Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
09/07/2024, 14:59
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-09_7d0241721ba67b822779d9f71c58ce24_ryuk.exe
Resource
win7-20240705-en
General
-
Target
2024-07-09_7d0241721ba67b822779d9f71c58ce24_ryuk.exe
-
Size
2.2MB
-
MD5
7d0241721ba67b822779d9f71c58ce24
-
SHA1
f5399d4792d61aae5c51f7466a31077ac28eae60
-
SHA256
4adaeb26c829e74d17d5c785e6a32ba4f5c4a9f0fbe9ec90910de47eb34d5ab9
-
SHA512
da870c0f759ad7c1632ec16cbec61d0ab9a674ce7bb38702be0b0ba017dbde27d1d5c1cf543c6bc374fb4739abe61e2f6e90eddc4f440f9288d055808457cb18
-
SSDEEP
24576:ROObVw4TaN1wdFukCba4oXtgLhU3wEdmh58lsqjnhMgeiCl7G0nehbGZpbD:ROOh3aN4FuLbegmtGCDmg27RnWGj
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 4672 alg.exe 2428 DiagnosticsHub.StandardCollector.Service.exe 5012 fxssvc.exe 2936 elevation_service.exe 3676 elevation_service.exe 1052 maintenanceservice.exe 2564 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\5661c92992844182.bin alg.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-07-09_7d0241721ba67b822779d9f71c58ce24_ryuk.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-07-09_7d0241721ba67b822779d9f71c58ce24_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-07-09_7d0241721ba67b822779d9f71c58ce24_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-07-09_7d0241721ba67b822779d9f71c58ce24_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-07-09_7d0241721ba67b822779d9f71c58ce24_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe alg.exe File opened for modification C:\Program Files\7-Zip\7z.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{EA7A97D8-06D2-4899-B7A7-E79850B51060}\chrome_installer.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe alg.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2428 DiagnosticsHub.StandardCollector.Service.exe 2428 DiagnosticsHub.StandardCollector.Service.exe 2428 DiagnosticsHub.StandardCollector.Service.exe 2428 DiagnosticsHub.StandardCollector.Service.exe 2428 DiagnosticsHub.StandardCollector.Service.exe 2428 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 652 Process not Found 652 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4964 2024-07-09_7d0241721ba67b822779d9f71c58ce24_ryuk.exe Token: SeAuditPrivilege 5012 fxssvc.exe Token: SeDebugPrivilege 4672 alg.exe Token: SeDebugPrivilege 4672 alg.exe Token: SeDebugPrivilege 4672 alg.exe Token: SeDebugPrivilege 2428 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-09_7d0241721ba67b822779d9f71c58ce24_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-09_7d0241721ba67b822779d9f71c58ce24_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4964
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4672
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2428
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:624
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5012
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2936
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3676
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:1052
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2564
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD58552b64828d2e06af3b810fb5cf2fe39
SHA1aa28f45c73e8f063fb370cc0dcd9b91d20e0e01e
SHA2565f96cd60b516d82adf4859735e22b587ef7e8f4085210886012a8b88727cf26b
SHA512c141e2c55f420a7bfa57ab6ba661b8d491f1ead32b018858550e313327407e95c6ad6bfa2544224a8cc6f74dac214d0a4608d0f2f24cd55dcefa6f8439849944
-
Filesize
1.4MB
MD57630bc2ba0b5ee72077eff80eaf4e4c3
SHA1cb094aacee2ca91491fd60a59ac6d6fdd5f2b465
SHA2564b88467f044f0f79b3c6a3944666fb470ba7f7f8aa77cbe3218b770ce58d1e01
SHA51246263f3f50b3313ea86306359b23011ad544463e728787558426c4d4a3e9c1351dd4b1b5af069be1289dd05cd20c052769bd91d9f32ae85dcae603b25be17529
-
Filesize
1.7MB
MD5da8e401cd1da1238cf69668819b9a1e1
SHA11ded19bf18dcf76f357f052e090a9a44b45c2449
SHA256a807753c92f041619ce6de451affd14924dc3a5d88e38bc2e687b04f556cee55
SHA512af098ab13be6ea361fbec9517d3d769660df225805fc6eb55b60a5dc19027a3364296b08f33117e385a57af455732d10eb85f32eb75e2d53eb02a84576da67d1
-
Filesize
1.5MB
MD53db4a096740cf43e70070811ee468e10
SHA1ba61f61dfe78d75e5c0054a186afc93482b456a2
SHA2565ee31706f6ca16664872e2021ba7af1be0fbc016ee1305d867b87b20263a95a4
SHA5125e670d2a14bc1333eaa0e813ba8423fe00be67bc792c188a47abf97a9d24a5005d2c8ea7c49308cae1efd7c2792d70d8e46c620273201a01f4ecbface2d4f068
-
Filesize
1.2MB
MD51513ea151c3b04be6abcd91746f66f39
SHA1e93b571e0ddeab3102a4f70dd8752527f5faebc1
SHA256e6940e6e707333d48cb73425f3d5fa983cf4110908d370b12d3fbb1852ddeb39
SHA5126331a26dc550774f1b37fa5f36ad6439093c05fef097c5bd705574876a8c41b203d1249945a6675184ac6dff51e881426c56f239a4c025b8a8a29f372ee8aea1
-
Filesize
1.2MB
MD5c35bcad738fd5558f878f0e2c29e3ff4
SHA1b62a0beb72ee7256690b368a44de2cf839c9f11a
SHA2567abf6103a8ae285160c3bee7ca7e8d539716172e481f91ad9d5558403d65ac77
SHA5122431b18f9f6d5b3431e824fa66b149bba8ec4eba7fc2f35a2dc3bbe09dca479dae6269866b155439445609583e4529bcedec34e45eccc71e0c1e3a3dd144f307
-
Filesize
1.4MB
MD5299493859043cebf7170a473f8e8cfd9
SHA19d65e9d673fa7e9573d9848df215abc970cc9106
SHA256367bec658dd58f624bc0b384ef82e0fc983ad2eb92ac28121f72458f87cd1109
SHA512280983b65768d25ff907b9cc9b61f18c2838557b4dff726e6b11b9a2cb95bbb7adee44b4a2ad4147aa9f297b37ba44f5cb97bada8a2a1af03c0f4f41e2d6997c
-
Filesize
4.6MB
MD5861b726b641a143ecd8b470043991feb
SHA1547fa8c4c51e10783ec2f84179644d92826393fc
SHA256a78f063c6494305e2ca3965b6906040206fa1a217ff9d915979a6824a405ea72
SHA5122d4874e6121f4652ebee4ee366e20fc22e576c0719a8531ad4767471628fd6743c42e1f4dff79cac698ec4e5609e84b8d38eba042d374f7ba25d5512c2ce041e
-
Filesize
1.5MB
MD5db2266edac7b2fe48df54cc2c771c34a
SHA157952e10289ee6070354c43997269cbed5dad976
SHA25644949f4a28aed45a2b0dc7534b829e15617b20a0e3ee337a97b174065de9e17d
SHA512a89ad5eca4ec1c96ab33037a8a1c2c63b95bf50c8fa6743d687a87ba54fe851327a5fb4cce77a68d29639d3689a24fc4ea6f71d05def35080e9f5550c9c44193
-
Filesize
24.0MB
MD544eb110e384fb349dbfe99c8dbbc6754
SHA1777e6c0dae6bfb0b5fe9cf17bdfc94eaff6dacce
SHA256b0bea4fea5649278981c465450a67a1b44e83e7d8f23fbb1805efb5fe1fb605f
SHA512e5e27f96c0c8ecdce1c0ddcda232b1db8546fd905515d3e6bcd1eceaaab9c03532a90b56e672dba004f939b01da9246527b2625ec54a30aa777a5d1ee115209f
-
Filesize
2.7MB
MD59d7671f9897d977195936ceef1c48611
SHA19616e077733dc5b4e56aec5da45c0ef6113290b3
SHA256a7eb275f01bef269ca01ed5d164082237ce506bb26e203da84336b1d8f5ede21
SHA51239e97b272b0f1052619739e14554f4a188fd006c4c971e00a61ad0da7b8201e248b53a5db6f44facf8568b7582645a547dbc183da7b31867b015c124c9866a4b
-
Filesize
1.1MB
MD53185821896e574484c1c96c5ab379870
SHA1d9d499136a5459f4ebd2a614936b4a9e87708c88
SHA25650cb2230aff44cd9da724a511ea5657565d3b7ba86dbbe0ce5fb577be1460f8e
SHA5121032c31c2107b1856e7c1fe456391e2effe6e594ab04bf8c3b733d04a65c3cd227e43c75e1f4ef61c457288c86e4f135419ca2575197154ea71fb10dc5143582
-
Filesize
1.4MB
MD58d49700d32b8cb688bb648ada2c59b97
SHA15bc517219e610889e4cc904bbdb562aabe3148fd
SHA256cf74c0c4a151b5c725d173075ac0546406e3b6c9bbd1a0caf8c6066bc8b48857
SHA51210df5773566eac23da77bb2a41e34a1874297c62c44ce11badbe0225cdae559f817a8037eaaa6cedc52551b444f8f08096f879d01fdfc204fd9a7119637eb30a
-
Filesize
1.3MB
MD5c8989aa79beb8843b7d931461fa16798
SHA15a9b2f5a2bd9d576f6199400b0bbb577a610d9ae
SHA256c3dd9118017414b0c20e30c5e5adeb117dec21a18ee0591c03edccaee40c7007
SHA5123271c7722d1f47d6411523e5bcd03d3867715d1f87a7c1bf3997fae3c41372412bdf4d6c0fb302e683c953c5737e7d32f11800e5d6a96d368ffe929fbff7a4a1
-
Filesize
5.4MB
MD5790674e32b3d261a5d188ec05ef9db12
SHA12b141f378033402e90f045252e28af289ad31a11
SHA256d2175419689225d54f1ebafeeaa2053a2477e3cab47d9ccf8a7ef7ffa9bfe093
SHA512d1e3356aa3411375db9987d424e839ac46ad39ac435cc653f16ba67445757e03b0954dc4d877cbc3bb801be2d0419d29142a697e3e43e741b9f28ff5e4a6368d
-
Filesize
5.4MB
MD5a75d2a04a7fc1b293a35e28df7f52517
SHA1e9c284bdecaf0ec9384b1586eedc817d0a8a2181
SHA2565f42b8294ce597a705af35fcf4b5aa49205a3039c18664a727244c1da0df11e7
SHA51233c78d0275c6a59ba63e4aac5b96ddd4f4dde6c5ba564780f818d306e7ff97156364249e618357740a5a24df6f267f62a8777be212ff8797bc853c2a2023a0e8
-
Filesize
2.0MB
MD5e2e0ccf74caaa180572394bcc8b32a3e
SHA165854e6ed0747364e7e2732e804eedde05025b77
SHA256cc4d6167c1c8565e2ccdcd6dc80e278c5d63e0761b7238bc7044a9334985736e
SHA5123cd823252ecb3fa2a8054296602b1c7a147bc333bfa703c13b773af001385608683a0a2efb49620ef87704ba4968d15642133ef674c1be649a3a619c76e79e43
-
Filesize
2.2MB
MD553b70a324ffeaa8f0fcc08aa21a9c1be
SHA18d56f400f8b7786a406c710421ea5f2c9dbd7adb
SHA2567e7b7b996c43518369e84931fcc36992f7590bb78d00a0b4eb232acc3c07335f
SHA51246fbfc52a8274a652d4ded1fa33fb7904b5a4f2397dad9b7a9cb63399ab79264c1dd508e841bcbde795f6f5725817d94cd26c06d274c8bf64c684d1bf6c9bd57
-
Filesize
1.8MB
MD5184c75bffd763a24cedc248f01220489
SHA105162224ad9b3683b9b828719ef15f6107699693
SHA2566df95046bbfe54caf20876fc051e0d5caa6ce1e559ed99995dc0737bdc2b83c1
SHA512f14249c771d1c59c95ee9f3981df2bd69b038e1195a4624afa73452a79f67a38697d453f9c308149747f360780d14fe1b0a64f1ec39347611faf248f91e7aca4
-
Filesize
1.7MB
MD523c0d9be196d49ea44aa5510f4355011
SHA17c7642044bec55524acab97fcabd2ec5897e14bd
SHA2568a3c5fb26cbbed4f220f50c1cad2c2f537cfc73d4ca9e0a70cb0019b3721d1c1
SHA512010bb2adac69d57f1a86a6dd2c247874d8fae93c31ea42ff440839466731b47ae5ce92f4e05bd297ecbd4ab1ff57da7638a98e9a1a4b17fbfa4443dac7adee5c
-
Filesize
1.2MB
MD5fce7c4cfbc3fe2d1a629898e4a7e0d67
SHA1482a8cd9d13e2e647be0dd1d186a80ee6b6a1018
SHA2560c54bfbbba018b4ed33579d6763b4c9b8bf065e76080a147ddfed6acd94fbda7
SHA512acef4dc049e5566cceb909a3c31d9569ed4ad96eacf8c078701a70f405bb8d3e69930cbb247f57bda23f52e4846537877f3b2c3c990f507627d5ccd57b8ad727
-
Filesize
1.2MB
MD594d4fa3c9a070d20a2b2c578b7c29083
SHA12902300cf952b963c22eda458fac88d550061325
SHA256d9fd138255495403afe17f2dc1a1dc840ba27d084c2f962c909934f410295ac6
SHA512be538f26c7e3fe4780bb8c99f5d11ab876251f5e03eb33326fd728e8bac1c4f4ec8ddfc07f348dced645bdf7e3fac781df5a924bc23bed7317571ea1de567412
-
Filesize
1.2MB
MD5423f35f99216faa79dea8ffb508a2e78
SHA188a56605e7c2e4c9c84ff8444059a7a8205ddcdc
SHA25654ac3510783a22e3056855d84b854b358513a0eba2146f15b44f21d446b2d56c
SHA512491de5662ebcb9eb7301d5e0758b5228a643b99ac6633a23cd403b4f6d9eb1b213429065c338f0321e13f06d05dc37d5b66bea394cfac332ff367017e8fe6314
-
Filesize
1.2MB
MD5faccae74911ae2e41c3b854a33a34084
SHA1a52ae4912fac68cf945922cdfa38f6b17b4f5b92
SHA256dfe6a1c6564d701dc937681e6655a50fc7079c124099764c0fc20289ff10b5d7
SHA5123d31115618bfd03e743455cae2a4839163775ab381129afffbe1eb400f98a22fff10a8dfc5163049c9ae103a1075e7152ca4d183388f76cacfe4531ed56cd23e
-
Filesize
1.2MB
MD51aad55f0d57dcba8215cffb31474ab64
SHA13d80aed43a9312f45f464d42c51712e8a8c3228d
SHA256c474cdbe89d192f5e64245a4c78ced8598e5e77e1be0f13bb0c87c9daea3b815
SHA5123cc160d27465ff41688f7bc6d0f982155c58a3d5bcc02b99d27f1c7a2d97e7dee3e8f53f82bb9edb06bc56806171f6a8a88f6e1aa3f088e9bbba086025954d4d
-
Filesize
1.2MB
MD539455a81e2b2c52027002cd2e08a1ed4
SHA15217c4e9348c9d07d945db4e6125c9a5c7c51974
SHA256a0de9eacbc45d48e076e26fcc52f9c07430ebf59de68be402331dab34ce1f6d0
SHA5120c98aa6c5087e9d15c07bbd9172f13a0353f45fce076bd2758610688e955ae7e5fe065ac3ff22d914d67607165d094d731c5b52fb66a9038d504e19d46afc0e3
-
Filesize
1.2MB
MD5bf0e0b88bc21ead96391020f224c3424
SHA1c6f2ea405536874eb71ce05dcaa9a256949d5ae3
SHA25673a50d23c2344ff99ba5c7fc0344f60535e2da075f0263653a149355f3a16927
SHA51277b7f0aeb0e834a3d194c44a26d89ba018a010bd31e23c9133a00884a671273d89053190ff041553b96610027506e5f2cae2bb6f5d8b4501d02b15c841e5611c
-
Filesize
1.4MB
MD5f5e6bed2465dcad10e229a2b547d286d
SHA1bcaa82473fb9e07bfd4c4c2f2111d139e5d35111
SHA2560cea3836d8d55d16f38a84214bb09d49fa3648a7b947500a16653afd0aa21e2d
SHA512412af0f87685d345f1870d73436c3bf61464952137b9b4e2d31ade94b1bd471ceed3760e23f66d4bef5b96d10ba0aeae8f25b1c9a149261bf60b4edea1fbd48e
-
Filesize
1.2MB
MD581e707903e0f20d7ce35f57a9ced701a
SHA1c05febc22494fd43f8c0c85a972c2d1d81d40233
SHA2560afe41148c69a2b32daa5df06a8be18e5e47641dd87d510c28d6a9b32eddd109
SHA5120a95ac2388ef016134771c019e01f29744d34d6cc4af63b251b96eeaf10ecd7ca081701bd7cd3d6f74b5cddcddb4e632a26ad450ccb687599b9bc14b77cae8e4
-
Filesize
1.2MB
MD5d3ca4ba186cd9e7a702486ce5b09214f
SHA18e24ce53f68139d64f25db79b718e1b85f614283
SHA256b55f046dc7881525d0f8f6fa4956cc354aabdb035b085da7e0bb72ca9070f2ee
SHA5125e9c8f9b37999d193833f4323aee37760a7d370a85c8aa8402dc6013bc5ec1c5b1175205f6dbcda15fa70cde5d14a3a6ce75631c8bb97db7fdabc8bc602f228f
-
Filesize
1.3MB
MD5a6e98e84e2e3f160776e135497ef359a
SHA1c77110c322b8ac6bf1b6e59cb0842ef6b35e739a
SHA256e314fd0224c8a8d4933137a2d755c38268e1f9222c371f826f53ef0b84c411af
SHA512fe62b49ba3067d1ef4440eadc355eea53dc74d01b22031e3226092ef71922dc8ae843af226a89f5e0d8268eb59d9631b950087061c5265fb18ee514064b82313
-
Filesize
1.2MB
MD52e8055dcb55705005fcf5ef0b8ca1b5a
SHA149dcf537c075487b45810122f925d3f6a4972b10
SHA25683e3937ba85208c33a7581bee338c08827b0e812625661e4151ff07af185f0ef
SHA512c6248eac6a05c30805ac61d291e5c0ab64a764eea941351de2548c7a7c27b62aec1b964e07ab1b63d3255bf60e08ab0cb3ae9198387d6cf0612e18d1f5777024
-
Filesize
1.2MB
MD52922885791942860d9ea8b4668646dc9
SHA150b5039bc34b39ce9ea8cbc3b476f3c732ef52f6
SHA2566b7e69b7727ba62a3f420620a3e6288dc6f7551a3f22c286c4108633690baa49
SHA5121746ef0a3d693e32442202a9aa23c51f36094267576d3fe3184dcb654b3baa07f412c4c9bd365e57c698dee4b70a24103ba5edb2a5e3b46edca97fd698075ea2
-
Filesize
1.3MB
MD56bf3b0525b7c924b795c494373d630cc
SHA1c014196fbbf86721f8e28b2d807157c054e4e865
SHA256485f8273890b2a8d1b582271be44f87ec4c7b1cc55ba3ff0c0c8944f5dfa5e77
SHA512c13d75470859bcb4ad957dea626eee39f8980aa65c7214899cdcf15e761fb5a68261c9efb81d7f0dbce9b3af81e7c980c43a497a43af15d6f12b820deaa3e4fd
-
Filesize
1.4MB
MD5618aa584086aa5d98cdbd7d4d38cc766
SHA109a7f3639f2e865dc84cb02a96c056814ffd20d2
SHA256353b730303c7c7f404263d29ba8a53f3b3182d90f709f8a0b6b4e48b7625b7c0
SHA51238e5452ca8c3dbc5a29191f3942460172bfdaee4040cd95de96cdb37eb9860c7ba99d0868ae472aff0a41150d6fabd6285c1d6810d2ae7181d0b1b5e670829ed
-
Filesize
1.6MB
MD5f6e0cafa11d13986caa66a83dda57e8d
SHA1ebe285d0e827f974f79beff02a0e6abb70a80b2b
SHA256ea0e56508fe7d9ea72a4e4987f23d99a51fd28e8b5801e8fae6948bfd324469d
SHA5126d53f9a1ac7a83fccc9697a373a5ac77e3c7a93198c75a70b7536ed56cd2e8d136e88efbdd06b0a4c925ea3b92299bbc5dab8fe96d6a2a6302e6d7f71fc2c739
-
Filesize
1.2MB
MD56c9d851ac175e0d33450f4c3b9eace19
SHA13a1b04ccd225edfa57df3038b2599e5e7c6657da
SHA256786e88c4b05db10eca28044122f26330250919fdf4b9a7563c209f564a5c2d15
SHA5127e80a980316aadefd0b7b9f4229823383dde9f3c52314fc1df9ffa89f81be8c40f94a5d27e600a5fc38206686e0ef2bb7f69e7981167e821f00653688a98dfdb
-
Filesize
1.2MB
MD5e4c73c083fd90c25178878d1294f5f9c
SHA153364ef247a1fcb695159dacd64eaeeeb63ab248
SHA256d4590baff8ddaac0f8c8f84f7bf771e259034a15a3cfe7baa72ac219b07e5189
SHA512f5defba17da79818eb1f082c4abdc08f187e2db79179b7c890135be1df16fb7bf9307817ad1cde7baca3a186fdd60cfd1a624014a0182912e49d0ab6dfcfc5e9
-
Filesize
1.2MB
MD5efee8b7eb40ae65b628ccc85ebeb1724
SHA1edab9efeded274f686b194d867c63a033afa28dd
SHA256d6ae0ff4212838bf988004cdf1ba19e67ec65aa6e26433f1c2618a57f81373de
SHA512ef60ca814947f806b3433e979bf968314d3845c0b238390061bb671a1ade2f49ef3d04e6433aff2781d5a88c3f1c122194ba41f1b7c9a892526ec36216f33add
-
Filesize
1.2MB
MD5096976fd5998b3eb85aa4bac447c6733
SHA1d30fba097f2567de440a4a7a878dadc9d54a1b9d
SHA256e0d59514382fbae05e8cd707a15576fdd94f2bf9e841393b80c737ca4651ebe9
SHA51268c2a29f6688d11c5c1832253baeb8264ef2a107134fd166187d24f97bb820685b5eb06e0e12504eb9f25b230a2f12843dcc697906ff8b93f3efb5590a4b2c29
-
Filesize
1.2MB
MD59ae71cc81dc103184ef6aee3f004c4b8
SHA1dd42574aa12eb5faf949827c8d4f1bec3c6ff282
SHA2561bd1b6653852f181329d901ea4b7e8d9b76ac10ede3ce3fcbe8bc39adaea677b
SHA5129f1da0ddd6fc86662586a942032c66562b81c84e23c8a71faa0cb7da99e632217a2704218c4936d28315fdc9cd2780174fd5bbb61d9c33f12b293c4a7c17f626
-
Filesize
1.2MB
MD5859afe16eb67a56aecb68a7d01be1e0c
SHA1620f7d110fb800d9b214833769b3bf5e0b4a90b8
SHA2564bcd2929d295b9d39485b51c17ddbe9891fa09b18e3f424e75a1d20339347274
SHA5125889046297c26202e3f1aa76cb6c175f49c1eb90dff9f975307e331e7b30f2f62d17d898e53e4f00365f39734dbf8070b5ffcdba10a53aaa5a90d790e5c402bf
-
Filesize
1.2MB
MD5ce9cd28f7fbab10aa34fff92ad9be3da
SHA13a01a21e8be2bef2640ab603fe0ddcbe8c95c487
SHA256061aa506fa7ca88cee2d3b50d33dffa2bc564b45811ea922383c584f4f297093
SHA512e1372082cbb797beb78b06ee8b330ad75033cf8acf57d2941274cef4360f093e26cec03bfb32d86300595883f23fba9602ab7c3ba3aed82d2a13ef163df897d5
-
Filesize
1.2MB
MD594046d1b27b5437befd2e60e05b09967
SHA10f9d291308f9e0403b8d668fdeb710d156f1da18
SHA2562d6ed6a8a9deb18b3e6cbf82eb3b3a4e6e47c19235bdda9a9fc4caa6bb513c83
SHA5121b3395b74b844e703b3b51c534f290bc0ab65b5b642cd4d5d688130ff8c97dff48b34dac32faf76dc4039ff026bcc032fae3e1ad1473504e5eea3cac04a6a10d
-
Filesize
1.2MB
MD546ac08cbff3433fb67c73ee4fca51972
SHA1bc0e0cb290955707eac0d1e414fcc1a9aea9babc
SHA2560a652073c20000b829039c129f9f5dc561b87609ca2f9b131675eb7b7119b932
SHA512248d2fb21178cc0b9497ea235a91b6f42526b603bda7b35bae48fb34b16a0e636a1558ccb02d56628628615d0d189fc07860590ff0b875dc38f7c0bd6b9cf16f
-
Filesize
1.2MB
MD527b3c23414abf9c7137004c0444463cb
SHA1f7c643d6ef1e855bd2a90bd8d2f22c301e6e53bf
SHA256a482d1d99dc0be313c9086f8f7f750b253c739858695213dd9ab6a27cb4681a0
SHA5123924807ad3a80fd0002311018886ced8fcf5f3e8ee76b63eb9516c0fcf7332cbe286829376535bddb60c92bd1b93dc7fc40daff0d00d112e4a6077ee2ae76f19
-
Filesize
1.2MB
MD556019802fd5cb22bd740572d98bfbaf5
SHA1121655b716457c39f7036547f85c5c6ac6ebb991
SHA256ab8719b30b423e8f55e023a07bb5691b242dcde7a119e95b6d2f5d7e0722a66d
SHA5126122907f0dfd434f07d07faca5af12c09e99b6e42d4538f6d74513498d646cfc5a1cfb520941d1cfffeb57a6d69f2b95321641607566f3f19ff5aaede358f71d
-
Filesize
1.2MB
MD5e20a013586b8ac306ea8ca7cb060b0ac
SHA1a1b04a6b5531610e4734672aeeb65632e791cebe
SHA256f3551f8a55931c38968577131406caa120e3a39bb16a6f3142cd8efbcf62a3ef
SHA512b95e90a7da4b749091f6e0c751418f7bd8da572183e39c6d15da7b1b5c2e6f9beee95d2478305531caf4101884dfea6e60055aaf35a2b349896a682010c64d3c
-
Filesize
1.2MB
MD56d2087026734f12adb99f1614503214d
SHA1a15c53041f7f385e80851ea3724a0c258d63dc2a
SHA2562f930552c5e6201200e934bed0ee2c07ca47628a24d164399ddaec6fb9b399c4
SHA5123e85d40e026f967594e130314b3fab5578aedb30b69e98bd5aab3162849ffeefc0b8b7931c2cb3dd3a318df9aeb15fda5b1cedcd20115db32e1e5ea59f1ab623
-
Filesize
1.2MB
MD5e404d9f3dc263d0d62d6bcd4d4deb939
SHA1657b4ac54f8b2d27bb5ad4c67bf13ac6e3f972a5
SHA25645a41869ccd9d239ba6fc451f90a346f08c360543f016d400eb7b6dbe43e4e32
SHA512c92b8d9fddadc839e31d661941612982260e3f52ab0cea0f301374960fb35f995ad72a7d30887051ec76cb22ee988caec13107bd17ab9efa93efbae1ee249dc3
-
Filesize
1.2MB
MD5823c8c68c30cc9f050bcb3ddc11f9922
SHA1302e6cbfe18d5452b2b27950c03ac9fd425f92c5
SHA256226ae45fd9a3b9bf644f89662df20669bf005d5be0a663c1444a76b18b3f0b96
SHA5128adcb7666bf6e159cddad77abf7e7e998909eb803deb2f77a189417a36391464ed473f6788b64060e2a39c2aad7d8fb499fa191873b71305492c8caf489a0b93
-
Filesize
1.2MB
MD580f66ab813f11ffd69047033663c0ac7
SHA18b8eb249c522c9c4dfcbe6fc08852d0d0d7e09a7
SHA256087cb42ae04fcd79776f82b9cc5fef4c7d8338cf73c4bf45139ebba6601faa5f
SHA51295cd3abe58348d115a4a8129d6b66a5682e07763ae22e99f258d3c4fa16b146558f3edd3072aa9bad4b31f521096beaabd178b256990c395b032cc1685d1d1dc
-
Filesize
1.2MB
MD5288788b2abc15ed3fc7c1c1a6e5382e2
SHA1d7d9ff9cb6399075e7cc7f0b308339b3081f8fcf
SHA256e755b044d5cad0fa789b6003b76ce5f638c77bf2ac2f26fcaae465946146a9b4
SHA5120ea60f7a0b4dbfe09c63f2bf3c4ce49bdd8747b6c460ec54fb9ad4583e8fa81919845a179ee71443f412c0e99d609b399633b6436e32d9c325164417930f52e6
-
Filesize
1.2MB
MD5065d928aa04c4d71bd9c07d7fd5f0a5b
SHA10bdd5dc7067de4077829b5a92326484787c48669
SHA256442a2a796b4d8127efabd0919854d63f7bb704db535cd8b13b6817a4824c011a
SHA512bad8e5a7c9bffc49297a3e59242a4e579981dd21efdfd35a4a42a1ad2e5434b5dacd82f89c19c6c98c7092bf71fcda67309e7ed7e5fcd98f77249a124d63707c
-
Filesize
1.2MB
MD5a2a4d7a7bcdea93ca22dd40a572756b4
SHA11730dc8e28ef25c4d83362d1232274a8ec43bd8d
SHA256552f0f5fbf3b547fd7506118e771785cc48e8466a27546237fb5a15cd68ef460
SHA5125cfa9fce395a15ef3baae37a19f029bcb8196649178af2bb1d838dbb6ca684d1b847955ae034c727b8d8c742fff08ef96d4437fa52692253f6fa3b2beba5651e
-
Filesize
1.2MB
MD54724a00456a6e18baf6978dfa018d508
SHA13ca67f651300054e8522e137c761e3776001f695
SHA2563d794f17b1c530a66d8569f24dcfe316436b22169a4e8e227c20b8ab3d3b1da0
SHA5129b0c2eefcfd2243229ff4aaf453624108f333d984d25a132ce9389dd58af6fa89d60f6122f343ca3a21e43b9803ce984ccaf93f283e65038090a1d54ff4aad45
-
Filesize
1.2MB
MD5336669ef34d6d28275838cd9f76c574b
SHA1b7122c0fdba7b17cbe7769e7e5acc93fc5af597d
SHA256efb0739d3a73e1c53eda8c419dbdb5980a33895aa408c65eaf69901098dd486c
SHA512c1fc4c79caa481d726c767a6b3e3063e7267adc4fb19e481d0053cfded677795ebe541a4e2656432fff481b0752a58e39002c471924b4b7e7061f288cbda4a45
-
Filesize
1.3MB
MD5b35d5189197efb2bac938d5922228d89
SHA1a2482f21d9903854037ba665601e498442dacdbe
SHA2566a9d8b255396b8b754ccf352fa871b3112edece5dca41333c2451ae9900ae31c
SHA51273dfa69100c7601fe564d0c7a034b0b5b15d7f1219be41ebe45a54bfff57b1d3ec67c4d0b619f91ee969610f4463b8acb0f659c85d531b1dfc5a5b29bf45d9ec
-
Filesize
1.3MB
MD5101b73558a69e2469e06b1d21749a2d9
SHA1c95a84cfea41ac34a5864227982672f246eb6e50
SHA256b1091db107b39012485e6ebf0e611efd83fedf5d8341fdef0f5c1d18a37b37e8
SHA5124ba0c4d60067d69b647f4b4c4f6ab4a76bbd114de1a4a1970a77377dfbac5e0c7472a7b089404dfcd609d6d1c2cdebed7a0dcb49882920d33ad41fd54b1c40bb
-
Filesize
1.3MB
MD55c13d8839bfd49c02f94117a848fcd2f
SHA1fe0c6554a64abb856e475e60f049cdced56d2c01
SHA256e2b0e6a7ecbe8d134b329f743b5735b081d5292e7f41368223552250ec19a2a2
SHA5121649dafcdef08c8c5e0b54307fd4f9c68c69e9947fd689f14103ccb89a565df373629047e9a0e69f3ac588ccded08a65d9fac22b26aa4e93e92c522755397cb9
-
Filesize
1.3MB
MD5b74eaa54b728a7c4527b1ed16faf4e2c
SHA10b60a3dbee3f051af9ef8aa19cce2f7c4fa0ae03
SHA25625195f080a4eb37ef50361961733b410eb8fe6fa95222ccaca41b555bc8d3dd2
SHA512827ce4dbf77336cd0e25631d1b9b24f87e650296adddd8563f5ddb9cc1f2c0f70606b046c10b017d6f16745d25fbb7a95eb1285b05f586baa2150b72a65efc57
-
Filesize
1.2MB
MD585cc39b5e7cbff6db49e20146b354e9b
SHA19665e080b0a3142832dc78d540a77350b15d6995
SHA2562038e04bb9e958905c425e6d67bd889293eb2984f9ce591cea30363768d5c8a8
SHA512cc288d907f8889d8305adc32aea17ba0e159b7417b7816aa05a667400c49fa0bf013dc0f908730d9f1c2f0d94b7b1c2b3f5b9fb1513e611b29b0a6a7db207bed