Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
05-07-2024 17:33
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-05_86ac81ae635beaa967d7a54e75c97f19_ryuk.exe
Resource
win7-20240704-en
General
-
Target
2024-07-05_86ac81ae635beaa967d7a54e75c97f19_ryuk.exe
-
Size
2.2MB
-
MD5
86ac81ae635beaa967d7a54e75c97f19
-
SHA1
6659ea8a1be67618ebde8c5a31d7a08c6848b05d
-
SHA256
5545e1f75a6b313606896858852ccc0fca97ad0dac1bb0d0124d1b8a9a057438
-
SHA512
d34f608130d5dd58252593a28fe8f899eb36008aac3716083f67f756412efabfe7ba8f3bcacccf0216e0531d0a355e9556be7ac145da38f526da1bfac1556cd3
-
SSDEEP
24576:eOObVw4TaN1wdFukCba4oXtgLhU3wEdmh58NsqjnhMgeiCl7G0nehbGZpbD:eOOh3aN4FuLbegmtGmDmg27RnWGj
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 2840 alg.exe 4708 DiagnosticsHub.StandardCollector.Service.exe 1516 fxssvc.exe 2684 elevation_service.exe 1408 elevation_service.exe 4352 maintenanceservice.exe 2932 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 11 IoCs
description ioc Process File opened for modification C:\Windows\system32\fxssvc.exe 2024-07-05_86ac81ae635beaa967d7a54e75c97f19_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-07-05_86ac81ae635beaa967d7a54e75c97f19_ryuk.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\5167da6899ad3704.bin alg.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-07-05_86ac81ae635beaa967d7a54e75c97f19_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-07-05_86ac81ae635beaa967d7a54e75c97f19_ryuk.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-07-05_86ac81ae635beaa967d7a54e75c97f19_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\dotnet\dotnet.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_109015\javaw.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe alg.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{CF62F5D9-6052-41C2-9FF7-4E6A3DAC056D}\chrome_installer.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{CF62F5D9-6052-41C2-9FF7-4E6A3DAC056D}\chrome_installer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe alg.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4708 DiagnosticsHub.StandardCollector.Service.exe 4708 DiagnosticsHub.StandardCollector.Service.exe 4708 DiagnosticsHub.StandardCollector.Service.exe 4708 DiagnosticsHub.StandardCollector.Service.exe 4708 DiagnosticsHub.StandardCollector.Service.exe 4708 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 664 Process not Found 664 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2432 2024-07-05_86ac81ae635beaa967d7a54e75c97f19_ryuk.exe Token: SeAuditPrivilege 1516 fxssvc.exe Token: SeDebugPrivilege 2840 alg.exe Token: SeDebugPrivilege 2840 alg.exe Token: SeDebugPrivilege 2840 alg.exe Token: SeDebugPrivilege 4708 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-05_86ac81ae635beaa967d7a54e75c97f19_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-05_86ac81ae635beaa967d7a54e75c97f19_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2432
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2840
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4708
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:3612
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1516
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2684
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1408
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4352
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2932
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5e1cf9fa25b777dac12e50066686e270a
SHA1f0016d3c5a4ef873b54b8806980dc85675b7d96a
SHA256f7c127c1d62ec2a151bdc84f753a71516bbe8999a1132da9d8a263ecad055f70
SHA512c7aead43789ea8bf5f62f51fc911e6215f091fb164630388759dcbb638650644b8afd27adb3643b4f8cc1fb77d53356893028d17665865c726a5a45186d491ef
-
Filesize
1.4MB
MD5b8d98abd324c758b53ce13e240ad57ab
SHA149210d604bdaf31c18b838066d0a0918ef63f821
SHA256f673abaacda06a83dfc326af914adde07b23fcb3974fb7d180afaeae77d869a2
SHA5124a91bdfd024c312503a40abd4c3cfbf0fb3227bfbdb4fe3d1bc1a887881e40140b738c404148994f2b437e6ca710c7aa56bdfd4ebe5017216cf3d82f7e49ee48
-
Filesize
1.7MB
MD5880ad7afec99abd8be7f5c6539b1c772
SHA13a8e186385f9879b3ea444e140f44b680c2d0b40
SHA256ad42e5e20e944194bb67e5e0e9c47ce32fdf7d9b4e5dcd88dd743cd5e093782b
SHA512817c0a11ed2b43d5d416ff974a2b812b0cd2de7364a74b95afa742ec5c0c9e55a8d3db8a628829edc676b26aa9cbc500134b053068eaf690186ae3ae79a7b6eb
-
Filesize
1.5MB
MD55ab6aa01ba8237e8931beaf65ac98831
SHA147758c97c242df49ad1204e62531b35affe5511f
SHA256284466373d3b22d76842a0bb97d53610e91c0655257d0df4d6ffa1ecae1bfd92
SHA5128bf5c7d05a2f37f8bd67b71f9e1d0286c853aa07f741b8a422eca9fd30a9d83d8b255d30c629e9aef9e3abf145fa8fcdd203d91300dce88604b0620d7eb3fa09
-
Filesize
1.2MB
MD52c67ae6c62984499b583dedb864e9678
SHA1ff1b74b0750991a486eb07864bf4181ac4ca7bb0
SHA256b3c639fe6d0a1dd53dd718b2a70949af105214be0635a6a85f72b8fb8ca705a8
SHA5124232bde5f63b44b897672c4be58faf589e945ac69c29be97df00ee7cec259966ebb8e874c30a2583d68a1fa73ae879347af0feaebe492bca635ac4fa2e218a7e
-
Filesize
1.2MB
MD50b3c36f7a38feac3c0de0de3914480ba
SHA172ee4708f3485f6022b35a07e513572305699f91
SHA256198006c005332cd9be81d99da945e3a218e50803070c93aca9a399c92a165530
SHA512831cb98960f5fce2e0a09e970c25d42991400cf9d3a75b7fd08c9073974552e7e909f9c6733c084033a8fb78c1587cfbeeaf7790ca761a6ba5fe4559f09d311f
-
Filesize
1.4MB
MD55f5f96fa7b91e5f8d9df3c3543af0d8b
SHA1ac76395f1e1de18a01cd8e65270e7950714a2f61
SHA256e530c9273bd3849157e4de459c2ad4550ac3d18b5865d6aee340fdce9fd03d8d
SHA51241ca4ea945e84e28fed8a4709b836b5390b1827f62a6adadf6d9df7c5e5d14530d8ab703428fc8dd60d2854badf374717c152905e9e41a56202a31f716c4440a
-
Filesize
4.6MB
MD585d68e5db7bd7cdb4a0591507336b477
SHA166fbc92c8fa7ab569a9383d51f079b9ff0845bf0
SHA256e0e77e4a4886ad4eb69274b6897037396c1ec569228248037c827341ac5d6c9e
SHA512cf125d5b31b313c66e105de3ab0093a287a63b6af685560ea7ce30203a7520aa3855a3011995397ef032d0c78b84a2dd4e95b5778f388e84f2257506ddbd87fc
-
Filesize
1.5MB
MD5716023ee0571d080aa906cede6f814dd
SHA1b10b9332257770403a935df1c146577dc09d3f4c
SHA256347604663500904425b7289369f94d8869bef2d5164f43000b23352176b0f933
SHA5123799a69aa64a47d72bfad7b5ee9e35bfb0661f6b0f531173009773d54ae70e2ef2c231eac7381fd231406e3bfa1c8af90795ac2cf772fe842432cb05ca7cc351
-
Filesize
24.0MB
MD508624be90daf18a42d6b25809858b136
SHA1741828dcdd3376c4a4a8ba61eaaf95804739d618
SHA256d92e3b36f0e05fa38f54826b634d45ea05830cae9e681ebd30eb0cca85fd48af
SHA5127a64d0162f7e3fbd74bf33b37d938d9f6df9db671760fd53e297034a5eb08e8ac17271560be68413e48b51da57e508f2d0f8aaf546065675a3fe48c161153d7b
-
Filesize
2.7MB
MD5e7cb2611893e0d7ce85347ec03eebe89
SHA1def702b067b9f7acddaac8d84e243ae8c68a64a5
SHA256cbc8e7f27ba82553afe332ddb760e0982cfc5461bc48db8a2fc233f2649c2614
SHA5126508807be328c267e9f16702cadd2ee419530d55e4d7683ff2101caf23ff47c328b896b544f1ef77f32652cd027554f2bfae406a9285031a5a97a94b1e5855a2
-
Filesize
1.1MB
MD522bcdfc6b0698b1e620b822e9809f91e
SHA15b726af65873531e44eff80a54fecf3bdf62101d
SHA2564cbb8d7de1462fa814aa19aabd2f0c20ef1926ed612eeba43e5dd5785853adce
SHA51277ad7fbd899bde5d768e31b933b550dc682a707024ed2e2a0182f2230b0e01e3d1a8050bb72bb27ba53c93792008bc6823be255e9971904b646fa0c845326a01
-
Filesize
1.4MB
MD5215c492c6e37e99a70f612b3d9e7a16f
SHA1d4b318991398af95e76bb79134bd5022ced8b677
SHA2564cd8627832291ca4cd254c6a1263482f9ea3bd530d5a27d3c994d1f79c207c5d
SHA51233db474e3b60e6f9b6b6199725c47f8728848ab4651bdff9c6d194d739e61463a0cd8658d9d043dcadcfbf526df3e2caa7a6d7e448e5b2f191183b2932996568
-
Filesize
1.3MB
MD5dd016f9f000dc617cfcc7835fadfa26e
SHA17685fbdfa3037b49dad2d28c59bb3f09df608abd
SHA25676439e8854015a76097feeea473af0c29de3bb4c03e65dc32165804c3c1fa9fe
SHA512da1b1cef5daa582f52d283458dc378b875a00ea8c0f41b40622cd5f13a32cb571941ddf6545a7710adabd4d2618dd23c430a5d8e51ca1ecf69d4c29f6df5bab2
-
Filesize
5.4MB
MD5a4ebbd66b86c6900c1d6c672d94452b2
SHA1b2a97eb804d008b3e2d76646958dbe9a2dbb9fab
SHA256c94866c63469f7b15532e6a5ddf61152448be50a80b5fc298503d7057bde24c6
SHA512e4a00a61912f5c6fc067645a4e087d123ba27ce99a317f70af53edb25f8f3bc169ae53d89f6a1df6c717a40b138b7c187ed95f4b5bef61b40b030e38f1543f39
-
Filesize
5.4MB
MD5e35cea4c1a5e1d0e1372e5fb373a8182
SHA1be5bd5c3d0f62c2a55ee5ea6fb76b3eba155bd6f
SHA256261ab4656562d17e538f77c5ae8bcd3a3138fd4622197dfcfe983e5ce1f684c5
SHA512a4ee32cfe18e970e0aba0ecb3dc084a92fb9458648abf50372b77192d7b9ece5e27cad2386134448f2d460adc65ddeecdbbe2019c7860b8fa52d85dcc1559378
-
Filesize
2.0MB
MD5487a1503e006868b975ded81a6a0a02f
SHA1927a4cad736902db6586ddec0cc5bc9266867b55
SHA25617080827085af48f07b31dd254cfb8d0e687bc4134742788305746438e8c1d02
SHA5127e01049b95a011bc4e77d886b9a292af94f3aa23d1024b21aee602ad9b2c26ec8e5740fb29bede18c0dc816a0c60c7aa72a70b4d5a367159567b9adbbc357740
-
Filesize
2.2MB
MD50880cfd6e62a4f244356e2ed4425a8d2
SHA1521a9a9c99d5ccfab5a6d85524cdd60f29e12328
SHA2565f40a3a2e53c0c7ff2f414d60c5561321fd84b215ff5bf05d545d1ce24f2e58d
SHA512a1fe399d1e53c6a1e689c610fc8ffedb950e5ac9e746f11dc77a891b1e1e9e9a6833f5b61f3887e9886047b8b27e63ddaf32f71f7a0c3e2c7a3c70e6e910c210
-
Filesize
1.8MB
MD5dd567a4039bf44fcc75adbc9cf57b300
SHA139c48966244c2cd06d42cce3ba00c675e7725f7c
SHA2567be5d408decaa6a9127676ee72f8f6b961e1c5f76b7d8ecbed14f9b33e573b75
SHA512ff09a332ab521eca704574c5da29cdb5d616aed22180871574580339e2242297539becb9e10fb730dc476ab657d61f4541fdd93ef9b02f290463ea74d8577c94
-
Filesize
1.7MB
MD565a58282befe4c8d0547e1ce0b75a9f0
SHA12ab66ebe2faf7e48ab244f942f4f71661fcf1ed0
SHA2564d2863a508c3e5b61a4daf137f288ecd833d4b87a539d5b1f4500996074e5dc7
SHA51255e0a0a12c8dfef1d72b4c5e2628bffe8d3a59a0ee8dc7d5071328c65dc442c9067a5609bda9cdcaacbdb33d8ba3974fddee7202c1793f76f406034b356dda1f
-
Filesize
1.2MB
MD53d2ba8a0831d487c42d4d4d109150857
SHA108d51b549d6dd7bc6f83468858e147b42d6e891d
SHA2560f9b5f0e8278a546ecfc80038f84b5da25b0ab1dabfbdb75c923b89adf49d5f5
SHA512c7dc03c76fa89dc480d9d9eedd341efef6148695c08b0cedd65c3a828ae0726ce1e8e68f318acdd1d37433e6af3d7d648629d47cc7815ed3581306652b0535f4
-
Filesize
1.2MB
MD5e7e801db18aaa12aea02a8ed137f8af0
SHA19969db50431f50bef8a8dd12608c3b5c9563c44b
SHA256d8189fc18a8ad58163ec63e6b57a335f10408537df94f8fec219ca6541c37636
SHA512fda7420882f337446b0b99b826b0f815cde0e4dfa04237b68b550ad29f412390b7884230b8185c5e659552b6e4ef49b27c49f39396c420e925823022e30dc0bd
-
Filesize
1.2MB
MD57905ff72d69ee6d4da87dab82b1d7377
SHA1b0a8eeed14e2d10deaf15ca5b2b734dcea7cf772
SHA256190f57fa60f803f3a4c3c5c4962b79fd5a1160eb809a011a3f94a25d3d5ee4c2
SHA512e9f24f851de0ccd993f7bfe70221e97d2b6b4ea78bf04652819ff98ebb39405a24824a415e4bb7cc512acca550cf4614197149dad6651559aea860cdb00dfaae
-
Filesize
1.2MB
MD5c754e3ede48792c9ff115c92d6d85839
SHA198388497fe406b1b80e2fc8cdaa0735c7a50e8d0
SHA2561a4257372889f0779f9fc6c013a06a1044c383952e87112a5ef6f1b987e2b8eb
SHA512df2133f7e7e27787095d84bd1390c5cd2052de77ec8546478864e1513b1c2447a84e09f54aae797f566cbb233fb432450adf38f8e2cba10de58292037f226a3e
-
Filesize
1.2MB
MD599713d3bdd8886de9d9ac8a1a9cb30a2
SHA1f7eda313cecde08f426320dbd0d018f690f67a2b
SHA25634b32d7772e94dcc4951f2d0ac5fca735c0404b98502002d4eebf7ee44e1113b
SHA512fe00a882c11cdf9d2e77b3b0e5b4cc638f17153b1437a57c0c53d82dadf2b866e06aecd37ba8322f0d4deb9a4dc4d3b036c81cca5159c4e501d2a2dd4431c6f7
-
Filesize
1.2MB
MD57e287d7ad7292465302fffbfdcf44463
SHA1956d40281f322013745232faf582e31b1cd226eb
SHA25688a533b377d6140f105e55a02797bc16f4e31f94655abcd88a060429c9433983
SHA51284c9070a3d9cf22e57a9a8e4938b8b51885445871ac169bd9d941f8b82effbe97dc70037951abd050581d82718b2a709d540d2100ac1741eb7722fbba304e3fc
-
Filesize
1.2MB
MD5a327db8ee546ad66bd361d2b70a46851
SHA1602e3a5168f325e23b5713b4be97db96c02330af
SHA256f77f6c8dec7ecc23870b82a18183201008e32e387ed85a0c21c2bd42c2f173b7
SHA512532f21e96c7a02b607bf0736106fc95623c3f46d72d8066a67001fb5dd486aad8e48b2e788b2fc58969361a73f1ed6ed5bcfa0b690c5f832ec8764c742922029
-
Filesize
1.4MB
MD53ef04a80b0f338018f05b51ccecf3c19
SHA185f976cc3f9f14f24611b24dab738d0265c8fc32
SHA25637ab4e945b52fd565be6937335a8eecd8a8e6386c4c9e5cb991fbdaccc3b5815
SHA512d54432d62b178ae8883a14d8eb0f72b889fa2ce3d96d7462675f5f66065bd673bdbe1e87df2269245ca8fd4c20aabdb66c0f441f4c462c9845def61f478ed2a2
-
Filesize
1.2MB
MD5f34a22692ac4e53a843e17eb1da24853
SHA1c08fa6c0391dc3d13341f348e2c9790013abc2c0
SHA2563bbe53e6f853e1c71d269f0e2ad130099793dbbbcb0e3efddbbe1cdfa53e38c9
SHA51248377c907ed8b62ece9da262256e0dde5f4ea3b57503bd6cc85600e059a82acf741ef7d702caf107cbb083ddfa786cb9f3032ac522088006aa2f628a7e028e84
-
Filesize
1.2MB
MD5c9faeafd606c1d4bd4fbe8d719253f27
SHA12ec947c57857be88ddb2b26613370ec935feb755
SHA25676185ec875ff431bf7f06f48eb76ad70198d0909511fce037a3ed313fc1dfb08
SHA512ed241ed85706e4a4a9772dc014528de696eab1ce98337031545382b24546f0d0cc8c5d006e6548dbd61a0bbc87dcc3f2a7abe44ba1061c4b5e05e7ab13a45808
-
Filesize
1.3MB
MD5692adb9126fcb839bca2cc3053a217ef
SHA14c4c0da6036c97dc0ecab32eebd10b1bbdf77d82
SHA2561e5323f4b50ece15a0310e89fcde178c060d3f44a08d865027e75b3523890e06
SHA512cee30c3c2a447c30609e6fa44af8c446061ddd983ff3722e8038c9b5b664c60e25024a9ae4ee72649ff7713156469e3f29ee2025077446bbddeb589106e1137f
-
Filesize
1.2MB
MD5c458c6898f5e567d4770a249eeccbd43
SHA1dec831669ace3bb2c1540e59d266046394d48aae
SHA25697a39e2603824d906a2518d7deb5eb32c618bce493ca70f400398b73e625fe8f
SHA51203dc51ac7baa1128f259e88a65d44ce7b019a9cfe5ab58bc11b612c924ca426e818443a15e274ab81b1885978c34ceac40badf9029689bd2f4f1a56169985592
-
Filesize
1.2MB
MD5b4e30ebc3d5fee86b65f831f278bd8a7
SHA1436ef116cd6e6f9794d8ef8f43d17222ad710030
SHA2566d253fb5ccdaf8518499309f6d73e17aea25a90b3af54a7a08ed93efd34d0d10
SHA51287ab202cca222b8eb8aba1c52c00531310ee54e5305b4dd5a90d6f0b0d15c8fd5933f6618ec5db84350c80b680e08a437e763c13205b7d86bdbba4c8cc3ac864
-
Filesize
1.3MB
MD57fe64f9a7992d6e1ebfdc5a7bc2f0669
SHA1c7fcfc2303865f51ba562d63fd3102dd478d7ea8
SHA256f6c62b4f0072163c63d8dbe38da9854f53dd02539978f10ad2dd71f2f4080932
SHA5120ba8ab086d7c3e78fe798416754957b7ba845198aa0af0dadedaa4fc1ea93aaa8b1f9e835ced8526a092bbafe3426d450c33513c0c7a8cf8057da6a3bb006936
-
Filesize
1.4MB
MD50260701a3614b7ae62f917425bf2538d
SHA108117b58a1353e3bb1ecf6be0e0432f838c12ebc
SHA256fd732d6a8c8af7a17fb3900dc3e5f5095026d4090f14ac481a3c82751d1e5b2c
SHA512ea06b521926482a94ce28f9bed0489e1718abe10965027b997ef2fe8a9b39e236f210c5957c38966bad1ea0569961f5a8c21c2af9a6fb533b7df97b2b4fb6961
-
Filesize
1.6MB
MD503154527da4cec2a68ce7bfea706aab0
SHA115288feb6db2b91b3fd6ad494d2f95116227f4f7
SHA256fae4dbd3bd57fc0c215ebfa66a7c0f34821ecef746c45bc106fef76d9c73a7a8
SHA512e4c5c039f2ed599a5a498a42362f09ab29c4e477707475ff4c640b2e31fd58d8ab18ed403ee6c84932683d8f5fba21bd67904e0c2866570c7b32480c351799c0
-
Filesize
1.2MB
MD51d224041e530b5048fb4983d6f960a76
SHA143b58a7da17e3aa379a7bf5bc08af3b04991f0c2
SHA256432b5c84d837f7e2d9be399423fc658a5d8877bc9328a1ee3baf07c3184f8457
SHA512c0860127aeb0c470b03d5703c261988a05ebda79a1650442c46d19a7f0016867462a6502c5216217ac86c355e076c2dd041ee44bd2fe2e9024fd0a240061078b
-
Filesize
1.2MB
MD5728de496ad5322559c90ecb54479fe1b
SHA1fe2614ede9166f73802c8afa71401d66e19662a6
SHA25624013a5bb38aa1c260f47b80b0fb672e0bb45cbd5832dd7ae4e0fabca99ecf7d
SHA5121b86f8297da05696db3f0505769b6f11d676d1101c4e63d905a59827f180ad29d3e0b0c89ff042057124724054f9f2736b9c2c0f1739bcebf2fa82ee7e298fec
-
Filesize
1.2MB
MD50ed83ced45a99fa5fc87a357eb150418
SHA13976fbb524b6c2ba5307ec6a72298848028571c7
SHA256be0f46fe1fad46847ebe3cebc06a0739cea01954b7e45338aef6a820cefad6bb
SHA512d1f040d3aa251cb4d0421fc87b51e852bdd5f4d16a81e18cdf3bab489db857370948d080a9a8a4fe994d8788c0ee909bea991796ce112d81141c6a0fc5e98e46
-
Filesize
1.2MB
MD59fc4f5a60420bad08f5379991d5dafa6
SHA139369edb1e8cd31ee31519845f64652473060be9
SHA2562ea0d5a47c6f072f80afcb8c78534e28f680da4fbcabc788bf9735c8f0e551a8
SHA512dc3b8449aa361ccd77746637420803f21b031bd7c75934c0181ad4334fba389c50c7bb6c167fec60145126cd09f14d3f987e29b7f50cc08265b56c5f1403da64
-
Filesize
1.2MB
MD564979cdd1c5a3b108adc0110cc2ac3ea
SHA1d788032d08652e7f58906aa45ad0b5d234554487
SHA25693aae1aa903a927c87976f8350b8005e55accb24f55773d85c6429e08104b640
SHA5125cecc9948cdcf6fe01113dcf2fe03e1e904810e615fb277dc2b3cd8929fb4624f45b1d451087df388dd96d7d1451962255f0cd32558f457a35bf90a7cf4be9b5
-
Filesize
1.2MB
MD519c8b986d282ea23d034a8a019e80dfa
SHA1c9f41b266adb3b5818cd22dba5422574abbea788
SHA25673fdd03283efe44a1fd9762252cadfef71833c6c44511ece09c3828119ccc490
SHA5128bc6c38098b8c33432414e62fcc4927cd875e4dbc081a56e92c6198ce6d43bb3fedffc78935f580193046439eac94379a37dbc27ff0c8a129e60197d36252788
-
Filesize
1.2MB
MD594fd0645d01e89ee89f0edbdfb6e74af
SHA1b33563b83ad932a950ec8a83891bb362d3a8bfb8
SHA256109c1c5de2ca59622cb998c47c4ea137ca1847dd7aebc7bc5b7a592285c78c7f
SHA51285e8a4639f89dc225d36b53a994d92df7af24f14fe9e08f876f966b760815872c2a16ce886ad97181b87cdcbd0dd034ca7f23d282d614d9dce84850dbf319368
-
Filesize
1.2MB
MD5f3fe776e76e869cfe373a21b5054eede
SHA19a60752bad770c6954e7405c52fa364b5f7d23bd
SHA25636b6b32e1c0e6f43705d53f1be45bb9c06db97cb397cc33d420a50da3def9573
SHA512e8590dcc4641d3a9bd569cc597e7e12839528dfcbc76cbc0d566251ae8445874d47ff741f0270e1d3ddcbb4ebc72b2bbf5b990d2b54265e2e6a1ccb7af3a82d5
-
Filesize
1.2MB
MD5389f4e78e921eab52c3fdcbbf15117b0
SHA18dcd5154ee9543bebf63e9560f8a5407fa078997
SHA2565ddc422cb870386871ddbc62ac987ef5cb01154e5e4b3fc6f3f38cb63bdc1ba5
SHA51203ec52455ef84d521c9c98f4f94df22914caff76bac4107b08e732b6b7438e9fa9398a0747dafd3a3d7bf4cffc86c5ebdfca01e7c9e852a71094fafb8ccc46a4
-
Filesize
1.2MB
MD5278c36ae42084924d80dc31927ed4601
SHA1d32bb6ad2e57e6f35457f0038d5fac0f08471ff5
SHA2569a5ffcb8c2de0f435a9378e3b12b3d06fa4a5c96d14b9f3cd1dbf7c119c9fe1e
SHA51272066919c35e5c115114a7de712b41a8ec1d1c8ba92f7bdf8d05fead55344f5338420f7dce8e8bef59bb9030af51ef20a9482924372adab7105896a957906790
-
Filesize
1.2MB
MD55dfcecdb838fb21e4308acfeca716c9d
SHA178366e2162dc3b996cd7b932cf831e5ab766f3d9
SHA25601859e6b68c5f814f781a66de49406de893a170f4809574315676ad7d98a8e53
SHA512b387cb495731e5b599cdf30523c6124cf0b9e3d7e64609357696c81e315a7ac62bb8b7f84dc909be82cbe78a59ff9e82d59353ad264ca620438ae6c7ae472c5d
-
Filesize
1.2MB
MD56f5a0b15bc7098313c8232ccfd8327ee
SHA1b8fb18d3483dd5f998abf8627ac308debdc8c79b
SHA2565831ce961a8684fe178f6cbd799d9f0a600c3eee4cf2527ab00559ff51b5d989
SHA5125d29eb2c98be32ee8fb91325e70eb69caa1d42358e80a99b874e1ff37f996bdd073eeec09acaf34b2329288b808e4dba091383d161a4d8f397ae353f90c2d3ee
-
Filesize
1.2MB
MD57adb00d149ee0f4b918314cb0ed2bcd6
SHA11403ca63a1abba903b7bb655fdd02868be39b793
SHA2569e8e1b3d06b61bf035026f9f3b0864497f31b6d424a024d2083d31ae24ee293e
SHA5120ce7811e8c0863c8b3cd60036317be1c1e2bf5556922aab922ce704d1a57e61b92fc5e965affcac1c237fcf3406351386fbc477329a72c80bc98c9d25ecf1824
-
Filesize
1.2MB
MD5eea1544e67853729c38b19f6fd466f18
SHA1c960ecf93352ee824e85c21b3b65b6a9ad76d9de
SHA2567f699748fae85d55decb5d8c4457c627f0f528369b8a6c21d0f08f886dc6a53b
SHA512dc36cb4bb23e4d2f1aea077bd63874d292fbcf983659d06c07eeed088be8a282cdd9a6a752dc600f158944743a6eccd4f056fd02fd7636c1cebacc3e6d059349
-
Filesize
1.2MB
MD527caf94106701778ac4c39ccaea5992b
SHA145d55a2fea834fd1ce5418caee550306a192f7fe
SHA2567fd42111c87c91dbfad674c7f59dfc92bb5f3f239db40dfa2ff7fa6fb1bcdbc7
SHA512db678daf2b7c799cb41c0e8d69dac8704792c14a795eb3ba3c27d45b24b7a8f03e2e9a111f35d9bf1600c0c9af2c2e411caf6cbdf7a64a325620dc59dbde19bb
-
Filesize
1.2MB
MD53182ff789fb913e05364f6de7dd3520b
SHA1feb2fe8d1d5a4ad9fb218d9e0dd59641df5e424f
SHA256f7210953480047657c41a140c707fe10a99e6876b05cf6f51fe5a0b5e08004c1
SHA512ddc67e7c479835a0ea1455c019ea7aef07d2946c9a2f6d3ec98b46c1e34f263e9dee2d94c055131202c63a5dec188fc736915da9c7e1e155c7e8100ce1cf6ad9
-
Filesize
1.2MB
MD5a39e1bc169bd86a50bb07e96a1d0453f
SHA10404027cc045d97ef048fc247adcd65d82ee71ab
SHA256ddd75f6fc45666491ada5a4a6a05859cf5744d7bf706e7c0c7170da590d62e91
SHA51260fe828eb1a5d966c1936d2acefa2217a18249d1b71abed16bac366834c45be40973b14256e8491f0b50defa18593705a0f12f2d35eb281f950789ed14c90a55
-
Filesize
1.2MB
MD53b62a14ce1fd18171ebc110334b177ce
SHA1c447cc6d15fc92b83c422659a2ae217889348be6
SHA256dd4b0c932f8533d7d07bd52a3ca156efc7d169d237c14b39c0147117ba36eb7b
SHA5120d43942b8d3cb93e31feea222fbc3e599437eb8fb901f78228f1f56d5dc35ebd414b5432ecd603559daefba0036b3c36609c9695d48e62b00c1f52a841dbb370
-
Filesize
1.2MB
MD55619648db63be2e0f3038d6414bd9dba
SHA14f81120cabe3460ab6599329019f9485a390745c
SHA256e2a09300376f8015da8926b0e8e38ab319f3370e8415211086a67f75425d9e9f
SHA512e5187eaac226bf016e01e88de2820668b732c246741c1b6293ddcffc44b08b3b0444a94cc643bf3cf326d896e997eba29e8455d11936d6f43e9a891abd59531b
-
Filesize
1.2MB
MD5fa7296338beccc0589b6a6ccdd6fad3f
SHA199304404227a10c291c807927f0e3453ffd00f68
SHA2568d7b8ff5d13585e7d21542f1e5b8b72102290ed5d1ebf811d301b24d099fd68d
SHA512ee4886232c5dfe2c66867d15919723c7432de87e44eac48715fe73802dae34bff34258508d3dadba224ae93cea14a5f7521cccce370e0c1a96f01345417308fb
-
Filesize
1.2MB
MD5621a019bb1ed4b3c5225a74d7bb61993
SHA1e650a3719dfcf6d476f88952064ff2c204447b73
SHA256857314e7d779778bb0c5b3c4f171fdac1d86e1cd103e06922cc5426c311bb393
SHA5124e8b2a1538af45b2877271b730aba2e4b1943d33f1fe05df219bb8624520ea91d698cf70926363062a51bc83074e91955daf6866235642a798c18cea5aea9851
-
Filesize
1.3MB
MD56acfc84b7b71d3a8b284cd100ef96976
SHA132d02cb5edc8d2b78dea95e34eb97262e55ca93d
SHA2560737bf6b58903ef48c0e1c2fb67cc9b208f9745aafbb1b12cfb107819d730f7a
SHA5128119df794c50f4432e3f2d250d45b01128a456db08ed06ee31041fb8ac327f222c2ebcd8df8ebafa3cd0612b5199251124a31cd98048c26875ee57ff0a9bd815
-
Filesize
1.3MB
MD5225d4d23c922592d9d6baff6762c6086
SHA174d862c1cdb1685cb38eca11cc9e1d41a99b52f0
SHA256a8c39f089cffc35e05d014e9067b2287dbd05b8e0b2f756d16cc4fb1f34a7225
SHA512fe1be3f94e8cf01184c894186ef5de04a96ef5c070173c5788448348959d4094cf3fefbab3dbaa932e1f2f9cf6e692e19d9ce969075cd10bbf98d398d57bbd97
-
Filesize
1.2MB
MD5b842432c0c4aeb1369a40a527cf6588a
SHA177f6052cf0b0af0e6a1dedb1e6dc42d8968cf5e9
SHA256c71df6260b47564d31a6e9d6b3d430235e50ccc4f91581cb76e142f06d1591cc
SHA5123c8785ab868e44f0578cc5d8086b9a77dd0a23a277c56db49d86f46ca46931c33c9c52a5b04bc21ce9dd207515a57caacf605f99796af0e16fa8e74980e390b6
-
Filesize
1.3MB
MD595b46edf8682d0396c551f99b3b0063d
SHA1207cb4981cc3e9d53b148d73d3108ea58fe91c3a
SHA256869fb043670d2f2273f8fd00c7998f20638d3f8ccaaf328ce2b02cce3abaf685
SHA512ed77d7d273e99e2ee122ca7f06aae9a950e2479d9b3fdc08e3652948caee252b31f10089b4123deb49da257db89c1c649ed87a521f4a5e2bc0b3df5cce4e27c0
-
Filesize
1.3MB
MD54c675c38862c6a29f9e70368fb1fda93
SHA12820cffd9a1eeff84f3d708739b0ff3504fa28ee
SHA2567d182654c097b8d2d5bf40387d5135abb1619db74962c81f2988845b97e106cf
SHA51207dd06719921a78758e7d1a1cfd18282ca420d447bd5fb02170e762e778241351bb2c3efe1ae4825caa59a671a5b399c64ec86d72e42b83260e3b30f6a1242c2