Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
09-07-2024 15:03
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-09_98a4b0af7bfbeb9fa34ef2000ed59690_ryuk.exe
Resource
win7-20240704-en
General
-
Target
2024-07-09_98a4b0af7bfbeb9fa34ef2000ed59690_ryuk.exe
-
Size
2.2MB
-
MD5
98a4b0af7bfbeb9fa34ef2000ed59690
-
SHA1
d49661370d26b66b6d56f21835e8b3ffb498c36e
-
SHA256
e72e01608900713adcee510687eeee466fe90719c7492db843f34a4d510f5264
-
SHA512
cf5c0ef75575281c8613cbc6eface0158f1ab6b22b2fe48af5aedf89ab5ddac9afcd3fec85e5cb2f07052e1ebe62eb165dae3266cd079bd27523633e5b684770
-
SSDEEP
24576:9OObVw4TaN1wdkukCba4oXtgLhU3wEdmh58eSkQ/7Gb8NLEbeZ:9OOh3aN4kuLbegmtG+kQ/qoLEw
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 4016 alg.exe 2928 DiagnosticsHub.StandardCollector.Service.exe 528 elevation_service.exe 556 fxssvc.exe 3636 elevation_service.exe 3576 maintenanceservice.exe 4964 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\system32\AppVClient.exe 2024-07-09_98a4b0af7bfbeb9fa34ef2000ed59690_ryuk.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-07-09_98a4b0af7bfbeb9fa34ef2000ed59690_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-07-09_98a4b0af7bfbeb9fa34ef2000ed59690_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-07-09_98a4b0af7bfbeb9fa34ef2000ed59690_ryuk.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\348a60e575cb61b0.bin alg.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-07-09_98a4b0af7bfbeb9fa34ef2000ed59690_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7zG.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{796964A3-CF91-4ABC-A549-587EDBF9030F}\chrome_installer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe alg.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe alg.exe File opened for modification C:\Program Files\dotnet\dotnet.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe DiagnosticsHub.StandardCollector.Service.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2928 DiagnosticsHub.StandardCollector.Service.exe 2928 DiagnosticsHub.StandardCollector.Service.exe 2928 DiagnosticsHub.StandardCollector.Service.exe 2928 DiagnosticsHub.StandardCollector.Service.exe 2928 DiagnosticsHub.StandardCollector.Service.exe 2928 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 676 Process not Found 676 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4228 2024-07-09_98a4b0af7bfbeb9fa34ef2000ed59690_ryuk.exe Token: SeAuditPrivilege 556 fxssvc.exe Token: SeDebugPrivilege 4016 alg.exe Token: SeDebugPrivilege 4016 alg.exe Token: SeDebugPrivilege 4016 alg.exe Token: SeDebugPrivilege 2928 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-09_98a4b0af7bfbeb9fa34ef2000ed59690_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-09_98a4b0af7bfbeb9fa34ef2000ed59690_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4228
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4016
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2928
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:2872
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:556
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:528
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3636
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:3576
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4964
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5b3b33a3e83bd071edbb01ea68e9e164c
SHA119d126d3899312dc79513a24277b941f7ee2c7f0
SHA256d42ab4174a77a29aa40f7fa54959d905dd9ce322c32be09f78b4bec19e83097d
SHA5124da0563e0c730d55372b0a351eb32a5d407f1a9daf3ef57b9204454ad04dcca17d3bd545c514dcf500456bdf8ca286d9ee4516401a054ead1c5672baf1640de3
-
Filesize
1.4MB
MD590162e65536042f8c2d54596cb548f83
SHA1a97265b4af7482005660d10bd82907571bcc9459
SHA256b0177ea0b5f29ce326ef4b458ae690d0e204109107355962d7d972c7b6d437da
SHA5123c07fda8572a16eb1ad5ea044d73ab2534e81ec12e6401dd073ad65d07552b721a77294d3c17e17d2267c816c9f39c72a69594002fb255b0ae26734d16672fc6
-
Filesize
1.7MB
MD57f6d197e5a696e8762f7d2a99ff3db18
SHA1b9123ea7acc6d0b2312392942c013ba6242b1705
SHA256168f7e50538f012b8286584816103217ac40e3dab98ae85d8fe9f9b313bc512e
SHA512cff3a2f80b6d8ce71270981d0e4843001d615c400f15795d335af15157e3c333b70f9bfcf8857bdd3de56513f50119404973baec37b50069255ce21bc7c31272
-
Filesize
1.5MB
MD5f7587a2959f0984d31166d880fcf2d23
SHA184b4bafe7045e395a47d9a0e33e72cfc57f7839a
SHA25603fa830afcf7c177975b40408fcb96bf725ada94e4775fb07fdd32c00407b13f
SHA5124e84a2cb4a811337bd92afe89105a1182ad38d2363ac2da3f8c78619d3af2b864d0656e06ac85fb783e5bffe640086df29c6517c54eb29785d60e4d93feeaa66
-
Filesize
1.2MB
MD55ba840a0254745beb0bec51439483867
SHA1ea221482f2ac3f45477f049146f983f44da402fe
SHA256f3eddd3b624d281a71b487c7aeccfbc1584cb46bbdd39a3e7103b491151aa331
SHA512af140cecf8213228cc45598763e73991eddf4eb6ce45d2d4c1da43a1bf3df5f4478c7ff785105bb28b54e62d28d2b33fb0f1c0f99e9c2f708d8f6c64845fbac3
-
Filesize
1.2MB
MD534bb724fad9b9a775c51aed0f41931d9
SHA16af3521ee327fe71d5188c1977fa2781c4d4aa66
SHA256be11e19643d05c3ae1079444e2faaf2bc633bdeea5932f1e70316b7bc23285b6
SHA5127cff80976da71cadabe34f85d92e9ed90a33675d416ff63ec07befeb3dbaa07b22c1de8522850cfd0d4b1ba4b077854af3e19ea85a0454ff08ca7fa40b67ac12
-
Filesize
1.4MB
MD5ce5b4be31a57453cf0945222084f0906
SHA1496b4bb74816b9e95ae3b938c0f2dcf4730d6bd5
SHA256753488d92a9427165ecaacfd6daab303d5048d81c5d04afe352bf3483c4c0e00
SHA5121fe9a7b571434dc970ac53fbee657ba6b4a28e53f284338e020c4ee119eeb8500fceaa4a7b2e0cd5e7fd5199be58e5bc133b785d8075b9e85a42ea045434acb0
-
Filesize
4.6MB
MD55baac9ecbc0cd55acc5aa2ea4ad717ad
SHA1a97049f9d83e02acee9daedd41f389a42914a861
SHA256f953eb78790cedd2533c1c2414c81c84838373f2aef20541ca9ba70756fac2a5
SHA512f476519d726159c388f26574a35457185e3e19e3e07f12585bb4021ce802e442da88f4d41c966df6dc7a3e4e5f1fc2c6f536c9a06b04a7683ed480623af208a4
-
Filesize
1.5MB
MD5104fdc9ce2829ff888ef44c497bfd1c3
SHA11b66a0aa80d61e13a26ffd990feecb9764f02454
SHA25662274cf8303be31c5a8a8276b16eaeec1a7dc9b9c8101c97ec95626843d54467
SHA512d6acf9f5eca90be0133f34152cecc86bda18ee1271c308c60f3679cf1511702f4d1a6b5f9d61e4242a0d1dd22bf5251f489d8c55b029560e26ce65f92d5087d5
-
Filesize
24.0MB
MD5de13ad5c5caff5e237f8a990996b048f
SHA116b93c841efd62767739133171384c82afce36e8
SHA256183ee4e8c22bbbda4ee5c13ee50d8ff94361238c3d8e2af1b459cabb8f0e0c13
SHA5120bf36587e364d1e215f58ffdf4fb11e41c9366d4d20d627c59e8c149868433af092a9bfcd907c137d25b2193882e74eb5538e37cf92bcd833087a2832c23de77
-
Filesize
2.7MB
MD515b8f99cfdf8d843d36d201a434c8bfd
SHA1d2d6e43e1c6292cf90cc081526e07267e7f53255
SHA2566b247e2997f993165d09dded7d481419512fb6b78be6b9fb7f09b6fd98b2fd65
SHA5126f206eb42dfd0e06e1ff98d45e24de8f94551b3fbc17ed4ecb314a797f4d3c228ef64fa31d5f74235869e81e7db56e36776c22985db393a6a6199020d9b4df93
-
Filesize
1.1MB
MD5b952f81896de3ca2f907d515b56d90eb
SHA138b7c590819ee4f6645444eaa88ca46172ad1ef8
SHA2566c8677c3ccce492b92c2038b1520048fc57adf66af50a102d126981e2d285ce9
SHA512b9c197ec37f560ceb6e61df93328fee6fb497d30c903837e6c21d957b7b7c037d03e59c7fb47f58d0688575106bb08f881f5d9d3b749b1a7708bfc75aa8da05c
-
Filesize
1.4MB
MD5673469cea08203ab239faea40b9ca419
SHA117c0ecb65ee7ff5e88ff1552d880a9984e21dfec
SHA2567aa6d7957e5dddd3e6f76c6541ba55f13720fa740c1255ae41f6dc341bde35d3
SHA51287de1af51d9b0e6bec395769c4c9d867f0679c1410af6839596d0160052f6e6be659531cbaebf565e76905fe2377330f0081684cb2860de45d8ef64f49d0c02e
-
Filesize
1.2MB
MD51be3623e517755550e0ff22fc376ab6b
SHA1e09745c2fa85148ef551da342c82f53431e69f77
SHA25621c470f08326edee8761e3771c6c22f82728ea23bade3e9cead0922b8d5e3a05
SHA512c7ec0ce0164328fa98df9dc7a3df32534941ce00221e21b7b8d92c7d7bb7b7b5c24a7df4f2deaba46a73a4f7fb4022cfec010dfedfa4b88b086f18c94197e985
-
Filesize
5.4MB
MD5c829b54f63f598bdf604c165fef7e2d7
SHA17f681eacc2368403225c46f97454d89d3a2557eb
SHA2560f1bc30eda0793999210e8c727feae42d5fef17740f00eb3d17cd1e79b9da4fa
SHA512a4d9665785bab872e8fc7437c0f2642635491337f65c7f1038bf48d0f01bc4b940b50f1df99256ebddebdfa3b16ba9f94fddba0e37657b57e3728b7c8178a150
-
Filesize
5.4MB
MD5d35446c9268b05227c65da980579fccf
SHA1868f82e1b0c5f5b5dacb8a6fcd2fd61cf8be8b6e
SHA256169bc1937a43bf83d5da7981a070db87a53e67588fcdd29ec150c8a0da8f6729
SHA5126129de790c9208d5ab76f2d0c442cc9d9e01af99ed635f7d70d7e2b3b63127d4101ec3c785fc9b51a65b038572cffa7220741359a7cfe9871be2efcea707f295
-
Filesize
2.0MB
MD56b1985e71c60377c121050681f3dcfae
SHA18313fb882989322f05074e3a5bb25aff0abcd111
SHA2566eebb872f9d459ff65a1760501d4a9a1692193bc6e47ca938755a8ef5f07e465
SHA51264b4ef37609ba5f4d9f0bf3121d3d38c558d49b0caa10f03cfe8bbe63eccaf7e125a48b1678ec64651a9f2900fd035c9b3e60e2a797aab0b1460e576c3d166a9
-
Filesize
2.2MB
MD5577111a009c597b0dcb277ec059bd3bc
SHA165e0e32227574440fa1daeaeb4ff5c394340d0f4
SHA256416db463357b2ec3796ff2bb645fa3d0c995f373e1febbd47b3089fc82aeecb0
SHA5120e92b7b7d6fbc029f5de25411a409ca637489ba0404d89c69d2b835f37e49f88d078a601f088ad61705dbdec118d6d8a1c7e8853cfdda465ff5569aed6c305e2
-
Filesize
1.8MB
MD5f9e6ea72bb94c24eec1063af3f0d144c
SHA1ebcc503fdf3ddff4db01b304032dd09c37b5b19c
SHA256e74b92e6428cd437fe3d65aa69432f053d5eea26e6797a87447b767192eb0d6f
SHA5123b8da996840b99a0ed426100a3e28cec42f33063a7cb77709d806350b89cee2bbb08fe25a8924b09239ec015a5b11a8b05e05d778df6acb156d0c488f280819b
-
Filesize
1.7MB
MD51dc36eb47b8721a476f935d5041ae432
SHA1cb2dd30f6772f403b21f8efd1c376ed94c673984
SHA256244c9a875710eaca5ecddc56a1f5f02a0e5cd816aac75fd25f61d94108340c8c
SHA512c16d72274338185b569be0364888ee55f5e87436e64a240cfdf5243c51870c94a4c0a391df5458370857c3e685f24cc5ed440110292a175d8a8e59fb9d5b5fe2
-
Filesize
1.2MB
MD5d85eaaf24b0d572de1ce663ccc4c929b
SHA18fd0a1df21e3ff7ef18ca2f0f06e39c3d6d9162e
SHA256b11b7981324f82b7bbee7599a21cc8efae9e55b8a5d84c8ed2a00e570d93560a
SHA512cbf6a15511f67c68f81bcb248011f29e97cbf5e0a2e193dcb1a9b72f572777671e5df4d5556520a18db504854ec03098122814c90cf832c62ae6ceb92d8aa5df
-
Filesize
1.2MB
MD59c80e92a60ba7ad785ef278474b51a9f
SHA18177586f62469a8483d9cb45f0e215a7f8b1d8d5
SHA256cc92f386c6966b65d0c3cf235620ee12d47d69a82e1a8af71daa95f3d0f378af
SHA512d86ed41c1db6d617714f4d301b931c2634c3a35eef3dccad31822771199ab5d0cd71ca63d990027c3b349861256f001c6810d02771c5fe27a6b031369e4f1b81
-
Filesize
1.2MB
MD5f0e175e529af58908d7238bde6bac1c5
SHA1eb1d0f36d502025801d15cfa2eaf096eb92334d6
SHA2568da50e69892944fa2a6af6236073b65a329e10e5301d8775ea7e0b4ebdb855d1
SHA512d7a08dcdbe204299720a9adf93a2d87f93db65b2c1ce2dbebc370606912a4ae06c530585a0a616cf9c5788c5ee9a4a55898ab2af7944390e46ad23c0d3f2cd9f
-
Filesize
1.2MB
MD5843d1d2b979e3bbcfd949fbd7b2d8b5d
SHA11a38a13196dac4841c0b62173ff8d5de4c8a6fba
SHA2567780279bff155ea80131cf8a3c9d7d745b3f610218446e43f5823332a05b92cc
SHA5124d3c3d866901ceaae4c27d9d9be8ab7a074d32c185cfaf9e87094466b5cda3194931d539b539c5038567607b23210b3fa011d376ca2d029dca4de4b234e0c03d
-
Filesize
1.2MB
MD54297648720ed54e5a6cb820bb550aab0
SHA15fe2c34ea11d34623daf0a653acbfed7bd7df5ef
SHA25623f6eb60024f3d84af6a29f04a3758bec314955809c0e9f0b66425c78a8b4050
SHA512e47a29985cba33be0821ffdad84ea7923d9786d5e221768b7abc43e1f64f6bbbad71b66698a085a22ca93b86e0e31857fbd2cdc6385a1c6ada7ff75bc5a57993
-
Filesize
1.2MB
MD54c1680522d1530e05a7462be3075a746
SHA1a886d8e1f0704d833ca835f79de4a4bf1f4c7a99
SHA256d9f1b020f29fd9c7f3b2fb93dedfae7138683009cd41ffe9a5b38a09b287ae3d
SHA512477c3a62871ddfd832290c93ba4adacef656010ea8a36a2610e3f2369a27cb0e6d08f375e96c93b1ea13b01ed30c902518456dd68a797297c6034d66deaad9ff
-
Filesize
1.2MB
MD5bf9330ffaf4b458619a98f6437a05d6a
SHA15465959628cb07ff2cc2dacc2969db5f9007c1d3
SHA256ae875cb6f0e92b96fc799bb9183822aeb308d855f870af4cd04f87dc470f519e
SHA5127bbcb7df9972fcf88338002297f8f659ba3be52c2817a3264122f57f5fd39ef09f26c67e767b20eced18a109398fd53ac62ec4338958cc398ec4cf2a5686305c
-
Filesize
1.4MB
MD52d940fb2b41693fcd046546fe192ff46
SHA15bb69c08e1da84ec6014381aab60be5932e69d5e
SHA256a739cc2da57110f1162d8236eab7a26dfa4e0110be995c6875b3842ec8f28b19
SHA512fd362ae105562517089005886fbf62ff5403ffb1e85d23f333bdb0d3d30f11a3357edee515a05f0324b2121ff4ddd363a586126ed0986fd0071ea74948f17852
-
Filesize
1.2MB
MD5ac29deceb95bec2084a99928022f7f78
SHA1cc37178f7bef3a5077cf7702274b55341df188d4
SHA25602e4c0d37bddc44aff5a0db8f06ac37af9fae7fe178f41002c133f19950fb0d5
SHA5121e88aaba404d95f7644eb6405deac81ef45183862349d0f71bf6b30a089d0eaddf9a30362fd49c1d3c38984c50107f30add2d6318d66c23be2338f8a55dd85e6
-
Filesize
1.2MB
MD509ae7050985248473b81053661e8c3d7
SHA115f0beaf8cbb0bdddb975cea57ecd7fa1b530fb5
SHA256086fdf5f4fa088dfbf3823c2cba4bc4f1467c8613b62c74cf97525daa5a383b2
SHA5128ede7586939828e88c9defbb8eb1a902f01c8d6fb36f6815a1b848936126407cea54e8af3b6a461d83d098eea373bda08182d47dbbbbc741b39774e008b5b78b
-
Filesize
1.3MB
MD5a0842176b1425f3931a2be4ff373c4d0
SHA1618c0e2b123ce94b29fa280a7ffc786273e31a77
SHA25658af741b3265d0fb31e0da35966762185a55f29f6c9485b96c4493871d5f2ecb
SHA512414c18372416415f62eaf27c15fc099e6ff1c82c5f5bf66cef657ef83e454185a2c25a2163c209c496e7b126af831644f38341b9f949ae309d689849be90f447
-
Filesize
1.2MB
MD57f3505b0f131c1b10cf7c6c950c15760
SHA167fd92398204d22f3e1b52a88a816f3d2f233852
SHA256eb6ffce962fde38646d7a5f1723ad2e409f63ec48883cfac3d4f7d639d81369f
SHA512fe016664a135436537f065f77a8520e4ea9150344ef5e8250e33e13f66bff01e4773ddf5ffa2b1d3f5208bdc10dba797a21ded766e4df1c68b491b7cb6c1649d
-
Filesize
1.2MB
MD56e1bd8317a2805f73fd1569949000ada
SHA171615f89e71901d1d6e29a2acf22b12436f77f71
SHA256b5beab17f315b6f48fd7b56740fa95b1cbd0f5147ce06adab5c8a323623df1c8
SHA512f1c6fc2bebec71ba155b2b66e1395a004c36be925a17864963f1686411179a65a5c3bda595ef992cb5ed655b82387cacf49e9adbbaaf58d49b7e7b1f31455108
-
Filesize
1.3MB
MD591d075014a541c7b60a9527b0466b203
SHA1a0a84d41007db2b908f780bcdeef31829a3bb89b
SHA2562192b234f66d1c4194c75a8ffc35aa474a8f9a0c3bf705bdf056e4cd14300034
SHA512198b7eaa59ac1734cacd09f34ae6498f8be1094b735853b3aad19a011b0a47386b2fcb9c7daeec3e2f78ee5b349bcdf368ea34f5173a88c91d3761b885981710
-
Filesize
1.4MB
MD5743db20981411a56734b9a49a389a469
SHA18ec6df7a064e95999b7746a5c909d2833875e266
SHA256e2ec3a0e83ea249cfc7892339e6d1dec0603f79528fd666720da3fadc0e4367d
SHA5120cd53e7f10c5df1bf51aaa251a41b160783365bb1c00dd680202f43960ad577704f276031f7f5ecbaf9010588ac457f1ade86bfdcf8a0a97280af21236925222
-
Filesize
1.6MB
MD59bf17fafc63199e3d3c10983b822e74f
SHA10596f74cdb8bfc7d1e7194599f0fcacbfa607848
SHA2566c3c6dcb2b9f3c143b36d774469a3eb6fc2f108eaa4f1efd3f842bbcf8be05ba
SHA512a8af379deb6544ef8e9b3909b7e0a8e6a7b77e7b09b5c3ce37469bf92df10676a961fdf2915681fcb84eab7b4efab652d327befe21d263a817b30ed0d2fe34d2
-
Filesize
1.2MB
MD5f910143b7e3a8089eeae012d143ca407
SHA1aca99e5147cbec6df5e77c3eff9b17e7de381752
SHA256e1c727b7469f99b8308c80627bbb4296af8384531bf76178225a3b203fee7475
SHA512429c6c07da699d8df5c86bff9c745ca6f67547867ac65cf70c51c132582aec8024739d2f3d67c566b1e7e52d77cc57952207b0a5f233a568d99a5c1ea01ad9e8
-
Filesize
1.2MB
MD5cf4f46ce8f956a7ce68e76b3528579b6
SHA17c8b43998203b7e92127f12806e29d85f0bd79a3
SHA256d45777c6f761c40c3789edd7c0e6604a04440a4dc500b0f452e39dd49607c2e7
SHA51296c7e78b3fe56bd6c86ba51afe78008433d4dca786c8ab32dc9fa8d72e55ad33e59ecdcaf40c1c1c8a0d519b65322e7acd4cd97667a6060041123b3b30f8c28e
-
Filesize
1.2MB
MD5563deebbcbccd2c139f6a143696f7d87
SHA16184a389d52d6a8de5627b1331d35b0ce885ad34
SHA256f6ce4b3b6cbbc0e9f3c8be5cce87669fa9e353ccf51fe5650d23160d28600cec
SHA512558d7ff3d18f78d6b1fb59d018b12d1d4c999f1bb6bf532179940868f32c7525c98beb20cfe966d60b891e323b16a457e75645cb8a6dc5222c85aea585a0bdb2
-
Filesize
1.2MB
MD54d3132c3b5223457d940d8acaf051d3e
SHA1a3178a34b78b80205a7d4198e213ed6da66ce94b
SHA25667cb3ec37bd1bc54102b533048fdb188cf6651088f0578163e0b024b544f46ce
SHA51209b4b9bcf05d691120982c4db306002c2f384f059101f6d6a8ed3f9cefff4a1b2d40da857d630ea939bd46ebe42538d76f87272a43774c09e32f150390bec9d4
-
Filesize
1.2MB
MD5540b6880f8ac450771b174772c74d069
SHA1598db59028c01ada1c2e24a2014214e2e1194901
SHA256dbaf0825fa15086d4dcaac3e609b18d3937134c2b0af70414a322e7b9a141e69
SHA512395fef28e06af40823ca33264b4c12eb563b44ebf652a43ebd73f5d791582690652d3a258d99f8a10ded46589b65d35c2265aa02d1d6992988e7aba9b1bc75df
-
Filesize
1.2MB
MD518bd3328e05a6be2110073639f28d520
SHA120142f264dde8e2133c3bc661b20755bc6b6b0d6
SHA256a4425cd22daa49a83c459e6a2843841b7a599d6fd1a221dcae5e86c3a7848f42
SHA5121b236247c946c12c2fbeb4763e8a3f8c09a907cf99bf5f97051eb64b53c3b393f0e5f15ead40af94efeaed91a9c0b9264658328fca84a7189e6a0509eeef2815
-
Filesize
1.2MB
MD5d5bd80497323eb778f99002628c115a3
SHA1b8290886ff18297ff4ee54064282f9754888430f
SHA256e10bf4c8811813fce8074277ed5ff6645d49418d6839d159713a3e81b07e56bb
SHA512df986acd2ec704f7711be34885ca0f8ff3486e8ed44721b94069e79801d4e87dce5052df4e004d0ff220d7e7ebeaa871187fc720da1074ea3ad705156754c570
-
Filesize
1.2MB
MD5f4a6f68492e1097c8eb1c2510a63d9d9
SHA1a79c9368b0571b0ded276a4794142f66996df7fe
SHA25626b0c17857bc29122a9a723bd4a9266f1920ea759fb06e1e2e13737c821c631a
SHA512eedfe252fc60efb8f0be24f9c0b154845f5aaabce819a75a22055d36a4d1f0b15a1876a040819127e16daa512bb9cd78c1fc7c06d728ee401d416631e2a2aec1
-
Filesize
1.2MB
MD5ce3f2a3c27feae0fe8b99f4357e6deba
SHA1ddfb863666e3820175fb742b64825f7ea643074d
SHA2561a62b480444ee53f55f994013d90a8e3874aa938dbf4eb61cb05ea31a4f5782e
SHA512ea8e671fab1e7f847e3bcb199d62681562e05c30ac61325510f9b9e9b562c5432586063ecec31fa5e5351a42a4a7267c52fed04b06a0e3ffd3f8357a8cb45d2f
-
Filesize
1.2MB
MD5c5a4070f95de285090896755215ee352
SHA1e290538350c9d4c12d928e503c1a200fa2c7854c
SHA256262c9b7e73cda083191aa5f33236fd5fb02f1ae67b0768b6a23970a690c7800e
SHA5127290dbf43f74270ef6c0c6ab1a0f1b5370e3e64d98cb943535e123bcf3c35b00e130066b718f030c05f83c3cf58777a5d52efb82852b7d35233b3e815eff1ab9
-
Filesize
1.2MB
MD5b0c940345650b24df65c9ec650effc0f
SHA14ed704f18a882eb29aa1bebd474f5095cd8df780
SHA256c1083c81e3b988f8b0f89dafee9c807c4474a979126ca5ff9c3bd7400e8bb64f
SHA512dfa78fdc56b1c8962225a08691f48eaac6814202e5c6eec5ea41e756a40b1f96fcde4b68d92d1fca27698ee367360ab3e39f95c5f2e4aa001415806ba5447aa3
-
Filesize
1.2MB
MD58a82bda2d704ed86cd1e04173f8a64cc
SHA1981dfdfc2ab146ffa157b981a717ce0eeace6b47
SHA256a68ea64f33324c17a161826b2405c4940e5bac7b4da4417a3ed4c985a88a1f76
SHA512a4ec2fdf48daee2bd2b25332836c37009b0a726ee61f5cd037806c11a95df7670aa0b1a3ce89ba205c66d15ff33c77f241992647403b2468038ceee5d13d45f9
-
Filesize
1.2MB
MD5f7a0ac9859548174375feced96c411d8
SHA1526280ef51eab0eaebc52068f21af18e4a7b7eef
SHA256b90a6d8ef37a7b8fde93682fcdc2a4745cc2f4d51f62bb9e71a9e83e4a38dea5
SHA512fbf54a8498cf432a471807a3b8f1c70a417c2aefc0f022aa554e11ccc4942f9fd7e9d80a23e1ff749d269a63f51a5853bb720b8f9c52bf95b7cfb02bde827d07
-
Filesize
1.2MB
MD5ab5a3ea0b407527493babd018c7eff2f
SHA15cf77c6d50ef39a4ad2e6fd38d6ae777ae18e742
SHA256e251b18aa8a6d74bb43a8c0cc2281a45a3bb9cc3acf83fb37af83fb139a0f881
SHA512484b4daa4f5322b352e06525ce691f6f90de737fe35de0a2e0dd667565e4dff220331a92320d2908f8603f8d0a1d8ea00a7dbd2518441ae310235836fba5f86b
-
Filesize
1.2MB
MD5618adb7c698451949c463df439ed68fd
SHA14dc2665b84b6b0e98e6f45620cdc165c33ecd740
SHA256a5603aabf2ea96149ebd916056d81a41f7e8a529c50d4ceeb2d789d8586e2e97
SHA512e6ff3a011fc33fdc82d1007cfe1e732e72a3453611df7da1cae032cd85ff17d356214f0b78225de9eb0edbeaa89660efe284783a9b5ba872e78cffcf0e074e67
-
Filesize
1.2MB
MD5b4ec48c57689c10aff459b7b011dba3d
SHA12cdc31133fb89abb5a96dd6eed1960941d418a77
SHA25676f4d5ed5602048e297d3d96474140b2fc72c490beaf56519d2b82376bc93d8d
SHA512b6e4e3a980eb69dbbd3e80bc7c96d6c7cf4c4b094cb15eec9893b1c30ae2c2a490e1b142dd94522b05752a5e5cfa3f6ec0ee24e8bcf8bb123e30830d7c3474a4
-
Filesize
1.2MB
MD5ea6aae79d427099a1f83359f7e3c0739
SHA17df74c68d9dcb1dadc5f8aa2d7a0228c4b012d66
SHA256ff2fa851a7a7a010a30c6ef9baf2b7f4920fda2a7fccc57bd8ec6b26786469a6
SHA512c5a35a8446831d4f08b451026524c945a5cd42984496d9e6a2ed53e2835228d1cc71a713774039f0c4c5417627ba689d738010fa638b08beccce970174b320aa
-
Filesize
1.2MB
MD56559634aaabe1685a1c0e9a8907e3258
SHA16ca673c768e76ad588c13c2be229e4f693060f4d
SHA25667aabd06deb377fdcd6bd4cc55773b99a033918322a23139348bca3cead0b5d7
SHA512e37f4ff2f2502734b6fbaba7e251507d982224c2f637d28aef253426880a7f19eb7e4120d3de95c77bb5d43c29894dfbaf0c8d2c7de36ae175c75b44a236cd0a
-
Filesize
1.2MB
MD50fa8bb58d8bb6c56562e44d77b3a2955
SHA1ac186db42b7ead1ace932338caf8730ad93a3d15
SHA256269829a514586bc44b8e365b9dc51441e48e2edf13e1bbee6a2d90eae530cdb2
SHA512884c3f419804ef50305468b85a8b97527c0f4012dd44dec1b944bbaf5cb6aeed2ff37a385f6797d6828685c9bafe13a2a95ec6f9b2766da52a64bbce15087fcb
-
Filesize
1.2MB
MD5c90c093bcfe25e0bfbdde8d25783c90b
SHA178f1efc127fe06771b7ad86b9d4d8a596ebe7e0d
SHA25687c3b3ce6b4e49375a752d344f27b83658fd35d1066333fb5756332ac55ec78f
SHA512c19fc83d8666236167a649b07e881a7f8fc0324790651c6113ec3d54b544ff7135dc670716276d4b14d163b475c3fb5f489dbe1275efce70307eba1d1fbd0a99
-
Filesize
1.2MB
MD5ef09f18d1449efc35b2acade11884d02
SHA151cde8de8a98bee2e4a36fa0144bed7e28129787
SHA256a67ecf8fcd573da2be10882675073fa27262e32406359ed1e079fc422adcd684
SHA51215fca04e6e6b304d0aabebbdd33c045e5d90e8b7b8ced3013feb9d6a63e894f2cb5acf570d9c8dddc850d1aa707e61d335e42b867ad1f68d86887c05dc06d739
-
Filesize
1.3MB
MD525740a069d662e1e8962d9570994b4a2
SHA14e4f5e3daf9198770faff13af51fa6c54fa821db
SHA256efd9412889d45c8479cbb6b4fc7a3ad9b522b7850eee2cb6db023b1042ebf8a2
SHA512c6194d2df0842e79f097149b88a6ef18f853980a648b07c582b0e0a57de3afb47d41b84a82eb0b9fad7dad0cc3763f0dd4ef9b7a42125f0a648f248f52b6158d
-
Filesize
1.2MB
MD58e1e845714888f57100b1bc64fdf12cd
SHA1ce6b64ba794413b76730dcfdfcab5709820e2ea0
SHA256a12b7ac454adfda67d0affa91467e721075b4c96ca54b8a5f75308b3348ed6c3
SHA512281ccb7bf83e5de3639f4eadd39cfe845728fa6b02bc66b654ad36f83dd441dc15e1ddb757e921044d114caaae63ae0262b9b60ba132a669a134310b257a3f0c
-
Filesize
1.2MB
MD520b252c8a82a12df3f8bc8ead03e4b2e
SHA1ab8cf5a6f8892f6d2ae876029ccc96ed3c3d98ea
SHA25688ffe733a8994deed1a76a7dd69b28f8e44ce1075ba94224b17599705b9aa8de
SHA5127877ef83d3a895bbb61a5f0d18dd246267d011c0be48a3bb12a45fb2c7070a84d059c6f986da03da90e9d26ebad473c71722d06b29636dd07b9e599474c65931
-
Filesize
1.3MB
MD5c5225ff0451771aab6fa0317ca29926f
SHA11bcf42b6663c157591bb1f2507f124d79d527a8a
SHA256694be2769b4a92f95ef11ac832b3be6f3241072f018328b9bf415ec179bc57b7
SHA51254ff0ce024a88a5e213b7fee26eb340126929e94b76a22141db6475cac47ab38fb7e60e3277b6ccd518a8f8affc6a20d69bd08b2f4e8a4219bbc2fe017e31efc
-
Filesize
1.2MB
MD5d45f1f4df7771d8ffdadaa3264638846
SHA11742a78b9c0ca6bd8c070c69d2fc1fe490e0e359
SHA256b6269100c3f4ea48f56c8fb56b13ce1bccf7f5cb72ca67f7c65db3d6fa336267
SHA5124d43cc8732c9c95fcf6e6bfe9000f9fda269386228d61f7aed7aabd49c9a99d096aef6f3c790db05728365c989d30e9d9b5c551e455946e926b62c42e6166751