326e5762736b4021b406cf0ff2947023dd4ab6f8c733fbbdd5d92de8fa58b448f3eae42326c53ea1fbbaabf6d7b76c14c6afbd3843425860c
-
Filesize
1.4MB
MD5bf84526077133207141f39b607d0a66e
SHA172cd971907203adace183a82a8b29c4d33b80fb7
SHA256396ce78f5def17691dcde222b10d3ee674f2479669be3367d8759f478005fdd2
SHA5128bd952a12a7bb409caaab468f0cb17b9915aa3a3a6de265e4e816e14f3e1c3eab8c56930ab9167e46db798a56b213be020d46b8d4fb043b55197ba8f9715aa6a
-
Filesize
1.4MB
MD559901890d5a7c4536575bdcab268b492
SHA1983b288248dc4d6772182f5325b5c2e88079bee1
SHA256e8f5346cc1804be2e1d1681254556739e4ca2be8551739d93a407f0b56198b25
SHA51266497ba21ecc2668d522e75fd4b5ab1c25a3533a99c78d85d20f25217b99f5b82a691a0e64708c59394c780ac622646f025c3ed3428053023f004282fb4889e3
-
Filesize
1.4MB
MD5384d5be20cfaa2083b762a678d136a33
SHA128678f187133e71edd9e85680234cc81a8186fc3
SHA256e26c4c2403fea55a56881fd4722a5538f7daac767315df94885473409128e525
SHA512d7c198bfc75a9c100da8081a8e6e649506f0cb01d691236f5c3cca4e0df7cba892049d68e2aeed1a8e11766a725ef062d4ac79fb9a159b26cd37c9533aa59dab
-
Filesize
1.4MB
MD5ecc9ee1ffde11f842859b716562a7331
SHA10d2d7f2a1b3f8155fbac5d2cbead5b65b5b6e58a
SHA2567efda3ed63ab80645c2acac41be9ee93b74af886dc28519dbe11f860d202910a
SHA51255e77b10c3a739b2ba51f1961fc12f01b708b1cbed2afcdb77212e0434ef4387a997464530b6de37e94b3e517aae80ed8542f68caa1493546da982d0be41296b
-
Filesize
1.4MB
MD549f355453e410b0c166490dbf111dd31
SHA110f2fcb9d4fb5c95c055defe9a53b67f204df680
SHA2564a53a269747e5c0398318470a0c1eb900ff95d4a4b786cc0fb4b46e2b4bc888b
SHA51254c208d601165598f10ba44016e8151c4c2e0d18f324de2e43e44f42181f8dec40fbbc0e2e5e059458ee19cb3b5cc0a358968d8578919c3f861d6731ca745c19
-
Filesize
1.4MB
MD51ff3d0cd508ae4068a6e5a67d02622c7
SHA125bca6bf1b75e26de7b0566c5e273151d673735b
SHA256a43efa52fd0192d5b1b29d7b17ffa4f6389663f3b66d122ad333a14b576cdff1
SHA5126074b110c3a3dcaed109298236779ffb3962a0b160bf87c0d9b0e0962798b18423b8e6c5e5260527f5679e4ecfdb8b99b68b637fd149639f06c1aff352769d9f
-
Filesize
1.4MB
MD50a0f41e818589b02dca66694e2679166
SHA1f9d83e1524403eae721c102457e63cc228094690
SHA25667b213be47fd23995477a8c9f25394319f49d389008d051a0db46dd323c9f8d8
SHA512f947fd01199d259955ce18b6a8cae6de46a5e11149e665f7fd7b26e4b86c244a1a9de1da3f681202d822f2ad5ea78a689c9ee7c18b53b6d7688b7981a75c5caa
-
Filesize
1.4MB
MD55dbbf4a0e2afcea5f4d5621dbfe0c423
SHA168c4f6eb85ff5d483ca1666b85042e2811338e56
SHA2567e7334eb606e548ddd831696420e6415c0fb19702d801637084b48d76caa1dcf
SHA5129eba3138a7e9438f857af5bed1b095c1c94dc48c5389b427ff683633833971ecdd9b75d06eeb41dd4b1bd697e2480001dfa06899ac98d353f600c6fe494f2f4a
-
Filesize
1.4MB
MD5aaeaef1ebd642b94c901ce0699ff9806
SHA19827c410e175f5a0fadd3c0cbe74b1b24681c420
SHA25667239f2f15f9284035f1e3459443dad05afcdb608d082b3d3090141b96ff1c01
SHA5125de66e3f3c52c4bd72816db645bf414aba8c6db24cc9b341b5d2b0af548b3892da1147d1891bc88ab0ea7a223ee4a8c2fd5037c43d00d75ba55e4f7a2ec2306f
-
Filesize
1.4MB
MD5714f2f67d7383a07612f0eabb86688b9
SHA13023fc992bf4cc29cc3c27d764a200690ad824fa
SHA25658df805992fcdabb32bab76d44cdfe3301022559781063278aa7adeb9cb1a26b
SHA512e7d731e400470a474f507a5db525faa01a430638a84727439a370427ab333ba5993c707d6aa6b6520ba1b4aba3c15b0d84583c53598de289f4a45a6a8212d31f
-
Filesize
1.4MB
MD581ed8055f95d7c7cdf2aab6d6ebbff57
SHA1d021b185eb42e8db412135d2e0147a8c647e3cf4
SHA25674bbc59e79905bf16b7f355ba9a6e42dcb21a6b2bf2a568aa2c37ff010cc2a3d
SHA512aff2037f2005f5cf88fa839d4b3cc087b5e7907ae2affe56914d3ff760767877d4e9abc91983608714678132f22c89d4ccd52575f12969c724790036085b3463
-
Filesize
1.4MB
MD5f56d8d0bc4ea05ad6d86f3dc9ab358b8
SHA1990965c41a2fb5c12931788d0a11b3952da43de7
SHA2562ce405c049d4578ef6330a2848c096123c11500d37267483b3d419b05e677f23
SHA5123a9e84425514e09ec6d94aeff9e7e6ecfd6499db60732e55fbadb88adde72540e17eb833d3440a7873be25532226c2da31f898853b5d690b351ee7e893f7fd48
-
Filesize
1.4MB
MD532f7ce396b5d35047a9b6ba8b9cc43e3
SHA14d761ff31c527a334943a5d4a4f61eea6145dde1
SHA2562c84a00d2ed6f735430b0bde818a91e2986fea5c9613b49cd8d3af41120f320e
SHA512f63044d67c0e089956b14dcfc9cb635687ab645d4155ec4db4fdea949890901e31d82d2c0699a6a48b97f7a2ae142832f4cd05818140b5b6bf543aea107db960
-
Filesize
1.4MB
MD57a820a9d2cd5ff56d98d51e35a05485d
SHA199d07822495050f768c1a78c39cbcb15bc989eae
SHA256ef31a00fd96bec03665e14083d88b8f5e6a9136e45c3708c50d3ac426a608025
SHA512273d75d531e3b164df1aab5eab2706cfa8224555ab814eecf4084ecca4a41b5d18f091b6f59cc0ce79899841695c6932f06f20a222ccb4cb63ab9413c67f31a1
-
Filesize
1.4MB
MD5933fe864116bfc00a1c38e82e6589cc7
SHA14771da79ac397146bf80d2d302dd10c42107eac1
SHA256e5200140ee8e3d93edb606b98e1e4cdff789e1721f588ce43c6ccf3658aa0ef6
SHA512085a671bc03974b8178884ee0984786950f31360acaff2625799afb3b70aae79117334e385051c3c6fd03b60f5f70437c02cae73de1b71eaf698422e9acb8aec
-
Filesize
1.6MB
MD5b4e5919090099b4c4954a54eeacb3827
SHA17901823763bb8e3db1c71a4ddb698bb199f1822a
SHA256ab0ba10aa92bd969262f4b541572291e13feccac22da02582848ed22dfe51896
SHA512a070f7853d16d3b44fd0ad719dbf6d359b9f5b4eb5cd058a7d122f1fecc46d28bef0a167550e41fd77f0a1448ee1e4ff59824d140b9508dd8159330ab14d86c3
-
Filesize
1.5MB
MD553876f285319c12f0f6a51df6a27b090
SHA18fc5adfac4fbda822a5071c64b4d40a1402daa4c
SHA256047d050d7f086e8e446f69d0a06fda91b3e6c0d63099c00ad4b977c191a25b22
SHA512e03a7b35daeb6396f0e78bf7dc43738658efa132569d9169f65c736be4e8d420344bb98696d634d4f8ecd596c16ecbbea492bb44c39490bf273ddbdde30e13af
-
Filesize
1.2MB
MD5e237bb96aee135b9f67e461aeb2191f2
SHA17c037ae2139a2ce7a250920ed38d62a0cb5a62fd
SHA256f5e9d048ad06bb190bc22753b28dfb8032e4f036f14855aa644806521a37be2d
SHA512664724f85ed2d1777448bb9582bdffdf32fe6bf18c7520ae4898e71234cc0ded9cffc02d3d671903fbe68454f198873ef8e9674b952027ea8804b1bb52a34e89
-
Filesize
1.5MB
MD537ea20cda4a9f62e75b5c8443ba140c3
SHA132e43d16ae944eda20be3012eee1b711e3d17f00
SHA256f52a89ba0d56ec5427e4210dac57215b107f49a9c05b3be43a57d67c78e3cfbb
SHA5125348f63235e74635695a77fda01fdb9362b4409642d9e48d83f9c0c03af5e18f66b7596e07d3fb6cadf52988e4b3e5cc49a984476c45bc39dd686d5637a1e870
-
Filesize
1.3MB
MD5db857cc34e955e39c654b1a7a81d6de9
SHA19e204f3718aa8f29affb5076f9186f1334a53ef3
SHA256533efdaa807e49f53a52a735eb5c693aa5bf37ae19587cfd728b435b05739129
SHA51208e365587ce821112c8f58d03059bf7f589644c1f8661fe37712c78748df104f37e775d2fca0cd5756031eba5485275a73415462a59044f9b2235600ef3c8c96