Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01/07/2024, 10:57
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-01_4e99db37ff0918b617c68e7686fbed42_ryuk.exe
Resource
win7-20240611-en
General
-
Target
2024-07-01_4e99db37ff0918b617c68e7686fbed42_ryuk.exe
-
Size
2.2MB
-
MD5
4e99db37ff0918b617c68e7686fbed42
-
SHA1
a5776d4717f2b240964a217e6f1319f3d72faba7
-
SHA256
b79b47ebd423ddcdab196ccca3aa359d10ae100a6bd8de69d5789d3ca93086a3
-
SHA512
133fbca1f6091db9734dd5b0ccd785cafb11fd11b1e15098328e255983cb9c0a648b68e0f9dcbc9bbaa82df5d776db7f4a644d9c008008c34a71a301218f38f5
-
SSDEEP
49152:7OOh3aN4kuLbegmtGPgDUYmvFur31yAipQCtXxc0H:LU4ku/ct5U7dG1yfpVBlH
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 2668 alg.exe 3268 DiagnosticsHub.StandardCollector.Service.exe 4168 fxssvc.exe 4812 elevation_service.exe 1448 elevation_service.exe 4032 maintenanceservice.exe 4680 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-07-01_4e99db37ff0918b617c68e7686fbed42_ryuk.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\8968a61ec8648821.bin alg.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-07-01_4e99db37ff0918b617c68e7686fbed42_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-07-01_4e99db37ff0918b617c68e7686fbed42_ryuk.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-07-01_4e99db37ff0918b617c68e7686fbed42_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-07-01_4e99db37ff0918b617c68e7686fbed42_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_96109\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log maintenanceservice.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7z.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7zG.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_96109\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe alg.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2024-07-01_4e99db37ff0918b617c68e7686fbed42_ryuk.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3268 DiagnosticsHub.StandardCollector.Service.exe 3268 DiagnosticsHub.StandardCollector.Service.exe 3268 DiagnosticsHub.StandardCollector.Service.exe 3268 DiagnosticsHub.StandardCollector.Service.exe 3268 DiagnosticsHub.StandardCollector.Service.exe 3268 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 660 Process not Found 660 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4304 2024-07-01_4e99db37ff0918b617c68e7686fbed42_ryuk.exe Token: SeAuditPrivilege 4168 fxssvc.exe Token: SeDebugPrivilege 2668 alg.exe Token: SeDebugPrivilege 2668 alg.exe Token: SeDebugPrivilege 2668 alg.exe Token: SeDebugPrivilege 3268 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-01_4e99db37ff0918b617c68e7686fbed42_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-01_4e99db37ff0918b617c68e7686fbed42_ryuk.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4304
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2668
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3268
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:4224
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4168
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4812
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1448
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4032
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4680
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD586c165b0a1a4c4b010c526d68e949f81
SHA1541bf3ab35fba9b550c004e2f72008fa5b5d83b9
SHA2563bac6c1baa795108b803a06c463a176bcbba95abe9ddd4eb20d258d9d919cad3
SHA512f244fee1e59e9fc38e2e439fc7028b6778956c0408d703315c777be26d903d0cf3e7c3308be24cc04308fe0c5a867a5794c734a3210327a95758fd2bab45a0d7
-
Filesize
1.7MB
MD5e24acdfc2fdcc386fc00ac8c7e32a129
SHA17db52c83f90884ca19a768b06ac31f5d4439bf2a
SHA2566f3eea8026bf450e713c522fa3731557c77913b5813b9ca3f7a1389c45f174dd
SHA5125206b977a018d1626670d5940c15b1e3c4e4750da3a43dfcf3ce83ec11165801d7570893c9b5acac42874bb2cd28ad3ea37579a2ddbc38f4854337b0dd648808
-
Filesize
2.0MB
MD574141d3721358d06ed0bbc9de09894d6
SHA1aff3979ab4746d70bd3cdfa97eb3e37cd418414c
SHA256be330a1077719d8e3ad8a2cbe82f3825debbca224256043b9d249ab12c682131
SHA5122588cd439a73d8e5bcea2ec4e102a6d9590c7144a4f3a1b8e4c87684729a43d2cb4de5c261d55a4ad5bbcf6b6062b9ab7f2699aeadf033eddcc41c9b19f82638
-
Filesize
1.5MB
MD507f8aa5c73898d89d8bbe8fd0711130f
SHA16d2b5c5a0c1e3119f9cebce960d0c6ff1176bc87
SHA256971ae884341b2991635a26295576b931bb5ca3256c12ef9f645a1cd96b4b7b1a
SHA512d5bdaa02a57bd99580be30441a8f34cab01e0a1e08ed302b1404590bdbc326f3debbda61cf345f580138ff5c6c195c49b5ced603616c49b3fa1b35a277e5f1e8
-
Filesize
1.2MB
MD513bb513ff615f783c2a94588e9332276
SHA18a1cab950d0d3be35e4968b3eb8635f2124017b2
SHA25626525730090682ab06754d259605149de479ede5333ff20d78714e3c2c9f89f9
SHA5125a3d5884068a8e68d96325cefa9de4df25dd9f5b8f85767468224414df5b6bac5307483968f89dbba6b5c54fb2797c766429d0fe95ff59ed2244a5d00d3d4355
-
Filesize
1.4MB
MD5b05d5fddb73b82123abf0ff44480a3f8
SHA1ac9cfcbafbd3478ebff7009bfb5760e614d64816
SHA2569d2b85fc1a830ba78e163f9dc264d7a198ee21d9263559c578712c5253a32799
SHA512c928dbeedd6dc34187c3d42567b3aa3e2851cbb6cac7693a1fd5eef1227186dc35de5dbb9659c965b1e5d88689af6e50e6702bfaf3a14c7b8a61e3273c47959f
-
Filesize
1.7MB
MD53d6b462e22e38ea805e39f31bad57f55
SHA1e8b1a4b5a6c5ee4842f0fa76f72771f748628957
SHA2565f0b6484e9754ad80d3d9e1ab1b7fa8b6a9cbf3a0aa39bd8a2bfe5ed112100ca
SHA512e88b5185f07bd26232ee6638cd596fbbacc9f6c7e23c6e6d33823da48b051ff96d2c72a7aa2a6a21dbcd9fec0bf6a2ff1e6e87a8c0d7edbcf6541cd61e45bcea
-
Filesize
4.6MB
MD56cab152058ee632fd11112c15da9cbb8
SHA1267b782d7db61af4280ba28ae45bc0fc70cbf6ca
SHA25609e2aa28b22e14665c8533d3b0e4ec4d91463d59a61763fb2ddac2576eb262f6
SHA5123d4e0ab769453c071d099d5ea8bf81ed3ace18e4c44247a2e63b655b461ce752e56188fef1c325b72cd2290d2e989f2f721a7b836ea6540355c031d9c11e8895
-
Filesize
1.8MB
MD524781acfb4abf43bc2d54e6bb3a963ed
SHA1a35af42ee1b72299efac985101d4d680091b9610
SHA2560b82d87f343199d4391a41ecdfec41369c036c776f0717bce791408076680be2
SHA5126d1b0c9db3a0670fd5dfa1479662aea5a96b7d5a7ffdb7b7b8e09a043896b9261ab45d5f8fd799975a967c45354411a276ab483fe36ae1797b99f45924e6a57e
-
Filesize
24.0MB
MD5dbdd10474bdde82544b692e4f32352a3
SHA157a1ca2a9aee157871229d67ad180875b5ff1830
SHA25677a96b86ee55766cf2fef94cb24bb1ac38de4b1ea3c1a3a6abc0a2d63b47120d
SHA5121e1c17590fa427fe0ae19363bb8c9cdfd81f03208fffe1f572c1cc5be705bc325cee1678b6bba2662e1c38b7993d0830ffade22d4205f36aeaf231cd7e3f3459
-
Filesize
2.7MB
MD5b1665c96f68187963b6413934ec6ab08
SHA18112573cbde6bda5460125dc8ff5376b7b26f3fe
SHA2569ef0be4e103e5db05acffde06b6654f7a0c950a3076a8eb43307d5b7980e72d7
SHA512b56e61f6611d5342574332433f25bd5221b5c22965c306bd43b07e6dfabefc8a956b68a53dcbfd0aa5a9177cb8badd175b53384830dc1abe79c37b4a027c0e15
-
Filesize
1.1MB
MD5008ee0c30d0ea627d135ab99d35da812
SHA17e8b90bf4e65266ce8b76f92fa2acb218246e84f
SHA256fc0961f3b6acdbc917f035ac7d546a957445f7875a90e9c32b88f56d4a974c42
SHA512cd477a735dfbc610a443bace41cf8cf3ebf7b4fb70d2ec6a525d88bd134db05d9804c8b132b868e68f8b79086ec62f68904b0271b64474bb8c2863974beb8b01
-
Filesize
1.7MB
MD55f1e09c1310bf53b57b43f12260ee7b5
SHA196e392ead47e384d81a3e14ab607ecf99934721a
SHA256941a74be91cb818c12a2dea764b7dad5c60f8a9026db0a04ec30d80102d87088
SHA512cba71ee7ebe7074c14bd63e30ae0fd72c8c5c6848e436a2653cdd03a2cbe6cd598f0f8326e6de3e7a8f5ca012068a13f8492776b2b7d270c3b6ef138473743f0
-
Filesize
1.5MB
MD5962ae2a3c1e097144dfd47091819d2ed
SHA14182b83c7894f9f0de5e6b5d1275a8dfb39716f5
SHA2566a5ce21b93de59028649990cef7017f0b0ac341cc12bf79484b64c104177eac8
SHA51213543eb7245289e68839fada86b86d4191b31e5b58cd3dd3a6c729a0e38446731354a76aac3d7b8799447b506fe87df26ff6da7180cf87d33066f2bda9d22357
-
Filesize
5.4MB
MD5296bc805b006de0be5a8de951f4caccb
SHA104d0e52fbf6971c097f3b377e13abffd611bfefc
SHA2560012bda947518a722ee0ae8d2d305c640229873db081c50cf9724ccf66322637
SHA512bf65b3612409b366213fe78bbf155ef51b881595ff9bf8c1c57814c1e34624b6bd5430c8c2b964c2591bf77b29fe44284a882e55ce78aba84803c287daeb9543
-
Filesize
5.4MB
MD535d1f28622c7a4828660ec197ce9f027
SHA1741ccf1a3acee933cbfd1042af9eb9e1df79485e
SHA256a4d2ecb88bf4ac78d641ae07b6a49761e139b22eec0fda7a2c0e3c2ab44ddbf8
SHA512faceacd150a5e7372846401dc86bc009f3439ad52977383003090bebe66b663ca5867c8ddfa900f5100606a8a25f7e0eb9d972a6531f131c0a482a83ffd22a32
-
Filesize
2.0MB
MD5ef29425cb1b61bab1cf7765ab988b5f3
SHA1ee65e42becb64b400b741f5b7fd0b0bb3cbec512
SHA256688f3b47fd0af25593bd7d57f9452452fc8e7a1e75ead7553bc01781a7bf9111
SHA512de2f8e539d95f10a1e9d65b001cb067b02620f39370600836fc613cb0cde78e34b470cece04ce2a9b4528a2a98dd70de602b3a6d52e4bb53b5a49125622d4451
-
Filesize
2.2MB
MD5c4f6041da4f7337ffb1b7459b622dfa2
SHA17605ba7042b0a6cd4072f6e2690a617ed13f8f43
SHA256de61f0edcbc11a6e1d7ee77046b83a711e1222c2472a0d3c1cfe3cd2c6b6c398
SHA512d937daee6faa52b08eb3d49b2096a71b388f192c39ee0a87bf0384b86b7dd10b72e633bd30525791d71eaac87605aebe34589df7211908e1a7ca3d04aa333d66
-
Filesize
1.8MB
MD5f7b1ab1da276d1053588d75a41ea5dd8
SHA1748eb71e8e89ec7cae632cd3b88dfca8b4e8e0f4
SHA256b1163994d2d52678109d7489c015d5b09e7790ea04299259fdb7aa5cb41a6e4d
SHA5129c46c7fc58be5f8af583bdd0a98e68f4e8947ae89c5d517dd121be532e72c5ef7b003398e7871314bcefab9f9509af2d8e1aeccc6371b70067c16db38fcc47ef
-
Filesize
1.7MB
MD567b026e8155bc4c2ec2e94210d59ca6f
SHA121b90a516b0d582a055e28f6edce95cdfd887691
SHA25623f9ad7e1a0dc00f083c316546a1f92951dd76cc6bf5cfdeee8475d92d613eef
SHA51224afbdfcd06e720018213b05b82123664e2dda7a6c794099b15e162bab5f045b1c481377ccc79b3796c381aff6c5b80a3a6c99313e20d3e764350cbe8fde4474
-
Filesize
1.4MB
MD5b4457cc1266bf0754737f63077a2fd8e
SHA199e02f6a4a866c16d0218edfc42aed27d5519b22
SHA256b336d4207bfafd4ce65f0f9e0743d27357c0410d478352de6d2b5837cefeb9c6
SHA51255e126c014ff6f39d4e333a981af1668e933b649996c26b69fa2cff900a0156cc14b153fd5ec4a1cd29b61ba7add0271c3244f96e5e7841612fd749420c7d22f
-
Filesize
1.4MB
MD53eb963fe8c2fdbe7ce9d482355625891
SHA1fdf3e1ac2785d66c4e3b937468ec2dd931950a29
SHA2567b3b697c6f642cd7859b2c73c73e5863d713a29a8627e75e6d5d0aebea4e1778
SHA5128c3a759b0347591b5fcb24e9c9de9254f9d449ede56eeb64d1d9b6166faeb12482e0525f38ea9afb29723f8c06f032cca8cc8749fbbcad61e73de743a6214c5d
-
Filesize
1.4MB
MD577b7915dc748388b2d6a4fe37bbbd984
SHA1ca3ffc192febc37d7670e6e25693a08d0b99d95a
SHA256fea5d89561ad73f5a9b02e6ef76c64f354c6083d1e68af4adfbd0b50ceb40260
SHA512ef6daa60af5473bdc1ca4ff5e6c5e88d70c88e7bd0887887832483771278f82afd907dcba5f0bfefc8d13de35f035b87e5282318be46ad128eecccee07d01a8d
-
Filesize
1.5MB
MD57ee986eff937198251163c5cd32cb417
SHA1acd4896a40a37c2a7de4581b6af8c569c68086c2
SHA256824b894e504772fa5eb021bed6f33c5617a3b82a26703d0e988a58575e532c92
SHA512e0cfb2604699cbb7a19fbe3700db7fee0bb51bcb85b6a4ab3c4d37cc0c2d30379bb7b82901fbe60ccdd7b8cbcceb1ac1ae68ff14fa0280547d416dad15fdb126
-
Filesize
1.4MB
MD53d60b2edb947b247f76650d4ed36e56b
SHA1a7e8173b579c87548beb33886a95def08755d0e2
SHA256e2993e954630380486f400df97c7a3384052037cd1709006bbb23782c1f8388b
SHA512736baef015d2cbdd506995c9f2444e19514544be9be7ab2652ee114341b02e24df61c72917a897aac1f0a5bcbe571d14015fd65aec8a92562196309150296852
-
Filesize
1.4MB
MD506dc0165a24db31820ef01034dba86ef
SHA1286f7ca3f1caee3e329cf11467da53bedf450ed1
SHA2565eb127fd0481b4fa6ca8a0384ab072e318deab31869e2e6707f8d2cc2005f2c3
SHA512d3b3d301945b0ef458da91545d60f4cb1da14f1fa7527f00ef5d6332632f622ed3bf5e92418a25f5d816b6ba0048e37c713caa94dead4d0f9532759797ca9e11
-
Filesize
1.4MB
MD538de83eb3a1f4fb6fd932568162c0bd0
SHA1f8730dfd472ca1c7b806b3cf99f2bcf7367a8890
SHA256cfa2e62c0c936da6a8332f89a4328ee86abdf979d6e8a7f3a0500c9465e6b4a2
SHA5123d4aaf49241dfa7e528c1dd91246a9f8ab1b67810d30f013b03297566785d2342226577797ab958907ca952aff32ae92d2d37b9440e42e1a007c284cda7312d2
-
Filesize
1.7MB
MD59c5c7d1b4c4a8ca66d356dcf020286f2
SHA15fb86dfdf0d5661c3a64f9a4d738cb3cc706cdda
SHA2569b7300ce837c508b6a9ff9e52b53b1c6ba41e7fe82ca6abcd10bd795c9c58400
SHA512a28bea7549e8fdfc64d6a2e518a904a980d176f8275eb386b66505abf89ec159767dc03883571c25a680a7d6b522756c2ce68a82d0f9c0810abf4fbf12030b09
-
Filesize
1.4MB
MD54c838abecbd7b7f133722589988bf143
SHA1ea2a9bc6eeedbd5d121e44b2f7e2bb6eaee15da1
SHA25659e5d84ae06ef328245c91133b59591b0cfcd7709a48a18c4a5be542af05f95f
SHA5129544c1d79b01dbda0ae857220f758e8800427c461143f14496bb64474b0a9f24231bff4f5627002815ec71813320088eb071ef3d050f0f46aa8f58cfdf6b6c65
-
Filesize
1.4MB
MD54df2af3f8cf1fcbe74055d3c63e7888a
SHA116ab16487761f9d22e7a66a0a83f87ff43295197
SHA2568fd743584b7cbf56bea382cda6b010dbb9adeb64f8ab17f4dd5b3643b2c6ba07
SHA51297067374bc4d1e253ac8aa4dc17330685e0796137ca54a936ea5cbd4649bdb4bce11b968e063c4b7668a68316516eb3da06ed361ed3544ec42447e4776d23354
-
Filesize
1.6MB
MD52a7eea9563e9bd0e88ff3d9a15f7b445
SHA1429a46de1888d6296e53c3e22f784664824073a5
SHA2563535720b7e5074ed2ee793415369133e477f4a0b3a084a314985d11b92635fd5
SHA512b17ba9e84b5200ca9a565a38311d6f5a9dfb6ec289024cdc4e70e2f6694dd452500cbf12a7a708e829e1c9acc5cc83a0a3db36abf72db306ec572f545696e407
-
Filesize
1.4MB
MD54a934481afce42ce5c7f6b8eecc48803
SHA1ec023e30f94753c8a71ab55ba44e8355c0872ece
SHA256d6b023e0c52edf1038ae153d29185bd2b751ce05607ce70c09c0a2acab77a970
SHA5129397712c5cb8daf3f7cad1c3b4310ae2d235af67857b783671d15bf72333c09f7a15bc48eaec04e5e2278cf1bf93ec6b89bfda633a8800b05178137c1402eb09
-
Filesize
1.4MB
MD536488d0edafc941b9e31af645b851bfa
SHA151e8d987181897a67d3d7544af1673e9af0d2046
SHA256f8586750b7f1a3173955d8746a982c211cc36256d435284f4f96a1fa72738bb9
SHA512c475c3adc94c3fadf6c25a64f3a9753ddbfc38f136464b0d93d99d05419877bc5e64c17ba379de833e6405e6ff47463284a499204df92c2d3d49a88c5b5c08d8
-
Filesize
1.6MB
MD5f12921752ed57f6fb227056140966b14
SHA1c44ba3177a499a599924500b769822770252bb3f
SHA2566f953c96fe1a6f8bef514a8cd905b64f47702618538af73490bfe0ca3a5f6888
SHA512d15695380fe3c4e2a4aa2219d52b87a82cbf958ed3e969426c543538db56dd8fc1a3565130d2ce356b6f856eaaa2adb5360f8f7146b9d85d5ad3906ad737f24f
-
Filesize
1.7MB
MD59bcad42680632244acb59a254a4fb8a8
SHA177e4f6acb81fce4499733fc02c1b88457d73eeec
SHA2563cfbcd2a9de01838a7b7a8b167d78707efdf7c271a5be01120393279d941d02a
SHA512dfe354a8f56827f065fcbc4614ea1ff676f49b1e2ef9de541d8ddf3e8341e772cd6c67c172b9bb51292730ce0d4fafeec647a0793ed485c3f4bdc4ea90c95578
-
Filesize
1.9MB
MD53a043678c8c174e0e3b0eb35b841e589
SHA15b389e50a728e47010ce3252eb6e3013076bf4bc
SHA25672bd9bb9e8ed208a2f01691b4d9ae2fdc4f83a03a5bb40c65bf96896d26a673e
SHA512468b28e1e9597f480d6603001e209d45bbfe610f21491ee6c46b039da19b92d78f6f311f74d6002b6a08642e5cc6b66e8e2c1f2908053a1decb1ad10ebe3de4f
-
Filesize
1.4MB
MD5460784787bfc9c4e3b13b0231a763721
SHA1c335fbe7ca5dfc08452136e3ca5c6de872773fca
SHA2569f0ca73cf444542ffdd705f25636363d03c18ae4e3e39d9003cfddf4dac0f46e
SHA512c9c498622589c1f2534ee9622a66f5596401cfa125a308b4e618658bbf4e7196cf4fd1c227879d7e2aaa978f644498050111a7e214ac71f638b2db398d434f45
-
Filesize
1.4MB
MD566793835ba75d3256b47297588c19bb0
SHA1d831cfa3ea8be75270c0bb1819a0986ff511caaf
SHA256b5df12e0c71154e7e0034e638dca02f2ab13998da4ba9c6b2da570fa138fe458
SHA5124b25a352df5e4fc61cb49d5151616af7569c9743216936d01f148a70c821ec84e78dfc841d47e9412817f7ae9dfc9f6c6e13bedd711483ff05a76605c611daac
-
Filesize
1.4MB
MD58f41e7603e6404ca53e9bd555e170dfd
SHA1463d3ed63e7f21583fd6cd5f2584f590fce77933
SHA256f2b28f7603ce26be0055516b7f59213e6766038a4c3174aa42fe60fe5b5e9be9
SHA512cbb71bc117a80a2bc6c014431799976a241c0e58c7fd1fd12e805e32866e0741cb8893ee719c25c32a86ed06bb54e286799ab8aa787b73522ba3c2059926b341
-
Filesize
1.4MB
MD5be4e2b9af50ec592beb554de3f8adff1
SHA15cd708ccbda264a1fd3c50bbae3a75dfd3c426a4
SHA256c8e6dbe5aa9143d49afae4c16bcb1ff2632fa71696fc4793f400b0515dce68ea
SHA512f350ba948e13da212956f36037982e317f27e35c3e9c6687228c8e38619d876a56cedf97c8c4a96a2a33a577087842749e8a28d44b3509129fda6bc440417cc0
-
Filesize
1.4MB
MD57012628909ec5d162f084c4b3c34f9bb
SHA19de2a21d275e97b91eb126f2012d13444b53b075
SHA256e1e59a65fa53b8c70859dd4437812e0fd358a51df417aa305ea7c67f029e557a
SHA5129bb002f0f315babdfbceb0b069fb1abbe085616e048be4f8e92afb45283750c93924e1e6835feed1155e26b958d2bf12df24cbfb66975f2052e1b201ad1f4384
-
Filesize
1.4MB
MD531b7bb445b592bd8676029835caa380b
SHA1281122c5df7332c9c10c6d94643b721849c94486
SHA2567215744d2e5dd0c98cbce8a548b88b8e6bb1c00ff107ab6cc26eb33217447fca
SHA5128e86f4ab9c4f986997bc75e522f30b340590f0e8d067008e8c724b0ac7659129a5e696ba86d1f3bb6c1628aa240ffc56d804c3ba157a630367345197e047935f
-
Filesize
1.4MB
MD5371f335647922250597d345df32003dc
SHA10d9d0ecb5cef33e0266fb8f073f4d7997e099f63
SHA2563640da165c36c525d50ff70c6e26c06bf62628ec13802338d808fe11aff6412c
SHA512e82acf650ac2f94aacdee330610a4a4d2166eb10c97e22e87a5bc6056b2cd0ff16fcf31e7ae6d6677fbf95544b68ad33f5739f2f33a24d9f8ada554eb103d600
-
Filesize
1.4MB
MD56e622cf65915639bc18af9b0f59e86a1
SHA1c474d8791b50cf0b197c05a090bfdd170d49c959
SHA2568bde5cee6e955207f9df5293f2e6ae42ed6e5433a59a1791d9ea23c8366a73f5
SHA5127cec668f0e215ec00bf9174f9d082f6ce77f0ebf009b315a4e389a0d3d64da89fb4e40a9f705f160f4fbae4448678adb7705d8ab57de0f4c39d18acfe7c23352
-
Filesize
1.4MB
MD512a77b937e8c0431d0333015a50553fc
SHA11a412e018d168b0caf0707b4b83745766e623e00
SHA256aee7b405a5f1a24f47f889db545c7264e909252fb6b30302e0a0e337df8b9741
SHA51233ee420243755c5e8aea53d77886f888a7428b5e9170798cd78d4115e111c72f7e7125be35e843e2f22c44ea08729f726f637c99417b5fde327baf5970448f53
-
Filesize
1.4MB
MD5e5f7a422a9d2f0340cd240e56fb599e3
SHA10daf861f93436905d2b1f452183d816beb9b35af
SHA25673d6c6039c9eebf1b24321de7bf9166709986f89bd3d44a12103f06e0df84494
SHA512a389b941ee0dce9ba10b1d7654fc7db17d28b9152d041d68b8ef250d0ad0ff708ba106f5cd33ed0463cb84cea868e256c3e1cf7970632f031e2e93d1dd188032
-
Filesize
1.4MB
MD5a9a1cc310fbf73156a3ef3a954d4ee7d
SHA19a2a4cd497b439b104f304c4acbd409e129064f9
SHA2564e189fa9c8780f1dbfe012b1eabd3a4c12b38327d9bcd0b4c6cfe78a898fdaa2
SHA512b81004ad129c40fcf6aa6327369f09c32244b0cb0a0c8e59a529b7a3d97d3692576051da8787fe4739e4f9c05f8e4c31924a4e12bdb50701fa620dd9279f47ea
-
Filesize
1.4MB
MD5cb61dcbcae38fb0af58637288980e4a3
SHA156c03b407637cbdb7b379d4ef68a59ac1f8f24ca
SHA256aef7d9b6b82a687e22bb6c1a5571eed610a073231b568e133ede9b7910feb975
SHA512422563d7a2ec9d4603579d849940488915a27b22ec8212d9f24c81673f7fd46df9eb2c67139c0a42c4ee2e0c1cbc63bbe1a3a82558476c58cfa83cc6c948c11d
-
Filesize
1.4MB
MD5b88ba601e562be9593e7b9add0cc7a3b
SHA1b071cc018eb4c3d719805129b8f5619c7e383bfb
SHA256e86653a99210fa3ee38cae8fb5bf3ec0e52788eaacf83ea6263410dc24920da3
SHA51287a0d0b5e052546b9b3f2b2bfc28af504e7efc47d71e1d1f8c23db5b02e8912e4e5979639ffa293a315811314ae9d3e187bae76f8ef20ce36f32b52b59bafc8d
-
Filesize
1.4MB
MD5d7871b0a413fc8dc5b8dd00128047651
SHA1094969036765ac4e2cd17aa714f4c6d6918fca8a
SHA2565090daa365661f7a19c189542176bb5a29dbe39aebea02ab868d597176c66487
SHA512e83f5641d55bed7c12e22dbb84bee218b1ded17c496d546d52fb8ba7f222237b7479e0be9641088f8071a51b2446d85a70045553819dad1fc0f851381198c4ca
-
Filesize
1.4MB
MD5e1af09cbdbc3a07b4659dc6d7d4600b8
SHA170340c4d926cff48bc4b4f7a1dc9325f0dbae44b
SHA25611cf70876300634e2d10d317ea2ff131b1f3039845b53b09c724ba0225756340
SHA51272ea3d1e98e7c17145b367b916993cad62b3d0ce408ac724c4b0a35d88195e37409e383c4e2b5bd7d3186d52627938c73c75c6ba31e285a3ecfd426a5c077589
-
Filesize
1.4MB
MD5446f29b2e1975e086f228d4ad8c06e6e
SHA14a00727687153184eb9cc73114bd560acfbd8840
SHA256e65b65e7393918c6add044ed682f4d5ee5162a2707860dc19d2c86e421e43ab5
SHA51288e8edb5c71cea1bc4ff386a254b8476a6ed8860b5aa2d924080afabc517ec43c56e899a09b8f70f427d4be8715dda62f34ddd41a25e14443cebc96251da9c84
-
Filesize
1.4MB
MD5c86dc75a9ccd5f885d6d14ce7822e821
SHA1ea1170ecd157770dc90e56a218bb8cf725b66504
SHA2569ba1166d9ea15eaa32eece48924e5c02dd0e680ca16dc322157071d3012d3f10
SHA512fd6488549a65bd53784394eae04ecd3189cd85669236fc71d25c0222512c76a7f7600183d9b04e6d8e90bcaf9e3c80e149d666929bbaab87fe27c7eb7134307c
-
Filesize
1.4MB
MD5479de12fc2e6827349741cf597cdb973
SHA12bcc8d728fd1c53aa16231aadef3c217d5743a08
SHA25685a8ba55526ef25465b5b522c4a2ba1e08c70514e67f169fa78505cdf8869c67
SHA5126956ec071439ca4dfffaa2d91de349fe584cc2e49757fccdd2c47c8d9a063e67c0a45380ae14e4bc7c989928652f5182cf05f5051b1d6a19e283c98120c7890b
-
Filesize
1.4MB
MD5f98868e74342f95c50327d49d6b319ba
SHA1ff6e188e1fa4d332479ac5ab87dfedbd9d01f91a
SHA25643c48a1a0cec731db6cd2a3dc791a2c4f6d4ef3d31ef0dec34a39a7a6e19559d
SHA5128a0df4a2d501d91119927d16ec28f6f2656624c8f98345bec06690460e01b5c89b5f3946fb1e52e120944296bd290f9fe8021411d83778607b41746b18412e1a
-
Filesize
1.4MB
MD53fb261febd95f214f73a96163c7cbf71
SHA17985871532440db121ae31dfbfc455d584bd9b76
SHA256e261f8cc45aeffc7e9cc0869e3aa7d7096b872f7c209ad3c79ad682ffef5b73a
SHA51250a45ee0d122b19184c9ecda9b1501948fb327282f541a2e86658d015ce9f6dcfd4858fdee220a4694650ba760c051699aeb3c43a13edf461d1fb0931638857d
-
Filesize
1.4MB
MD5942c2781579a3045d51dc6b0f6bc3aae
SHA1189641667a1cd0770b9134c57ac6150de306045f
SHA256bfe34c31046041fdaa405e24f093345c9e9b14274c0998c2b64326272fcaee63
SHA5129cf5d9b7bb4a5d03d4c148e8e643d72556f6255559390fd68b9f0f6f9960ae920b73d96b28a101aec316ddaa0d0445f5808fd0b8875f783027c5302c44ac4020
-
Filesize
1.6MB
MD5436bfe867f10d01956d5adde27575137
SHA16108ff485a82f271e9b1e2c78320d6abffe950b0
SHA256c55639440a976d3ce25e7dd7181e5e00a2faa4621185bb5e422b1c5f1ecb197d
SHA512a6f6e1e04342e938c2536ee59203d2af486ca6fa21f34272ea9d6c955dd819b0722ef69cc4a49e874a46ccc86bd61265f690855bc079e00fd33b0e71570ddf7b
-
Filesize
1.5MB
MD53866bf39720ec1600807ca5dd65223ec
SHA1a237953e4791a79b5abf7abb060322c23e0a0e46
SHA25613d09b141455df329515bc972bf327ee6052b554e6c0bf599b1e6878c7781237
SHA512525bd0b0dcd6c42d25e5fa681ab16ccf3ab60573fdffca4afa0b5840656b22cc4f0ee6564c374a0b3b4f46c22fa75a87c76f0dd7e0619c6205a84f4cfb20e72c
-
Filesize
1.2MB
MD5aa8ae1e491d469ed2368d558c7aeb676
SHA1a189d29be6a27cdf603983c6269fa78b5db189fc
SHA2569847d73af3036c0a2d18acfa5f5034dc98bc71b62c64418ea547447a382e6ef7
SHA51247123a4f5e61723afd9ba73d173ba194dc873eff2700ebafbb0fd80583eb327de6a5ee12faab3061686d919106e9a460f18ef1bcfabf31e3cf7e27b34583f828
-
Filesize
1.5MB
MD509e450ef09f9514ae337ad1a4f56a5aa
SHA11597527c23025d13dd068bead4df4b4483033070
SHA25662c2c5104857395cbde72a9995ad2dba7c8820d8250dfab175fa149f911cd801
SHA51270dcf89a78405fbcfc762f661ce704d94e28186b644687ffc46f9ef7cddd6b9bd62a1b6c5f1cebe9297c8b01101f549d7dd2c16ea6a97779ded98e58b9d55f78
-
Filesize
1.3MB
MD599c6089fdd15b949476dd80c467897c6
SHA17962b169b8463fafdadcbd99db3dc9aa3aab61da
SHA25690a6815954569127c9bd7308be96561069065ce1ea797b8ffbe84232cd93cd4b
SHA512420f0c147bec3d65f7752c0d0bc325738a86c641b17e193d2c43140c92ac7dd7a6aab84d904f153105efc4fcf6cfeb29789c0f81a88b07b7368a93630883be2c