Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28-06-2024 10:52
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-28_9a87fb334adf9337a19bfaca9c555dd5_ryuk.exe
Resource
win7-20240221-en
General
-
Target
2024-06-28_9a87fb334adf9337a19bfaca9c555dd5_ryuk.exe
-
Size
2.2MB
-
MD5
9a87fb334adf9337a19bfaca9c555dd5
-
SHA1
1de6285d85dd11a3728adb5e883b975f6d9f5647
-
SHA256
8bc499e8f1030e879b17d50c47081555f64ba1e0ebb1d2d9833d1e734fd690ac
-
SHA512
f448dd521b01e4dc20db77ca26d9b08d346574bee5e297bfb1141378f223cb3e17ec68d36af0bf334c79f134a85e23a0a741ece4098d75b14b08590d7834c34c
-
SSDEEP
49152:xOOh3aN4kuLbegmtG4blI7a8K2mFhbrr:ZU4ku/ctPlI7K2mF9
Malware Config
Signatures
-
Executes dropped EXE 6 IoCs
pid Process 1328 alg.exe 3464 DiagnosticsHub.StandardCollector.Service.exe 3872 fxssvc.exe 1956 elevation_service.exe 980 maintenanceservice.exe 2472 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\System32\alg.exe 2024-06-28_9a87fb334adf9337a19bfaca9c555dd5_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-06-28_9a87fb334adf9337a19bfaca9c555dd5_ryuk.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-06-28_9a87fb334adf9337a19bfaca9c555dd5_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-06-28_9a87fb334adf9337a19bfaca9c555dd5_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-06-28_9a87fb334adf9337a19bfaca9c555dd5_ryuk.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\debd2d76c3136770.bin alg.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7z.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104468\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104468\javaw.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe alg.exe File opened for modification C:\Program Files\7-Zip\7zG.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7zG.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2024-06-28_9a87fb334adf9337a19bfaca9c555dd5_ryuk.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3464 DiagnosticsHub.StandardCollector.Service.exe 3464 DiagnosticsHub.StandardCollector.Service.exe 3464 DiagnosticsHub.StandardCollector.Service.exe 3464 DiagnosticsHub.StandardCollector.Service.exe 3464 DiagnosticsHub.StandardCollector.Service.exe 3464 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 660 Process not Found 660 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1900 2024-06-28_9a87fb334adf9337a19bfaca9c555dd5_ryuk.exe Token: SeAuditPrivilege 3872 fxssvc.exe Token: SeDebugPrivilege 1328 alg.exe Token: SeDebugPrivilege 1328 alg.exe Token: SeDebugPrivilege 1328 alg.exe Token: SeDebugPrivilege 3464 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-28_9a87fb334adf9337a19bfaca9c555dd5_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-28_9a87fb334adf9337a19bfaca9c555dd5_ryuk.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1900
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1328
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3464
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:4004
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3872
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1956
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:980
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2472
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD566f9c7479cac26f58baa3124096d4e44
SHA12df4011b1e933c7e998d396b185b25b5acc46aaa
SHA256d0397c8d8886e9d1779db6e5c94467fb73c94c5038d7e4ab75bb570182645743
SHA5125147c42af754529d03cfff9cea77464a8f22e585942b0a9cf85bcd8150511575c23fafeae476b527eb0bac0f67c7f7e0f6ad7463918005ff975fcf6409463ce8
-
Filesize
1.4MB
MD58ecaedb04b25705c4db0cb132daf84bc
SHA1eefb791fedfcc5b6e14e334dfd3718938218f99f
SHA25640b74c7abdb0d27ef53fef6458531b60a4ecc84aec185aff4278574617420b2e
SHA51269e3cb46d0ec4d748efb12f28cb31e4a0d1b0ed5f030fa0611c4933d57b72569a4bd882e5ee8d4203b203942c6cd57fd69bf58929f885aa1754356cc10de1184
-
Filesize
1.7MB
MD59b48cd5d36862bc3ec8852f50b93c937
SHA1eef3fd43d2070240f690a4dcca5cadf7550af489
SHA2568118ecca1ded6e1946c49415f450fa2608b37e452e9c0f8965c948256e207f48
SHA51233aa777e941b9e22e0e688c70a701fe13b725018d68e5d38e8486263c4230cb1cac22611d6c00e97b31e23d18c76468cc6d43a9b71a22cd25c3dfee2b4bf1443
-
Filesize
1.5MB
MD5af36704c1164ae0757433d852b0d81cd
SHA1a3dd350d57fb77c2e45a033d801094d0990666c8
SHA256c7f111e8ea865b80cc606ee37f1544f8e0695bd308728f665e200493937dd18d
SHA512de2dbcacd4df06530e74fa6715ce90f4354873d0233417e0f6c9b4afd31acd6011dbe11f65fa3a8b1328f41d1b532a36135887c0ac2579279d9ac26249b5bae5
-
Filesize
1.2MB
MD58f1c3bb07f3c0570d81681e7cdebbf75
SHA10f60af9e877cc99b67714270d645bce373d2389f
SHA2562b2f72cc7ddad73a62939255a2ea82399ff3aa1d9bf793bb26d9824e5f9574a5
SHA512aa44d89d2ed3f288a272a09a0dbe8b53dc8916fdf242f8245568976acb1eee81a278c79d8ddda0d9a6a5ebb48ff0544e2189aace809943a7c0cd7f6574a1a3c2
-
Filesize
1.2MB
MD5c40b761ec2c61adee0bb6639ce2d284e
SHA1a8421d09c82c77d8807235a00cb516c162dca580
SHA256d9ad14d6175fc6df08a8d5cc19513dd5c8d30816daa949d92f659f5438ef29ce
SHA512d8b86d907ea9a1f6183eaa971bf006a066c07c12d63e560ab461d698ca08838c49e0040193fad718e7ad9e8b82858666655cf8c22360fdd0b7212245a9d649b3
-
Filesize
1.5MB
MD5dc9d63921524b6161308bdcc26928154
SHA13f61d914be5c4f4d7ddefc2782d8e2e5ea0f9c17
SHA256494a401a1b38a461b3af6d585811c2e5ea74e6455a42b76ea0a4ded76998042d
SHA512ba5d579b871a056382f7922e11682d02c06d03209b4dabf1a5ad1087b3b0afc658bbb109d69554777915ca065db169685dc4711edb57d087f00da95ddc50d150
-
Filesize
4.6MB
MD5c8e8ad078083ab739abe3c2c654c6a18
SHA1c7c0690696406167e3b9df7e438f7e05da9c9b66
SHA256e520fd889977e36ad8dfc0003b9016f9b236306d73969125a752cbe4f0eebe37
SHA512091ed33e3fab098f9407d20933825fbbd6c0c1c1ee3d301b3629ccecb28d32af6b33182a5e3e45656d9cfd02cd098c791fc0f5d38de5d5cdb4406551bcf7b797
-
Filesize
1.5MB
MD5f0ebcedacb2f69aafa34a4e1fcd71427
SHA1af5fe6fe669dd8d84262bf1644c96f04f6ed1426
SHA25685dfde1429a233542deb4eb4bb3ea12813b660969a273fa70be190c95875828e
SHA512a5974dd42538214512acfc9da13e1dfc198372de4f3c74a4e0abfdc9ddf37bd662d690b4150b0ad092978ce3a9464a489237b05e0e4f8b193b115ada7e6e0ad4
-
Filesize
24.0MB
MD5e5852b5f2140dafcc5bf774731209bd1
SHA1404b18fcb3c42813898d8ef08a7324cfe07f5975
SHA2567a7ad1e0fcd4f6e3c6a9f4603b5bfafc9bda4ed18190fdd3b1c66b44f7055b08
SHA5123aa0e32c54b8b516635d24e61f15271561135fb5575eeab3f7c1fe4ce4738c6a0c509dae26757869fde4063994f3f557be10928c0ec4ef2d0a8c3f5df2bb4610
-
Filesize
2.7MB
MD590ffa3ebee90905643dae373070f1df3
SHA19821e19fc888c1c5b56fbcf3f4897be99ac36f4f
SHA256060946764967f91c163eb4c83c96d685f4522af6f896f920f0739aef5f59e3fc
SHA512f0164535a88a186500ce2493f8fc9334d8801c6234001df3c49f84a01c9862856767785cbf34cc2f17c0ed11bb50f095a5b7d43329ac9969ece9b243c8d6640d
-
Filesize
1.1MB
MD5a6ceef8eb4cc69813857a11e93ea053c
SHA1d26a363f667b73c931094dfc6d4bbe60f2758a4e
SHA2563eeefd24777220e55d7c2dd26df6df396b7cb7f02b487398ea18e3a1add47009
SHA512cfa3da28ec0245f6b34c1aec4726638f96b5289d92bb850cf9762b79ae8e23620642ddc1faf1318e73b5689143ac99c901cdd4f85147c38cea33c078464802c7
-
Filesize
1.4MB
MD5d20c9e296cc184541c1e989dbe629c3c
SHA1779b0f1c5aebb803ff361f2415847248f58e4b99
SHA2562e269694f29b71020b80eaca337c8b1b069cb7a389f5cf895527afdab9b0c606
SHA5128971e4e5ffb71d577b571a185d2e2b6b929b433985be03778cc547591565c8da6143bb0775d5c0c5108b7ddb9f56663e661aa53c83c1d3ac926d176a64b425bd
-
Filesize
1.3MB
MD5a76048919283fad9c45c1f79eac41284
SHA126b4f60b1db229714e36f33591eb77fb71e6f937
SHA256c0bbd172b0925bb3ab801d1eb00ad4854bd80d4838ed5f6391b12b89d274dcd8
SHA5121f899cdc625724d1ab352288ea2d60d60f1d6ae92c520bd4e546d1f415bb05409880c5f34282d0c0df584228dedc861c8c908213bd3892ba3d250b2f36812647
-
Filesize
5.4MB
MD52f5973d0f3b2c775bf3debeb3c4b7b0b
SHA1d3c050d37e70f3dc52856427f80d07a1f1330628
SHA2567bd758dcd86f6f200ddf1ceb7e388ba90169a394c3a93a9c5f7417c05304e5d5
SHA5126f4e148985464bceb003d3dde336524ee33a5c168cab8c7f9188e188a6b3044cf126458965f8c715d3c3779f09b98fcd044d4d4501461c281572aafdb05fe3bc
-
Filesize
5.4MB
MD5dfc0a1482e8f4fee31c1b2fa67d96d63
SHA175c6a62378a939e5d89c9fc11d89fd7670187a09
SHA256bc65bae53709e578b081139e0a3724b09417999215790af7193056a5fca89ef5
SHA512f103e2547aad9ed75f9c76bd3afd82431315d3974c99e8b112bbe11bc5ebbf66b67804e4076ab5a53baab3287f97e86fe761758f096f3378bd17779fd436c9be
-
Filesize
2.0MB
MD5a98ce50c3bcb567a23ca144c89feb936
SHA154b72e3a63ee45fb1c51db50f3a40b16d9aec1a3
SHA2565af772bf0fcd0199ecddcd6e411c9f10b18b7c3e715f866943f72097c80f6e4b
SHA5125a85cc4620b92381ec36e4e5e47ecd6d693091dc39cefc55709066412cf7b95bf4d34e901b199e3a9a0e8950d663f859dcbdb2171f8ee4449894a5b823d38f64
-
Filesize
2.2MB
MD5df7ae2974901a63afbe4c299dfabcd17
SHA110523a0e0b978109acdfe47faff65ab812c0846f
SHA256335dd75f5571a048573e3d0605671a769844d308e3e6113fb8bea48fd4066fcd
SHA512b66cd6b4a34d4dad9af611e6d629c3af0bdae3302216634dcd05b50ba72d9b529b9b03f1262be43c43f276e1b4e192136701017c1935779a54498b7811d84e5a
-
Filesize
1.8MB
MD572461df38c0268f482d6e0d99753f808
SHA14452350049aac49b2e961d0eeb3b373c02d6c491
SHA2567870bf8cde53aa4c2c4ad2038541010b7ed108fdabf6474e97a5a0850395c549
SHA512d9d3201eabb5f7555525ed9c7bb24ce8e19504afea29909529e6fa128ebd1dedbf217574f309f19ee9d15a8f364fd64e76fb19f1b52a039279083651423966d3
-
Filesize
1.7MB
MD55b2145e8b59668073add082278200e3e
SHA1478accf6619de5c2b15f363239dd14890ac778d5
SHA256a53597aa63dee08fbe90aef2c1b85c4cf55af4a020bbc3afba5040a8d32dd2cc
SHA51298db2231f6331d79d0ca0ffa54752d9bf22db3d48fb32411702383d184e09d9fb7100ccb97df36fc67611b0d8e406b17e297d74ffe26a48d610529ef9b4991bc
-
Filesize
1.2MB
MD5060490813581105397192dd2eae8d8c5
SHA1b50a7ccf7e901f1d82a24ce8ea35f3b18bd64816
SHA256b63d634d4a6a61dfee167f7cfc3b0f2c0207ac6bacf1258c6ab5acd3e841bfa6
SHA5128e11fd8ccc56ba5a44f7c7d15313666988d0a7cb448424a2ac8868daf45866dae8c13b722d2e96313a3f16be726b58b549fd2609a18169ec8c6a28dc56e24854
-
Filesize
1.2MB
MD50144c73003fab8838036d5f2c0aebac5
SHA1b40e771c99111118cd876278aede85e2b0d85379
SHA25650339db8991aa3e0dc368fb5bdcf6160b05ad2c85db91d66de78a61f844e7ca7
SHA512a68b156d9d0840dd3e001e50029a6110a951ab31be9464ab46392359dfb3b368e8d898d1069f85e064513c3b886df3571e1b06ab8bb6bb7c9222639364f1ef84
-
Filesize
1.2MB
MD5777cdb68d4aa746a8240041e3e611b20
SHA11d857132900ab99abbc4600d918c455d3a25d4b7
SHA2562e27d05f6bdbdba41b80c228f26447c88331a62dcfe980bddd5ca54dfe9cca5c
SHA5124300aef26a2ec36ff7680e033e9faea3e2baeb2666539faf8d071b4b669b098157396957e5edd90225d143056cd612661dbff40e57d6a397bf1195be99d676ea
-
Filesize
1.2MB
MD5a83d926479e03dacd7eae044109aefe1
SHA16981e53d57fbffaead652e552f908ffa533cc10b
SHA256bf03ce990a215a33ddc1905262ed5a9b5951c85d82545f6fd1124fa26584e62f
SHA512422fdd84ea15645c50ebf8368812e7d3d15c7d25753cef728b0fec004124206b99e03c7fe53a45228250f5746f81bf5114ff874715411dff2fcc187f77b99f04
-
Filesize
1.2MB
MD56c4cf78f6d1733a360978dd8e0cdfe85
SHA18ee6549a00687f152b8753f7f4de228e3a91b08b
SHA2567814e5b2d10539cac2ab10381192743be5f32b7d248cb475b7b47d4f85a381aa
SHA51260551a712c172b28aff54313abf21fb0e82640090e3160029c059c921123997d09782a4ef7bba58a4368c5db5d87e9e954fdf62ef9871ad5f198fa4663d9abc2
-
Filesize
1.2MB
MD5d1d0321987611a669c9c9c2f7ed068d7
SHA10fbce581ce16ab081f6bcbaca96d711463d63c68
SHA2562ba9a686f4c2a19cd8f5b2c6cfa8711b53a2970aa502c9a2b06dc1cffaa4d0b2
SHA512e733f20deed70f49391c484bbfb6c0c892ab60082da3441c8c18af11530302dc2749a1bb835fced34ce5aa859c72756cdc8f70ccc0facbf0ec4066dc64f176b0
-
Filesize
1.2MB
MD57897bded970bfbc3ca396901cb29a048
SHA1279d497c6016bdce0900393257df9f7614892727
SHA2567191b92d00a83939e5870a0ee133d70957420b2014ea6db6d8d76c5ef53822e4
SHA5129c460d9c0e9c8d41a3b3fe3a7ab632098f29ed7d5ee8f10ccb742f283cfac8ad3778f3e4006d9a8ff4ec1270dfe8eee59a71fe4d6f6579807ccc0346d6895ca4
-
Filesize
1.5MB
MD543fa776ae723a5563c79229140d45dbd
SHA17a966f474c1c5a8c8def5238bea06e188743ebf1
SHA256573849acf61258f08cfa1d738acab0fc1edfdd5237520ff60f6e504bf39f3605
SHA51218316015194bbf7b1ee81e73d61644fd82de8b9b4e59a434cd35651887dca24a2829bb69d5ff03bca34cfbd68de9ebb00054e1e0d4aafb0519df90d6e9980190
-
Filesize
1.2MB
MD50eadc59528fa71368d061edfcda21b72
SHA1d97c7a0d76628f668af37be1f226414b4f6fc323
SHA25652302d94cea26e9bfbfa996550fc3e8194ca3a98586f8eedc4c02efa46f0df7e
SHA51254ffc0c9fcbfe3e6425ab329d44ba786cab5df28f81911aecac66cc2f1c6dc7b8a7b092b96e5707d2060230931e7e58d589733d2823189b2b03e2533f3c5280e
-
Filesize
1.2MB
MD566bedd525aa903bc139e34b5a2f68f97
SHA1d027b9b0c4c00d992b01ca23250c4a751477de35
SHA256d8ac85a7d1898195313d98eee700f7b2e194af795cf87e6da0f4b1e46d6951f8
SHA512f6877e12e994f99fb82cc82ed818928e5e3719d1e2e9355d036fdf4c744fc5338f26c2d5ffa3c3eeb32f49aa81ac0751b4d1d3b291d66e0234f1e04b296d7a2f
-
Filesize
1.3MB
MD5a7085a6680107cea7edfc56a458238d7
SHA1961d69159d411c3b2d339cc31b79415d808a4282
SHA256f00729d7380a79b632d5b3880a9a6cc838267fcd3d6ee59ffd9b3fbc58a991aa
SHA512cb94bda676c4ae4ea932415445a04c81f38bdd0927da442a3e9bb3a897123632b6163b48821c7948c945bdaa0be0bfa9561a405150c389f17139dba65f85c2a3
-
Filesize
1.2MB
MD550f2cf934e900c96250fea3c2b1cb2a9
SHA130aa2bf8f81472b544356bde0096d4552eec47d1
SHA256863f82691bd937d628f47aa4b20f3a39e138397cb552e4610fbb46560758eb1b
SHA512481ee6bdc7c3270a0525bf65d4521bbd87899c62151df2e6558351853ab3bda06716ae249f2f4d9bf194ef0892634dc8869d97b8e736470b98ed57697cee630d
-
Filesize
1.2MB
MD5a24372f36f9aa93cf0ae808eac8e4d31
SHA18c7e4d714c8045c8dde8cfbdb6e87c1923eb9741
SHA256b50caa8d794aba85a04e08c3d8e91b4a7f71c0788d716876c7880a5d5c45e79e
SHA512744e8919870c279dc9627530eddfbfcf1779d3c54ad946eab650838c906c46881c365420853c0d2422031514955023a67fa0bdfd4feaf1796636a43e3187ffd0
-
Filesize
1.3MB
MD5ba2c1b6fa5f6cd971d6426a6d283db6b
SHA1d66b0de7a3667de9e653923c3f19770a71c54f52
SHA256f6977b0c27c62631bd57bc339cf9521f7904d1fe52c53498a8834810fbbd66b6
SHA512dfc5999a17ad89d99fb106b16b6bc4db17a843d48160d291aa90db7ab22da7ad4e949c046b0cd99a6458175aa38afcb34183217fcba2e1ab5cd13221f154172b
-
Filesize
1.5MB
MD5b9e5836d2a1ec02999aca3e177a57c8e
SHA12fe3a1841ea9f7ba401a6724e12f43a3823d3d8c
SHA2569065e7c72662f0dccca72d9107c32eb13450bc13c0b2f38fb4148adc045a4f5e
SHA512587352fee01b4fe8dc343d014f91feff618592016675c419bd8d36312d9ca10e1a5971c2f7676ef7aa034cabcfdda02e25edf4819823335628c495bb3bac0b74
-
Filesize
1.6MB
MD5c03f2814b3d9187e43689708f5edf5ef
SHA100118eff203e8b277b8f240ca41bcd5e59877e3d
SHA25627c336d9d61feafa7b6427a6a6be3616310ca943c24ef0900c8fba18e79a2268
SHA512ded5a48a6d7bf9eb7152cd579d2be7408378d37dbf318cbd8c7ad3d96f1ecec732001bbb10c5ced7d591d675051423bb51c168981089c33e34c8826825e15cb6
-
Filesize
1.2MB
MD50d6d28b26160582a11e188dc1d7e9cf9
SHA10c7b97f44bbcc1b0a463b92043f828d270536187
SHA25627fa962fd978875c9837721c1216b56b6bb176a0ecfcd0d24b8420189af33c35
SHA51280b959993aa8237eae0b6bbe23b33da59a4860c5b0552e35823576df265a0637cb9b861927b834b587bb0d78b089fc489f166380a0da060c396205ec88376561
-
Filesize
1.2MB
MD50c680b9c0a14575db507b98bea6da6c2
SHA16740ecea232af9145ce68deede7bc4ffd37e3d68
SHA25690e8963c218b70658a32e02ff14aef9549967a1c537ae2e5f3f36c9a2d464916
SHA512416bab34072267e2e8d98f7313243768c31d07d307fdd14e25d5dd73c7011867abdbfb7b164699a3b11606d1a3cfac9f856326418c48fda8d1a0d28c9175c0a8
-
Filesize
1.2MB
MD5acf2f7cd6e71ce8a741a792f60e22c4b
SHA17f4a28eb6e660c05db64e73d5e079fe5b96eb298
SHA2566d69f50d05b71f67461f3f88a27e1058635ae22c09ebf22a4ae21bdfd178a1f1
SHA512520b331226ffec561563a08c17363c39de4b1748ed30ee4fecca3efb26b283651e3cf5d6b0929ab0656370d1694a6ceb53dbc806574e4fdc5c8e853fead245bd
-
Filesize
1.2MB
MD5c7de17bf2675759db1bdd63b22c8477d
SHA1482e121182ee382ff16f3529ef323715f28eb16d
SHA256e9e9018c6c1cb7877d9d1992ad926f713ad27de8ea28d53ad8a7e04edf5164ee
SHA51230154e08ee9a1a67a57743e6fc86545b8a5a63746f934c5cd15b7d3f81a17cad0c46e615dca2f44366612baff8be7b077355dcc21b567f81fd83ee8dbf7eef4c
-
Filesize
1.2MB
MD5f9808ba3ad9444633605988e274de870
SHA15ca13b523103f14d25984b495d232083f15782e0
SHA256efa8316e7e7eb5369d52e63824a7a319a57df7d6b0c5c6a4d74d2217b790c269
SHA512ff1bba4148a1331c71f93ab41fc55b8025a4ce14a95fbbc7d86b0b9282996e10d35a28b7ff223c607780ae5d8cd79815d8c88f04a0701c5462b70ebf0f4f929e
-
Filesize
1.2MB
MD50b7244f68550b0fb3b80dc2c1e938bd1
SHA1c3711061bce9a993ffed10010a778d87d508bab4
SHA2564cf41dacdda5556cca7feb7224c7903e2724a53676cda37ff677f9ea24f3d0e1
SHA5126280b49931c45d18b243b521428fe31bb8167890e9f7a0b2223a533ee8e390eb3dc6d790d401e9a59f8de41f500281a59110ed06c90d9de66cb9f87ef4ef1ebd
-
Filesize
1.2MB
MD50f547298722254986d01a00bdff7d23e
SHA18ca9e314ad7e6ecbb0c9c2cda6a742c77aac79c9
SHA25654f4a36aa4bf827d19da02f7ab474f819feeb2522a30fc6dd7f01609d64c37cd
SHA51275c32139975ad79b8960f49f6206e41ef11783a11d908fe05f80bb07111c3e003cfb99c134007047630916baa94e4f89b82c9e025436fa8611f03d59077d7a00
-
Filesize
1.2MB
MD58a4317db13a9e62225ea6560f4b41a20
SHA1a6975683c75eed736e0defdd334a1c07ca1a0027
SHA25645724496ac0b9f67262321c08c5a07c881761495e4ad5855c0f30f63106e2241
SHA512e4b48a2ff01a16caccdcde582c3651c484b8a59f390763fafbd9fc8e2a43974f35ec998cff764f59cd36b05384236cfe6c650d88b25d90aa218cc538cb0b0181
-
Filesize
1.2MB
MD578f49909512e2ac1f5d9e4cc918f3d48
SHA133786aa553cebfa5ec2977cae5e9b2c4ab33f896
SHA2566f12113bf153f625ae077e10cd2da62d0ab767f4cc548ae92563f123d43849d4
SHA5123f1697b75a31bdf188a8b79c2309e299d75403dabbfe14c60efbdeca52ff1e1949b18b34ef36c317052cb6da18eebd0f34a3ad9801b4afdd9b5473627f94cd22
-
Filesize
1.2MB
MD50f8fc6cfa83ac8e41a08b02cca0b9669
SHA10fcb23cd26be613d0e623def299fcea5a4b770d9
SHA256ff64a9c296bf0417e3e42358241cc1c1d8d69f63b3fee59367a3e741c21c0e58
SHA512ef16dfdff7e98be4046e0ceb65e690b041a1e624c2b9cb835abba2ff9e73a06511fdb98fe8f7efe167c55dee845d52b1bc93f8a1175e1c9599b18ba4eb5f5d21
-
Filesize
1.2MB
MD5730ec56789148429086a4ec0777f751f
SHA1345ce7ef1b53b157b80996280d67f8dbc1db151f
SHA256a3f3b3062efeb7acecc7fa8171fede81859b7a36c8dd62f448d2edd93f34e6a8
SHA512c1055da7d206b6eba78d7a3d2ec75e18a9c2890ac877e98c7ef65259ee6f4319c5a57899d9df61337194f8cc42761feadeba3566b17791ea20338986674bfe1f
-
Filesize
1.2MB
MD59e002c4b918feaf4f902c715ca327c3e
SHA1e8106f421e6ae468ba63a8a5499fac8dc2a1006c
SHA2560efb619953877fd6e322b3098a55629c6369bc703d8181b84b553265bb2463f0
SHA512c8c7ecdbe05242bfb8d0713f68a4b14dddb6077e9b3a2267a787452dc1b02a151e8bef3d587dd0273171c2e9a058670daeb847771bd395f72dfa36d931e9551d
-
Filesize
1.2MB
MD586981bdca17c660b9fd281bfd54c9f1b
SHA13ae730f52f1bc1420a77801d617afae30970cc73
SHA256dc4006fdd37baa101e07b86cfb7db78afb17df85f43b908f3d1f8a8415738ff1
SHA512846b144a7a08bb3c23d0af35192c07fac1fcb79bbff7717eea1afd50524c511e21b4deaa85ecec2307af6dfa5b89e878d255efa7bdbaf0b4a01731d26a351779
-
Filesize
1.2MB
MD53807cbcb215afdaee0b0192f35309caa
SHA169c2cac24f3ec69d5afe5677fbe16f4f555d1317
SHA256942ed4d1746eb09fe18da4d24f6b9f7c991c3939059834f45dc6462a44a3856d
SHA512eeb1679e8daa378439e08c098c3d4a242441474683ac32b3ad89bf279bb08dd77306c5346cff6b064066b183515105af5cde1db8c3b73158bc8cff4e6ae57a53
-
Filesize
1.2MB
MD539e53e28997ca79f1a3ca89ee8578038
SHA132c507360ecf4dc9ea1b5c5a3b4f8e816d0f372a
SHA2562b8af7da1fb2b6a031052243e82c149bcfec57f4bc78928cb6032b4ce238a49e
SHA5129cd1e0457236a46ed418041f702520d6f7ab0d64e630fa38e4f0ac3391b8c7acd489b62f30ea31443fda32f27d409979b012e9cd96af68dcb2bacd33f6df6776
-
Filesize
1.2MB
MD56f58e64d9d1bfceb1b55ce73864b31ce
SHA1736d65fa6e9f27ccbc29999ed3f90bee5066a17b
SHA256093979cf042ef6a4e9254264b795d1b1f4f7707111b8563d5203c21bbc938457
SHA512867159e4d88b0af44d56fc7712bcdf1251e14bcca8d45a4c794ff834f48b1a5790ae4a41717bcbe10d2216d0820ad2d7079f5186edbea9a8fc8f7ad1486ab649
-
Filesize
1.2MB
MD5aca99300954c5a14ff475015686ba61d
SHA147bb6b5babdbb2e0cd56482621d9ae63273a35f7
SHA25626b30c934933e14cd68ae5d686c9f8f01cb22dbf0e3cc95e57a52fca70911d52
SHA51208109a9b6ef494f6b30d0a6e5c5c2b732b024adf0693c7b0d7fda8aeca57a5ae3ee74f14d659ab0f8e5c8ea1a5d7904ca8d291cb842cadbab763d0f51b3c0a04
-
Filesize
1.2MB
MD5b7a33dce2b42dcf15e7a4ff685de9d73
SHA17afc2d9bb299c7590fcbda16175579fab58753e3
SHA256e6661a863b5b01f38b8f8d204ccf5e0bfc390232fa14ae74dc562693f62888b5
SHA5129911bb5841c85cc1afa9b43ff29dda1a9582a744ee4b424fcf111563071ccc819d463f9dc6c6815d3b37eb3e62d3d9f73b416c7c9b7cd91adc64feb315d09c8a
-
Filesize
1.2MB
MD5bab627d8f72bb5bd2be5fb69c38a3d5f
SHA11a45dd4ae332a4ae56e2825d921730cab133aa48
SHA256c50193b278c1cb748c8db79457f74324a2102467daffbee22969ce0da0bff88f
SHA512c3d89ce75c89ed260c30fc68ed0e52d2a4b533af913c67449efc304f5f8a6e6a7bdd2da2d124d3fa2e70ccab809bca2cdf582b2d2f35479e4722d367e3ab0b12
-
Filesize
1.2MB
MD58b882ab1db61201444b6e4b24485769a
SHA133f9a79baffe757a2612f1b272d586c400f00030
SHA2567a9a4c79cb412bc2505accd32226dc194d747b3b07da04f8fe66edf36d983ab8
SHA512bc1d57e85e7acf86bbc9819d23f89fb2ce7af4b73bfb843ffbaceb8820ca9797bdbea10d40a623874c077605d82e5d4241cab01513311156404da2e67465cc38
-
Filesize
1.2MB
MD5da8df0539e87e4e123b78c643060f1ad
SHA129f92001897b244f3a9b12233770ab967ce5573c
SHA25603600e3f70e1dfd4423526fd14c841d5f5bc3180789d1f2bbbac0efb01d924e3
SHA5129ef75c2262ec426d33efd012038f45f44a29792a39f4e446d455bc3d7401ed78559e9ed82a5d957da6953d355af95b2e3feb7948bf92ca923c77eced0e38f4c7
-
Filesize
1.3MB
MD5af3301e7ab0751247eef434022419d7f
SHA11f68a67db959766635788dbf4d283b8a3209fdad
SHA256f14e20e25817bd86c2054909890492afae0bea41c925efdf1da038b1183bc819
SHA5124bad245f83ef392d09ec46b5530b0853137c22b974303502246d2071a3476a19d730eb667f43bf856c3ee3befa4d89f3f3325c51a205d812b4c7bee952128b88
-
Filesize
1.3MB
MD5e08dfa3aaf23512ee827941449370e4e
SHA19c08ee0e401c2b6f6e58e07a9594dea7bfdd133b
SHA2565c461d7805924a839e677b643ab82f59009369210824291c378f13e9572a0f3d
SHA512b68862971256a338acad60f0f46d19ac979426eeb31b2039a917e6b9973e91d450b55189f3113f6ed8fd4139e53c14093ce52d3d23f235a1bff2a8753bf87d54
-
Filesize
1.2MB
MD5ca46c57c5f1e1c08a13c4566e42a84ac
SHA15e029ca2a21597f6074bb3b035132b79a4547234
SHA256a0c407fa0e8890aa09e8cb75d3d0b3c1565fcb3f9cd441241980d4a6c55bd2cb
SHA512cdcf10730c6e1f5d686bb412a3297ac7474c9a5c8c70591e164bb4a8014d530c05120d2466ff6cd54104c9280f034744b38280530f19ed2d0019f51c24be10a6
-
Filesize
1.3MB
MD5bf36ac290fd5d851ae5ef2b53aa6642f
SHA116db4a0ef51687d804b53f251b534584a7d09500
SHA256de5c8ad3b7ecbb90286832a664f974dd9aabbba74b460e07f1ea4d40e7bcdb7a
SHA512637b59e6dbf11902d538f40b7806487e2cf904b76228b58c0a0af9818a9151eb171eecf207561228e59a18abae4ef1310d15d2cd623a237bc1606721de9fa7fe
-
Filesize
1.3MB
MD58760c98ee195ec07469d17270c611aea
SHA123dbd4e7eb3908d55f360b0dd2707c439cefa882
SHA2564398129ccb01fbeecc20693ef2ed276a80b52c7fdd83fdb2fb935ef6e271750b
SHA512316670b6fbe3e5bcf1120afda5334089267bee49ac9b0063d4ac3be4c2db0138cfc55ff93b94a19c49d05ab76d678b91038b254af18fa11d24b733543ee77c81