Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
23-01-2024 16:47
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-23_3334a88e14aef54b58eb4cbf57f997d5_ryuk.exe
Resource
win7-20231215-en
General
-
Target
2024-01-23_3334a88e14aef54b58eb4cbf57f997d5_ryuk.exe
-
Size
2.2MB
-
MD5
3334a88e14aef54b58eb4cbf57f997d5
-
SHA1
14cfeb94e0318aac70c03d681069393958db3688
-
SHA256
d3e3ef9a45bbd707b32b4761949cb4480b217c6a6739a4c8b6b0fbc892b0beee
-
SHA512
62df9f78eb0e799a5e09c2e74820e1c3cea4c8ff9a10f5ae98dbdea65f179c913ca45845e0fcf26225690df00a790f3370ab284785c0faadfb7f6293acce67af
-
SSDEEP
49152:fOOh3aN4kuLbegmtGBgDUYmvFur31yAipQCtXxc0H:3U4ku/ctTU7dG1yfpVBlH
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 5072 alg.exe 5116 DiagnosticsHub.StandardCollector.Service.exe 4148 fxssvc.exe 680 elevation_service.exe 3456 elevation_service.exe 4264 maintenanceservice.exe 776 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\System32\alg.exe 2024-01-23_3334a88e14aef54b58eb4cbf57f997d5_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-01-23_3334a88e14aef54b58eb4cbf57f997d5_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-01-23_3334a88e14aef54b58eb4cbf57f997d5_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-01-23_3334a88e14aef54b58eb4cbf57f997d5_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\8b3ebc29c92b1ccd.bin alg.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-01-23_3334a88e14aef54b58eb4cbf57f997d5_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe alg.exe File opened for modification C:\Program Files\7-Zip\7z.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{6E55939B-E83A-4A23-9444-92FC9402812C}\chrome_installer.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe alg.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe alg.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2024-01-23_3334a88e14aef54b58eb4cbf57f997d5_ryuk.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 5116 DiagnosticsHub.StandardCollector.Service.exe 5116 DiagnosticsHub.StandardCollector.Service.exe 5116 DiagnosticsHub.StandardCollector.Service.exe 5116 DiagnosticsHub.StandardCollector.Service.exe 5116 DiagnosticsHub.StandardCollector.Service.exe 5116 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 672 Process not Found 672 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3768 2024-01-23_3334a88e14aef54b58eb4cbf57f997d5_ryuk.exe Token: SeAuditPrivilege 4148 fxssvc.exe Token: SeDebugPrivilege 5072 alg.exe Token: SeDebugPrivilege 5072 alg.exe Token: SeDebugPrivilege 5072 alg.exe Token: SeDebugPrivilege 5116 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-23_3334a88e14aef54b58eb4cbf57f997d5_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-23_3334a88e14aef54b58eb4cbf57f997d5_ryuk.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3768
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5072
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5116
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:4272
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4148
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
PID:680
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3456
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4264
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:776
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD566e3ac7c5bd54b940db2af781886f291
SHA14420075b9bc36df0e8dd2f7492873e3135ddc543
SHA256b214652b3af491193926baa163bfb51241a98fa7ef52fa1fc492f5c82123b4fd
SHA51259ad6ebc6f555d1e2084ab3e3c1cb965d0a98f35ce27bc86ad6ded5671824eae442da4802172b6801aa1abccd508b281157db34b92a3168695ebbfd88fe82fca
-
Filesize
781KB
MD548dcdfedb43cadb649f04f4a188b9b87
SHA110c5148de8e63df84dbaae11b814d52fa2b1d748
SHA2562cf2aa27f8997de7afee7e2d8fd37afa837c420097236b1b2e9e58fe1ce19299
SHA512f45be06b7cacdda538579d324430226589fb5443e274e6462805f984589768ca1147e426f265a92e6e83858277cde344aeee8548b59d2152b0d679ef1d62b415
-
Filesize
128KB
MD56f989f1ba0251d99c54adf9d5061c9ed
SHA1f6d4a5adbbd97bfff380bfb793badd552c2026cb
SHA256b5b48269d31ddb9312d3817f55eee315201952dae6e08dea87e00693adc429cd
SHA512eeacbb5ce03d05233075139b845a68553aacd118eace5e0314046df7ed069c4c103f22ef38db172405e8ca7d33e5747db8ec24f2a3ea98c9e88807fab0fb82db
-
Filesize
1.1MB
MD577496d75e9e977aa0bbcec328dd57b52
SHA1ae2059b69638a927b1de25e47548cc6869202a41
SHA2563db68f4a4831b195693efff090f96db91f80fe9c91bce877991327858615e51a
SHA5120e9a732a9e38baacefca3707183a76e37d16fdbd2d89888f74befdbb4b92e3716ea5d6cf076a5064e6ce3896b798eacb742ada471afbeda6f0a5ba0ac1b98c28
-
Filesize
1.5MB
MD5499b06888b253a4a981d3e07a1bd7425
SHA10a9a0ae6e706fc9119d99d2d082561f2b75f715c
SHA256afbcda35e4a3c041b47570c27954d822f374b728631ac890aa5ba2e4faedd1c8
SHA5123d08c1c9b57813ea28855f45f9d5f8eb1a70aec2d6f74c6f23dabb8034688b0c99f628f79289e9ff078c4a564e4496691e9483b966af2cc413f7d6106dcdf296
-
Filesize
1.2MB
MD526cc52ae2292283d324e9605038a3c31
SHA1a3d6bd8774d318332de8d38ffff20deed8ce5a04
SHA256da27cc4949e4f207566bee7130b924aed1178d21cba6c06b53614a24fc065214
SHA512466298b58a12d1acb43eb2892ec7144afed94c45f70c5fa4cf1c4e7fbce7458dbd76286de7078678c01095249af39cee0e61ee035cb22aa97150dcbb3753dbef
-
Filesize
582KB
MD53fdf6380a09223e168c111d0dfaec23e
SHA1ce3fce1800efd062af0d5be4582d2b552ef57392
SHA2561c5325a2a2fa2e58f19cb7b65d8b9bb1356e06a8c330b850cf78563fdf74bb79
SHA512d5290332120e869154c006cc923657897630ac41579c8fe0c31760c6a3b8f2c97b6e0b391a99e16258fe8ee2c85ab477993cb297e039bc886230b8af962f1480
-
Filesize
840KB
MD5f833953f33a24eace523f249cb2e9312
SHA1b934bec35d3e34e2951500d833f42650305b500b
SHA25609469003136ab9de5831e62727b2ae51f58a3b554805cbb8fa34588a12d262cf
SHA512431dbdae50173383841809d21cba41962029181b47abd74481907f582719526d6586472ef22f3ed28f3eda6ae8924042243bafbdd415b45b43c8f0c334133ae2
-
Filesize
4.6MB
MD539590c70d20bf1f0bc5a16bb8eae29f7
SHA12ef2ed9e4862754902bfb00fbc26b0bb730a5995
SHA256c8f61fbe1cd9da375d9015205c128a6a55d04081e114093755cca7181053b46f
SHA5126667529177adc011016d670e70bc98ad0338feb6dbe8602ff441494852c45c315ca791cc5253d2e4872846b6237c3de1d3fe269548f03c4ef603acefdc96a556
-
Filesize
512KB
MD5dd1171b5e5759c1ac01c9a00b213c04b
SHA1d49d2da638b7576637a187cb8ae020516b2202a0
SHA256c0d3a88b2cdb75ef7b2eda8cbd81a186e42281fec7b6b8e3a4276fdd18e0735b
SHA512f84992ee051d6e875c0586e7781c92bdb7ac2b454c6e9815da5a8acab5a41c2027a74fa3edc1e759c34eb9ecd04850787c5310db6b18fb7cd5253417ce2c106e
-
Filesize
512KB
MD51699a31a4d5ad22952453b373e066fee
SHA146db055de4a19ee7920e2f67e42dbbe4d2952df1
SHA25666f8576cdc79551d2d4782132afd28b6ff8a8604b38246f0e7b94a31f9aadd09
SHA512cbe1b3a3284fcc52dc8fdd4f006a581d67136507bb7f8058ee17731173deccff5bb2784765a54af1e77f23a2bbe976044b7e5a32b5463220593aed52f588b3e9
-
Filesize
2.7MB
MD5bc062294670859c24cd740b93afffc58
SHA1e1fb2a3439f2b929e7229dfcc0e5d704d5683f8e
SHA25645eceef9bf877245dd8d2834a4c83bc949c681e2519c4b207e723f9b87777b5b
SHA512d0208e16eab0ba9b22b3a2409fab8d220a44c3103afece42883382d5302dc2f1e2d71fbd3463d2408afb222a0da460f6465d5b50b7e29b6d757185ee0fb4008a
-
Filesize
1.1MB
MD5c6b8f1e5f6995ce0ac548d5d2687497c
SHA1de1ed1fef7abcb049df96d07497e49359d934ddd
SHA2564a5cdc13ed3adbe71632014ff7e6ed52ab07d8ac6f5e2c6cda148893f0102be7
SHA512cb825a674d0127b73e06e73865d4f2a562bb7215868d297adf219fbbd14314b636bee0261274c3f3893a0c703d06721f31a1d6cf4f1f37c437d68c493abbdc3b
-
Filesize
805KB
MD5e7e13048b6264cee78448743962f583c
SHA119d2cd23f560df5a7dfc71e3e61ff22128646c44
SHA256b4c89052148d200c58f5d2b863ff5a443cc4699bc5dee0651c4dd27474fde558
SHA5123148956a47246ce37703beb8b14aded4a84d4fa7021ea583c053fcdebc1482a74e55dd4ec01e8684eb9fbae1d13deaa475fef41d0a259c6fa0d582f0382859f0
-
Filesize
512KB
MD50f35f8ee5d5abadc30b18f7eb17331a8
SHA165363658386e71cfa81007e96461abe626997051
SHA256085d25449c951e128f412e5675e9d74d146eda4c11f86ebd2869dd4ae249ad74
SHA5129e1ee4edc7523b0b06c6b67e141337ac2d2f10577538efcbff2cac25b48236d72f420340e75b9394138865296e126b318b919f8de9c832947c3c28d853c031ed
-
Filesize
4.8MB
MD5d89e4ae77c73c979f3b7c85bcf685c11
SHA1bcede40d66f0feb7be8e7c1ba5c731f3695fe0d3
SHA2566eb31b29b35171393d9c875b668302553aceae846ca939cf78c2c2fb4dd2edaa
SHA51272fe16c72e72e70fa4264660bf081668670bbc97d066ae71d4caa9ba24a6b85fec4a2ef7a2bb48d5deb42dd12732e5e1d3641772cdb8c0186c704978bea5c2d5
-
Filesize
4.8MB
MD587943a71e067e475f6dac4dc5763ef0c
SHA1e8f73ff0bcfee7fa43fe5279f89c71a395ea1658
SHA25684edb4c2c9094904253f6a38fc264c7067656786330801e90e44f9873465efc7
SHA51239b41a47982b63cf392728cf74642d968fcd52728477dddc854b6036801032b71866e9233f472a50a985ba5a9effbdef03ecac5585f6a191adf235fab9058375
-
Filesize
2.2MB
MD59acab775a0bdb702ed9f00cb43577e77
SHA190a7eb9d28907f9a32053fe62ab23782e9f4276c
SHA256b70a07bdf9535dc343c991bb60a50577a8c491180cadb54f20dfb267479e2c9e
SHA512803944721b350bcb9a17e823ee0bb5d814bcdc8c4a1bf8b14c2807ed9df57f6610d0daa3e377fb0cf15c72dbd651356d41c700b1dc905380af2ec81039043e69
-
Filesize
2.1MB
MD5f468c5a77230d70701a745cec06e5ddc
SHA147bf099b7430c084c33d4a53370d3fc3e05b6c6e
SHA2563d4955be13cc5641ea5071e2c66809d7a77246f87693fd5db2b2fdc7d72be822
SHA512d24775a97ac21fb66ce4726b372e6afecb669ada370c396244864ff54b386fac9383b5935f34839489dc39673b938029bf6a9ac98ca503dc64dae1b5942c15c8
-
Filesize
1.8MB
MD5b7d6c110af08e824d4375fa1aaebb876
SHA12200dad7ca6456cb269e535603cb046fd3cee584
SHA2569c6bd0564728fd4433558b6cc390b91aa5eede6825042fc65476390957a5e570
SHA51210b723324a4f7f76b84aa0fcdddc6612efc1cd251ac6a1f9c650c7bc6f4e428080091965ecc48629ec2914589b7b71c86cc5ea5c75c0350f66fd164c02465d7a
-
Filesize
1.5MB
MD5ff57ee9e26057bad9fdd4bb378434da9
SHA1870124d914e17a4cd740ec60c6f44dc3774415a2
SHA256c15dcbf2d8fcaf26b9f238ec74954278f999a223718869270e471347aa114309
SHA512cac8b9caee6476f4844003f44cfe60c2774228b7692d2fa1573af94e49bc458f71eae08f597f2e711494cff17dd258fca5e2a9806bd6a5ae4c43ffccb3085f25
-
Filesize
581KB
MD5b1b10ba80184bcb8e3f9cab8967ff396
SHA1594de5160f3588ebb1a181aed1ebba92355a7895
SHA2563b633886401ddb7d3e1727ab4a8538dadbd4966d29ff29e7aafcf20ea6ebf967
SHA512cfde3a5d84ef9c265840267b2200e69cfbb21fac2cef4dfc9bd02d479cf86d7ca4b6f74525bd88593ead7a3c0166360f5616c1f58ae672f9d69b24005cc04ed9
-
Filesize
581KB
MD5b13c51344c12c31ca39f7abacfc93430
SHA125cf01d09a1fb5849b4933a0af3a5c24305068d6
SHA256cdba6aaa661d74de7fcb676a81b59258a74894ed5e3761f2d0e803a087b4ac87
SHA51245089e8b80bc1a9743ff1457f500c003fd51795403ac67f3b3c1924b8a1e4884acadfd9a471a5b4799da0e765b4897e5b65b522f96c835a6a82385f6f19c1dfd
-
Filesize
581KB
MD514120f62df3a8b0e6d0cd8fea5dd48bd
SHA150b179579c4964135a5bb1e844d657088d2ab760
SHA256c46af11a73e42d02a1a8297978c2170f69ffb8b0e44ae725d0eeb89391fc7f9d
SHA5128814e95484e03030c50e953d900bcda2e781974cc9072d80a0890003d5245a203bbd717f83a8573776d5b3cb5cc1dca21dc4a9b78d0e82a65de16d1a167ada4e
-
Filesize
601KB
MD509fa0058c46d977e473f13ad025468c8
SHA1f4c1547f09ca2c1448fea02346ec0c0f8a8f5e1b
SHA256a244a06bdb5cbbad662c2d2172e936a19bfcb910aa1f77dc254c904648872937
SHA51240e17690c01e7fc136bfe9c2fbf0f8e6cff10d50ead997310b43c7232837485f6b2354767b7a4fcf31e7c6c01dcd53b9c26d971a0999e492f8511d6852862f6c
-
Filesize
581KB
MD50e0b3cb76e70740b05546a3fe2b58262
SHA1464e6e0ad2305f6338772c8876ac7528aee960b2
SHA2566c2bae8d75271fdaf7b00fbdafc99651387c3504fcd3c9eee239a37a738b662f
SHA512ea10eb65dfdefd13e4c4d5de9f263fbb119dba0001f05b303ee9e48ceccab695c55d4839016830465fffcab5f54922504b0745e35a3e83c638d31875c8b4ce3d
-
Filesize
581KB
MD51b430d523dc700343bf27537b623442d
SHA1e4cc81e49152016023073362578bb38a2b7af058
SHA2562fa87bb4e3ec58461c45039d16a49ecd088503aa49dab62a54d5e182749d2065
SHA5125c00d2d928a4eafc9694dec091f58be280aa25d188f81fc7112e2d12097132bd6ce51ba120f1005311ca265b731d4528ecf4cb3c13a9262722751cc3a76978e2
-
Filesize
581KB
MD52ceb38142cf5ea35adee39af21c3efc9
SHA1cd331325365c428113ac342f21a60b6872f389b7
SHA256db80ec2cc9c5ceb99d8add283ce38b7e1f6819c868900ff840a6b133c3ea8962
SHA512605e882b901002f8f7cd36bffcebdb2565a4837db1d67b965420e6044723662d63409eaa7d1bd494edd821bbc485f1e0d96f5c1ab2f774a7e17f9f40832bf682
-
Filesize
841KB
MD5485d14e8f3813a40ffb06429b2eec295
SHA179db03a73bde4af552cf36468c39ff8253829cf9
SHA2562257e1d33bd132cfe81cc00e891acd2f46c96d20e7c23f9e9c4d1702f8882587
SHA5126b58dda354706662a1e6adbd9fdbd3a4791f11d268f9137626534ec3e8a0ac9a5dd0ff4bce3f71707783a9997a2930809eb35283a2b7511c38e708dd110ab4e9
-
Filesize
581KB
MD5b54c7bccd3d4def887e9b26f6fcf8075
SHA1b3b1f2ed96932f914d8bd2d0d52867f06aa03ad6
SHA256178e3dcc545a39f920382f7e24f68ec383e5840257bdffdeaf93736634bb17a9
SHA512acff0f66109e982a62c60a48b8f8a3435efa47c5415cb8dad1be46ef535c7bcf2c69077b28088aff09c4487eb399356c1b05a27b44faf8ad23a2fce9b3fec31a
-
Filesize
581KB
MD5d65000cc1c3bc2664c96a531032aa6a0
SHA140aa304f1da7d2f69f19fbed7be81342e6611743
SHA256b967e4a7ca76300b3de7a4e4a273efe477a1e82b895ea550f3cbf3ab2c28cb6e
SHA5124a2250e1a74d25285638f2ab1fed9e6b6070d3f4aa00b8fd4d7ae891ecfee274b7ddab67ee8059c70c98218eabef6a7f402dc04527afe1615201388ca08f20e7
-
Filesize
717KB
MD5843998fd2484942a2c885442637e77cf
SHA12ce5047374164979e0bf07a291241857e104274a
SHA256b938a7f70221907f5ebae4fd5f52d15a58085c657cbcc44e9c3a0828328f11fa
SHA512b50d670ef18db8a7b246460eb9a76aa5843b301c1f47bc444a6f52de6bb035823086e6bd06bad959c2c2db6840dc923071ac55492ccc2340826d5ab045ea4b34
-
Filesize
581KB
MD5246f69ee32278fca6d51c35d104abfa6
SHA1733d384e5fa01f3528130d4b63e15fa83846d1ca
SHA2561f4792b4122c381c4d28bb18901941d9114ff8e945182bc70688092a9e3bfc52
SHA5128126959839c873d4f6eb35e67bb790857c95e1238dc0dab2809787301e34a4ac8ecc96b3f1b439096d91ad4c4fb02357c8fb84d41f87fa99a97596b9bbeac69b
-
Filesize
581KB
MD59cebfe88636b41a94acd55a24733f50a
SHA102c15c37d18b2a23b37430c41398b516a221bf8d
SHA25634402b6bfd0d380184b53fd95290345fc9fe7e7e1b9ad6f130f1e123c482b6ba
SHA5126645af4c70eeeb8ceeb2c72b6e31ae7d975ced5481d4e514094fa8c2acb79b195f3ea21e0b0d36580d9051c733e66f071e0bab2faeed0b2febf41bc5b0117354
-
Filesize
717KB
MD581df947e9113c0e2a3f6efde2d984503
SHA1da453d44f1ece7ea0b95f392720bf12ebe8f9008
SHA256b82d28ea3f530c3be2540e3129729452fc484224717f9c4082ab643d3ffd5901
SHA512c38cdbe435430d5f1b99014893a798e6ac82524c6fa627b26a43e8268106e0c73eac1d11f4feabddb531659755b7f40da268ac944af66f1598133ba67d490aad
-
Filesize
841KB
MD54774c97af26ebd353b03e1913422bb60
SHA1520d092ca2f4b7b482e88f657d90597d5eda11e5
SHA256237a114e6e4c2856a4eb684eae3a0faa4daddac087f4b9bcb02bfe01c482a968
SHA512c3ce490547becd3873b6f52651348e257a9890ce8376b730d29f78e7e5d5d4d75e4b0851a0836e12dad03c2db2d4dcc4869921faaa44997dab551f588846a063
-
Filesize
1020KB
MD51a4a1e425e08c2f654994ae427a0a5c1
SHA1a8f0cf957402a52896944572d1d51c7d9f5f96df
SHA2565677e2f78970cc661daf1b9c0b2816dec016b91a131c0dc3f3e9a7f49c71f6ed
SHA5129039698a2dfd1f1ee3a846486979cd99d227847e54b39f7b55a172b3f79c0f8d074b0e0954393f1ddcff65a518396e1fe28a6309944a1a6a5caa5b0083c2f7cf
-
Filesize
581KB
MD54aecedf68db73c2cce7dccd7f44d1122
SHA1457a77fe60a0bf3cd7ffc5808c0fc63ceced5ad2
SHA25617fbd3b04746e4816031b4981bfcffe7eb550b5f90eefd89cfb7b76ceb7955aa
SHA5128e4a52ffa94176c84470f002ef026763b9272035b03b67d069ee2e8b6b4e88808ebc5b232e50880d5b7f28044e3a757cacdaf5a646bad1e70b2835633bc5c772
-
Filesize
581KB
MD532c6f9a229b37e3be35f254af9d87ef3
SHA1cb70c13c9170190f5edd1569d5ff035f988f1ac9
SHA2567df4fcf7e0db45e731731d101c8e2a8d30fe365042d42e918389496fab2f9985
SHA512ab4f9662875b7b542bb13d30bcb686ebd51c8e81e3f3e9413e962763e8eac40aa31a22f92cd1ccfd4f18344a56ae3f56a25a0762307cf3ca5ce1117214a5a1b9
-
Filesize
581KB
MD54200c2f20d50449d982ad734dd2c144b
SHA1706f30db88f95e7d1816083506445eba3074744e
SHA2565d886c5c4f9dee0cbbcfe66e9549efe2c5a413c19a86e28510cdee824c9ba44c
SHA512d02d242a918a1a8176b09d1958219c0cc9280f364ae928d4eefc4e105a2c315ed6dd4febc0c40b4767550a34faf8098140615e85a4da4f2b34c557701701fb60
-
Filesize
581KB
MD5c1c5c9a10dd559fbc1c80d41b1bafaac
SHA1e63272aa6b020e7d7bff2885bbae089cf26960b2
SHA256ef62d380cddd644affc50df36fdc8eac9897500052e1f84b6bf427505478fa50
SHA5123affd48e2c12fd7b04cd3373b08ad535784804657b9c90f01abde5afa99c07de63b9754db67310d431a487f91a2898d579cc6a4b3148f665ccad4c8e34d33375
-
Filesize
581KB
MD5a7de766f5430d270835781b4d77d47f1
SHA14cb5bd477bef8f8e372509f9508ac23df38c183f
SHA256fa6db324360a7c3f9e3f6aa21f2a0d9439b2dac63070bdcdb5b3d7a6a5cbe4ee
SHA512b9823f0256f41c97561996a892ffbf3d3be0bcbdd4befcea63a1b266b95d2d7b87a8bf59ba3733612abd40d40312859ccea9218266d314a8bd95a606b1c4811d
-
Filesize
581KB
MD58ddec2fe2c170351f2bbd89b91fffa94
SHA1a6112445a9f1e48b25dddb7523e2b46f5aa50aaf
SHA256e3fbad092411951c2b48e25528b87c5943169583fdf78c4a7ad91537deda6660
SHA512e432277e7b8c813e1c42fa8c4959a9538d3b6a13728e94b09e0d5f275d7f1fe4cdbf9a938da439b94a143083c89cb5a10aae7414d4bfbd2537da2f12d47aa8c6
-
Filesize
581KB
MD5137a79b585e4e47a9acfbbcb766d3504
SHA11dca38bed8fd0911af5ae033164ff5ba17ebb785
SHA25608e821fdba98f2950da9d7789889adeb3fee80130194c4373355175bf2fb6fe3
SHA5125e7f905630f8bc1d8e5a019d6502980c3fcbaba4ed3fadc240301176d6811955f4dba168dacf64a148daaacfb2b4767c232049a484e843f93d76c9e2607a9a7f
-
Filesize
581KB
MD55b4599c67e55bc50af7ef18b37357709
SHA1ebbf0942dde86ac97847ac29fa699aa993953924
SHA256a4850d7c8fb8de08f23400843acfb481529f37337d1e884239517c9655fafd5e
SHA512b9419ee178eaaf3b2f1392f955fafa31145bb26a2d3c3cea1107a76c9f664d343f7feff699273c15634b75aade47510a120c42c46ff5a72152c234eba8d610fb
-
Filesize
581KB
MD53c8eb1a9e7bf891d95da27fe13f6addc
SHA16b0524b7e701cafcc25ddb8704c5c5efb092a3ef
SHA25643462210541dadce15c50f0a94ed2e5805fe7d92c56c25e8a39ccc79581260d8
SHA512032c3925f46976175899c4a5f6e7046645481c1bce5012a8af9aa85295665b83fe89d1a14a1ab0fb1d1e1d2d7c0cbdae318b57ebfbce71c93fe04bf21e7f1ec0
-
Filesize
581KB
MD58d78c56f920d23a410d47bd3443e2d17
SHA11a7e98a96ccee65192772cfe4640ac04f493b827
SHA256fd2d41f32db3e4b9ea5b6fa4b81ea7529cd93d49ed9b48934bcd7d2d9394cd65
SHA512daf70f1dc15ce553bb122579a85a668db7312c38e343f5ef8620f16ec2cf30df63fcdd778ddb0454d735c897fc6358a6396f0ecea83863fa6836e138acd8c95e
-
Filesize
581KB
MD5333e06b2d56194726f436632fc000438
SHA1d7c632f32ceb03ee128b4481d8f4a5f68fad00f1
SHA25614d558e405b24bf426b5ccf244fae11c1da2008b4bcb84713a146099ede74776
SHA5128c6d3aa3f7f7acfd2d4e7e6b4233364a58d08bc3b889babe6e47161ddf57e0eef523c66d933b802e5aa2afb7be94662179bf9f4b5d6c5c565b39528657af3dff
-
Filesize
320KB
MD5290da582944602bef763e37a2137ea49
SHA1b39ad9b825bdae9fb1dc5744c09b047e9eb67b59
SHA2566b82725fe7f4b2fa998a740f85e297961cf23bf6c491d1adb3102231588ef7ed
SHA51275eb357aa12ecccf0a50f3c326484e1238273b882081ae09de8d62d75afb53ebd2700071d03c37b864aa1251196b38fff3405a9372ee2bed92d490c21881d6cb
-
Filesize
320KB
MD5ad96038e5a0e738c8818c1c19e3ecce8
SHA16fa04867f601f698ea7cd58d85bf139cf3059770
SHA256cf134ee61fc841589a437ce27c01dad8e9d9b83abc167ab99513fff6c982c5ce
SHA5129c35d7b9910e7bd8b0976a1b9c6b9472bd893d4bdc0deb98d8005bea384408e3f333347f0dae897e514a7ef1672229cffb61b5bd3a51ccb175fe04890cabcd88
-
Filesize
256KB
MD5a7bb5cb2d1ca7db91afeadb063637da8
SHA1db92849ea4d7a7f69de1ad88b51db95c6add055f
SHA25674242cce27a4a55a051a9624656bd976e03da41862bcc983307a40a8a87cae81
SHA512b59d3f976a1ce429231f14af0f377ef73efb8a5b7cafb2a8856c72a977eaecaca8c84d026106b5b9d9f01ce5a86d8f5b83c37ed3d5179cbd813fa9af6eed8710
-
Filesize
320KB
MD51d56bb7bfcc1a0df4ce5aa8de435c070
SHA1bca6f3746176b451c31598ee309d6ccd122694fc
SHA25644dd08ffca275f80958765797d2f9d371c35fc12b31054ce0b7299f19edee5aa
SHA512bae1da68d67edb4c7a0cb1a987ec7fda01f96bc5bc125b531471c83415e9cccd8da8128a1657dada2afeae525f59acfd49e81cad47033c989876342c3c971f18
-
Filesize
320KB
MD59b0a0a73070b7b802345764f704fa7cd
SHA1aee5f2334f6bda3243f67acd181d7fe5e88b6b01
SHA25601279d12b46825ad299e1be71144b00d748994687fb80cedede9aa439466cffd
SHA512438261d569713078f3b4447c665e2d730f79144520aa0df6a57e33b7eb09c30952e09a3feab79d3eb330c258fe0684d1006721e7084e38e1914d1bc9093d5da1
-
Filesize
320KB
MD5189b6994ef377004b11e6366c4816e04
SHA10598c28d4b730f1034059090e9912aab741b1606
SHA256591f22babc6c8bc7cab56b5e7d2220d2c85879ae2579be72788dec51c6d843e1
SHA512543f3872e74f020c0c31265f472d03c30286431ea8afd105dba17f47ab940da326600f18462490ab83753b628d477553c5b705d95bb1a3757a3a743566d990bd
-
Filesize
320KB
MD5b0f4aaf22ba1e326072dcf51790e831e
SHA1cb95e2912bbc69c78ff78979d07298f4d903cee1
SHA25637616e866b734631f88b77783fb1f53ca6e73b09e0f13b31a49f05b2f879ef0d
SHA512559c79db19ffef45ea3543d3c376d86c7b70edbff0e4c0f7cec8aeb4548bcf228f5da255e3c31c63def63f26f5e0bd7ccbced5f0556e5e9c2a142449a51bd865
-
Filesize
256KB
MD5e895445ca8b7a36e922f824be00dafd6
SHA19e03e45cffc54432b7061e0ad5bcffe1c11269d8
SHA256fddf08c12ca34519a7a0d81f0a00048544166e103a38efe081505c09d13712fb
SHA5122920ae28edac73d8680f460d81574d80c5f53a58926a22ccec6c6ff28366d84bd8be15cec760aa839a400bbbcd9b44e17036ca6e86506b3db70bf7e7ef8aee98
-
Filesize
256KB
MD5a3a489d1435721ecce3c07cf9de1c0f2
SHA1ed59e54451f82655118370f1a64b5c566429bb52
SHA2566ceb48d14089b929ab2f8238ec324c0439b2916c0a34535018be36f59590850a
SHA51280df6e163926c746753d01bff44ef23210b8a4419c43a0d71c2f3c010cf49821d05b3ebe9a5ae3df6b1c1a7c08c1c278cfbd071178aaad151fb465e77b927753
-
Filesize
696KB
MD51a4d426c50bac4e035bbfaf5657c39f6
SHA19e1e5af279b420b49d0631d7f585ef6f6a96a967
SHA256d88f44a980be0e9bf250e6c1628a1f1704bf4fb3bc1962de70f269c19e8cfe81
SHA51216100808ba3faeff2e256245176a71135c1fa46386d7b5ba6d5ac3eee47ffcc12dccae9842a2410bffe12421e0c14dc981c807feebfb9c73d0d3007adc072cbc
-
Filesize
659KB
MD53bcfccfe521353d4464e8a0c29a544d7
SHA1f13593b5e56cd4b0e7754dddb17cbe200e299a77
SHA25683c8cae15759886bdce52c65f3480f50fd457c4be1f1bc34789585a57f11d601
SHA512432a69664b59525041610dfbee0dce3e3626503873cf03201dba82d4107e23016f5e9a659c19a9e1d42759a49cde1b949d4d40a538e4d2fec7dc2558b7d8c0ec
-
Filesize
1.2MB
MD5e2f68bfeb4b8f95916eb061282ea2704
SHA1c55d0767fa04d1223ddbf2c0c312a2e6a990e377
SHA256c029c2a58389690ab094b33aef70abed955444b4bd7d9000d452b367d4473540
SHA512dcb6f72b886fe25cca0beac110a88a16d398839c2f5b940bd37433ce4894330c063ac44052987701075a333636b7d85ad278e5adfda9bcd36ae716b8a4a9b3b6
-
Filesize
661KB
MD5eed63cd1283078a0e2830b65c08ac6d6
SHA1c8fe95f0e749007e512896157178635c95cff82c
SHA25601b8e8bc629313d16a2373456f969170da128406801b807c7102eb3e44b3226e
SHA5128582d9057d1226244c7d841f4daaaf4773681a9f7ff543718c7ea33caa09cec798a1a2e5316b7e81a8882a6c8918a5d0165c3e73a4a351aec560a7ca9820cd2b
-
Filesize
1.3MB
MD5e9b5c3effa8e40cd5e45b1f9b5bdfec6
SHA150a74bd24c11efc547de430523213b793290685f
SHA2565433d25d8a133cee913bdc708dcce224faefab52f4c439088c50cb5499e2a5e2
SHA51272650b9f841e86cba64dc46c1654f830dda7e571066eb4e4035b98b79d128148d39085125f62800599adb7c98eb1253a3f172beae1fdde1ea56a02816faad5ec
-
Filesize
1.5MB
MD50c1c36969b3f9d414bb15e613bdfa9ac
SHA1d523e819a49c4af06d9849d9d704add38a70ff02
SHA256ec7e63b852368473136fa90c8ec8491a2301019ae7138bc55bbffdeaf1d97b99
SHA5128b388bba17bd9eda53b6ffaa55821d33c85a11de82a4fdef6a140395a45d24023fd016c11a317a1468d66fd59162a61a7fe632441f96349f9f662102b3471593