Analysis
-
max time kernel
138s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
29-01-2024 04:45
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-29_56644bf6c79f898712dd9a9ce0abeb4c_ryuk.exe
Resource
win7-20231129-en
General
-
Target
2024-01-29_56644bf6c79f898712dd9a9ce0abeb4c_ryuk.exe
-
Size
2.2MB
-
MD5
56644bf6c79f898712dd9a9ce0abeb4c
-
SHA1
5c73f820c10a8ed5b7b13283f41184b824acd8c6
-
SHA256
7dd7cda71a99af7faec6c1547044825c4fbb86f2ef3b6ae327d6d358a49fb1db
-
SHA512
627df55e930a3c24be505493b25aaec754480cfaf5bae3699b88933058c9ad6e19afb1984de74bbe3620f8ea6fa2d9d01e0d63324336b0633ec3903432835305
-
SSDEEP
24576:TOObVw4TaN1wdeukCba4oXtgLhU3wEdmh58Catr0zAiX90z/F0jsFB3SQk:TOOh3aN4euLbegmtG3aB0zj0yjoB2
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 1796 alg.exe 1672 DiagnosticsHub.StandardCollector.Service.exe 1820 fxssvc.exe 1844 elevation_service.exe 2724 elevation_service.exe 3324 maintenanceservice.exe 456 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\system32\dllhost.exe 2024-01-29_56644bf6c79f898712dd9a9ce0abeb4c_ryuk.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-01-29_56644bf6c79f898712dd9a9ce0abeb4c_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-01-29_56644bf6c79f898712dd9a9ce0abeb4c_ryuk.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\39952d11c92b1ccd.bin alg.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-01-29_56644bf6c79f898712dd9a9ce0abeb4c_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-01-29_56644bf6c79f898712dd9a9ce0abeb4c_ryuk.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Internet Explorer\iexplore.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_127968\java.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7z.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe alg.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_127968\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\dotnet\dotnet.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2024-01-29_56644bf6c79f898712dd9a9ce0abeb4c_ryuk.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1672 DiagnosticsHub.StandardCollector.Service.exe 1672 DiagnosticsHub.StandardCollector.Service.exe 1672 DiagnosticsHub.StandardCollector.Service.exe 1672 DiagnosticsHub.StandardCollector.Service.exe 1672 DiagnosticsHub.StandardCollector.Service.exe 1672 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 652 Process not Found 652 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1232 2024-01-29_56644bf6c79f898712dd9a9ce0abeb4c_ryuk.exe Token: SeAuditPrivilege 1820 fxssvc.exe Token: SeDebugPrivilege 1796 alg.exe Token: SeDebugPrivilege 1796 alg.exe Token: SeDebugPrivilege 1796 alg.exe Token: SeDebugPrivilege 1672 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-29_56644bf6c79f898712dd9a9ce0abeb4c_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-29_56644bf6c79f898712dd9a9ce0abeb4c_ryuk.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1232
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1796
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1672
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:3156
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1820
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1844
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2724
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:3324
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:456
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5edf7fd2ad0bc55e744e2b391b287442f
SHA1173df503b280d94f7c598cfc123dde9e005a6418
SHA25697a736af6749f87013912238b3625911a8b169ffad941dd394e17741140bf5fb
SHA5126b04071e1694b9e28233f09073a3d132f8f0cc10bc41562949f3650788fe168e9c91b5a9113a3b54cd8a1ff132e5f12043f92cde999a3c3b82fa094420a1e461
-
Filesize
781KB
MD5b896f2b4e18e75348ea244402801742d
SHA137fe156ef7aa696854fc39475955bc73b158dcdd
SHA25674fc4fa4553db47d8ee5fe6e76ecf6d00c01942414410854abceda393a5564bc
SHA5126b6bf2a1f700a550618bc37c3c5467240beaff0eea2c7b3bd5cc39486124b05a23f21c4a54123277f6ebff13024f0065c1cb3057d144a8c1fb7e53236c24ad99
-
Filesize
1.1MB
MD5ef350cfb0a2ec2f7b96b0e4955a43a10
SHA1d4c79c454ba2070779d68cd7153d0f83a78fe7a2
SHA2565239d3ef4c228f648574de33edbe501fbbc9a8f4140293ccff83578aac77f4ee
SHA51262956f75a8ccaeed176b2659ff972deb921084ff943b6ab8b7cb6b3cdb52e4c819df617f6560de0334a947779ef901d24425716f0d7daeec75f5b3fdc2d8a1b1
-
Filesize
1.5MB
MD5d0f119dedd1ee60d0162813570ee4e60
SHA180d98f5c99abd805d8961d0b653a8d88f24cda99
SHA256448f2522a0c378129855d1da32c51e9a07a07e067fc2bf59fc99e8af34ba4688
SHA512596e09240f18fa8c9a4d100a6fe593cc53b3db29a4aea1508e14e74f2a49b04ebde9097960cc32a9095bd2694deaeac9f45f3c2e74febbbdb273bc2d92ba990c
-
Filesize
1.2MB
MD56f51f6214db19bd09bde4b9882af3f09
SHA1c9587583cbb17343b6f29ae41aa15384652d0fd6
SHA256b341b5273ffded3af04dd2acb100ab54c18e5f906961c61c40147111fa1f4714
SHA51299ef28c2bc21a1b39ac198b9fdee8b500af3f874c7129883688982753a654fb1f40f4dd983d2295e82be3e1e38e598d2d62f5a9a248bdd24ecdd63f58c6430f0
-
Filesize
582KB
MD5dbc9359ca6fa4dc502cd47ac0cf51928
SHA1fa91492cb7ae8cf57be63db407646b8e5ce065da
SHA2568bed4dd9186c4f34aa035c6052398c63ed5926032f87323a8561a951a2dd512c
SHA51284621137117030727d63ccd385dd99c22d0d89d1e6af4c264925ef9b5c55cf4558ca6fc921fc5c8735c61d690bb3fbb1bc80a5179642cb26794a5825f584ea88
-
Filesize
840KB
MD547e3d375e098f601485e8b55cc271b4b
SHA107622daedb4531f2cf289e97ce32950295c680ba
SHA25677910fc96428b5b7f9ab1ea20b73520157f72be27c86b21609d481ef976830f9
SHA512dedde26aa2fe4cdea976b397eedd335bd04eaa2e00528e51a4a0781ca6df791365052c7ca929e67b0d74426be272cf35ef359a4b5965b4e8f73a8ec831978583
-
Filesize
4.6MB
MD583bdf0fcee1efa226ffd15504cf8d7f9
SHA112140194f76421bd211506d367c68f896a8a8b7f
SHA2562cabb8214c4d506cf47180bb8ce4a3808a60c2c94e5bec5ab3a492dac8d16048
SHA512f8d0e72b346a4e30889d0f50dcb9a874b6769ae3ff3ddf359818c0313a5d86d3e3663e4ef5969b3cdf582bd307dabe98393036cee3024ff835f05264d070796f
-
Filesize
910KB
MD5ef3f75e528a70790996218a580725b62
SHA1caec428f1e185f97aa88235606570af450e2e0bc
SHA256cb81a78348e07856bc8153d9236b88556b6a112b83633b3f384785cad86a7dc8
SHA512476cc94078dac56b0c84d1f504327e5f714b18ed92bda81b9642f6e3f864835c3d69feed83c4cf7f1eb9114c7482ec33a7bbb4424a29c160d311811427287844
-
Filesize
24.0MB
MD5d02de1e54178041f69663bb117ca4a6e
SHA102cfee36e26e5e3d95c5dcbc4ecc2f376959693a
SHA25657771c7b2aa602ab8be4cbd84fed75c023d5194ce3cfd784239c14c368af12e9
SHA5121b5fece28452533c83874e84be67590183fe36d896d77a8c513e76881237b8b132ab36a924f231c61ab3d618b2fd56f4429cf6252a8becf62b7945460544775b
-
Filesize
704KB
MD56e1b58a03accf135051b25af991cdbad
SHA1c224b22a3848911f62c44d06ced7340b6c42dd97
SHA2560c4f20125cf6d2faf3eb995026ecb1697d7b167dfb34657bca29587ae9da2180
SHA512e6575419886c7a9176a27aff275f83409220ff7b54dc2bfd89a5213622908153df23f3346c87fdc3d8df7a1a62d72cea17749f3e0eda595c50d95ac99d6366a0
-
Filesize
640KB
MD500f64044fa41becd7c4e8ca7d9cc2aa8
SHA19126d4edabb50e7cd3aab7ee1f44c6dfeba6eaa6
SHA2565697ab33d574b3ba550da19e6fd6d9669e847a3d69a81695fb199596e51775e2
SHA5125f3596f3b3f1f723a971d7efb45b424e61f2491970d939e151d7ef53b4db8dc7a46adf56b0a3ff8385945277acfa1359a57edb92e5f3e3beff89ddc2a02058de
-
Filesize
805KB
MD5c7044588b7bc48d3edf819af652513a1
SHA165aea215db938f781e3ca7c4ae84c19a89942e7c
SHA25643f3c80e4b01badc4fb1201dd0397c4e440b4c7d00349467bdec5319ca82126c
SHA51228cbc3d175c5cdd02a8ec66ad41a333346059100158abf2cf0457cdb25676d79ddc2f00e4840b9c4dc14cc71553295c4705b28146cdf477f00a6256e69bed34b
-
Filesize
656KB
MD5bef822708e24fbe0b7dea8b2f52d4014
SHA1e20ada0b914b1f84ea8b1b6e65c5b37872d30f53
SHA256da8aa0e6109526a8a9a24bc79730cc59fbb92698717e231b6a70b9b938ad535b
SHA512e5428e0c2cb7f41a5e7b9e94c1807bc7b626826f0b0e680fa68bad8ed16fbbcec66179f2a330cd8579e294ede0ef55dabc9dd958b39e747051b7104f39606c41
-
Filesize
4.8MB
MD53596b14860d6dd2359446e370a0fed16
SHA1aaff95d4df6119994660ed7780a36c2a89ca0ec2
SHA25670577f84c4ac1a4b1aa4bdd7f55b03f0e5faecc6a5a6e115f122be052eb22663
SHA5120cc4c9ed42bc509183ac02baa8dc9141977ca6cc46b59fe9e2a0a9a47b6d64da72d2a147db1a7c2257e35903ea13898d2eafa4d74aec6074ff8dd1db9b694945
-
Filesize
4.8MB
MD5809320191ea9605c1e37ca828ae6396c
SHA1d9df3e708d8c0fced392581e0cca3a3b6696718e
SHA2568709e93930017b15b1c40ae98cd131169816c66093e0fb12870a3a7728b32f56
SHA512cd7e53f5522e510f5dd1b2b7e6091a9b95eaa2c08ab50426a1312200a2194d5ec03cede12397ba315230b67ff055e1eb0189607f9bc694bf6f6ebe404b0ca7c4
-
Filesize
2.2MB
MD5c67811cf90fa31849f8c1a56fc42ed2b
SHA1239c8b0fec4523c9c35c65eca4a21aa838fc2820
SHA256e79332d4d8fc80b4805ecdf42beaaea9c24ae5acecac5c03dc5c760e6366a5b9
SHA5129df8bd94d0968b4e20d383812ea8a1fb264d3559cfba2f49b2d5fdeed7585f154f244b9fca2df12c81ef4e230cce23658575a77ad460f93a7878c81a061177c1
-
Filesize
2.1MB
MD53804678fa0e4967c6d0359c4796621cc
SHA16ad344f6b37595e6baa444c09470f428f59d61b8
SHA2569ad8cfea2c645a6c3a74140e6274227463591eb35cf8e187ebb6251dc923496a
SHA51251b58bac74cc27832607b47ad8acb8ee1c37b7dfa15c915fa0db2cbf6795f11dbd50cc586c8db9c031647ea10a4955701cf5a039a35aee78a82acd1b210c3602
-
Filesize
1.8MB
MD570a48bff47a1cf996bce1df0de5f0f5e
SHA1dbc02ba82f0e4fb4df348da88cf284bf7a86c72f
SHA256932ad6a88e22d8e838f26434a24b0cd513e3516267270d3f3447493625d05235
SHA512af3e425a99b06ecf9e1d1eb4d55e204322835216ec84d69a755251fe8acf0130d65b408d633ae6f54192020ea4789911bb28264eb5fcbf551ccaaf8bbda2ce59
-
Filesize
1.5MB
MD5bb72533f84ea7c91bb9069868af1d1aa
SHA1d5bbc2aeade706357dc6c6662eec8c36fe052e0d
SHA256cd25f91f8067f2642e996688b673e83d73c110a459784dfc72b55e1893d1d5ea
SHA512ec1dcbf716f1620335a9b567fc836f99339bfd34ca237780669677fc9e77ae9319cebca537abb27ddcc71c215fd1f8f994f8a347fcf18c600c2f0793c8bc43ff
-
Filesize
581KB
MD50d6f4017a1367c07879e0990ee6dae96
SHA17e292cdf8ce62de4b800036707bf4a0a94a77323
SHA25614555e7c9dd70a08a6d55befd99f5cfc145a7d0202f52581b335ec2cde70b415
SHA512bff276a3252a84ebf873415f2640016fc71496f6b8105a9204f4f6f75e9e51b5364d56f1431108e660ee1af0940e58d94032c7aa9bd014105313702610d1b3be
-
Filesize
581KB
MD57bdc25f57399d628a2d2361c4b7da4db
SHA18b31d24f85762029ceecb915546805deefe0bb6b
SHA2566b4b77dbf88e2837537c4cc6ee29905be9a7755e58ecc22187305bed3c4c925a
SHA512665e36fdda8b962d8601425fba092cfacc109909af95d4607c2f8aab6146897a6bad9217664ee64bda7059e447ab5c4be34ee00ed76c5a730b5f90a2f345c259
-
Filesize
581KB
MD53fe6bdf47f9996e8e786f29997cb8422
SHA16cc5306ee6ea4f5479ebd814046cd38d53db38ca
SHA25627ad8da0c3df39e00ab55383d0e137c9b5f19fc23536feffd5032a29a3befff9
SHA51242ddb5709d661b43a89daf5940aa2016a3da7ccb940f699337f71dabe4cf942fcedd9c074461369a7147df41208d72eb070be4a86cf1d4064f2002b7bafc34bc
-
Filesize
601KB
MD501cde2c72db631aea624d4101b98f474
SHA1c9f7d45250a39d45d3b0feec02802d31ed114602
SHA2564ebde3c4bf489e5e230e43b389b280721ea6df6df07b65b31c1667c21de9f155
SHA5126b3af80c43899258d18580d85eccbfc1aeaf16f492d3a8534ac44ca484997ecbbc5f7e7282fd9f8b295a0965f1e27ebe1ef976fdc91e9a27f6a3cc0b398db46d
-
Filesize
581KB
MD555b8ac2e1fe3e45a49017b57603c040e
SHA12702bf9c1c2d021e4341167e3f79495e68aa00f6
SHA256e4f17e565c95fb288b7c289c94994b76584dc3490e65ec7590047f3fdc8db49c
SHA51237e18c35d02331ed987dac0439671a706cb348c528a965d6361e85bcab371887675eb3f466db1ff5de867ad5a6e986aa4d71b8adb6ff71626b1949c3ace6d262
-
Filesize
581KB
MD5ea7c0c8f58579fdf0474428eaeed8484
SHA1fb87e36bb1878d5c679ac7dde51cc3b0c9e0213a
SHA256ccc6c2736474e6bfaf6f599b9bbc21bd74a8a6118dd65209e4e0c2e0971ef2bb
SHA512346cf49dd65da261aae2a5144d3af45b0bafdf438050b6fdd16239cf3dc7d9f745201ff5908677613b3a3140c1bba6aaa99d7fc41f76bf6e8fc716b8e6bd1b37
-
Filesize
581KB
MD52247f1aef12914d814b6db27553fb8df
SHA1c7fa880b2f615b521b3d7a8a8a3192398a42410f
SHA25694dea9718107b1fb793af951b11df2dccc606bd1ec5dffd8b2ce6bd1ae8df6f3
SHA512df9319bdf16e590207d8038d39aca738ba12c5a5ee0fc0d9dd4107ba4e89b410649e3ed30a9beaa8057e51bca9d731a8a24cb6b2dde2a6fe72b50c60b996b01e
-
Filesize
841KB
MD571381e6cc2e318114f8167ad6a8bd1bb
SHA108a8cb5eaba6412efa80ef5a09576c18e21d7619
SHA2563bb48943222139b42138c625f24c9c20ae9969e5a655da3e745d3dd753cd5c10
SHA51240461301b7173869c3b9251b3f610a696528e1ce8f9d56d5b03b1aa59fdfe9c7662701a914f47460359ee431a5bc768d4ea5608a1178c2a7c07d4f7ea7e45e66
-
Filesize
581KB
MD5319277b0077685e3c582e0b5c4c58662
SHA124ff254af98d216ebeb736fccb5ff6d165c18456
SHA25699e27f1ba1c2d6eb7a3674871b5531233ce608e49f189221a19bd46a4e557dce
SHA5123b908f6cb708441f9c4e20e71e07c0ca54f936d8cedcd45701e75f7e3be60c916dad2249b0b81993a980ca2a0bcee6b9e41c41a0660841589e337989203a1aca
-
Filesize
581KB
MD50deb693be83a9cb9147191285064b31f
SHA10ab837cfece7c521c4d55e4103de4fe2276afcb7
SHA2567663eb744f46cf34a85924c03911e5c9cbfb1095fec07109d68b7909cfa0f3b2
SHA512310e85f3c89dfdaf605232e2b9a02a0b2cd9bce981aec2733b4b2bdf2319aa0069466cbdc6d13ec270e7e2fe01e156765e5a41ecb412e4d9dd4c5fc9cdcd9862
-
Filesize
717KB
MD5d6381188898d448a7d105bb0c526113b
SHA185b20f5d472095baffacbc68956f14fed83c34cf
SHA2566a123b78853fd46a5082f93f634d820e5fe3b3cf5187b66273924db950cb59cb
SHA5127ce50c6f459c11bf0a5b6996289157797128badc74572ea7ec7d6179423bad96875c9d49960c3e9b7aa39e0826e24757c31a4222e032d691bf927f50eaa6c4d5
-
Filesize
448KB
MD55f35d3d854fd9cfadf1618283269968e
SHA1a1a7de1b1a30bf923ff8912337d3a8d6ecbf1e99
SHA25662aebbcee1e5195257803cffb6eb00b23ba4403c90f106a54439450f8cfd5097
SHA512dbc3cf8105c4413029effe3eb6e1936e37e914200e57c5875eb05883ba77bd155e6c954c1b067759e1e95848dd8ef4d18d409449e0af27f3bd498d79f36175e1
-
Filesize
581KB
MD594740b719f0fb7190fe4c9aac4f96ad9
SHA173db399157e6e7e2ca2b2fa8c6d3fde1eb9d974c
SHA256abb7b96b6c2f83d242d46fb7a94438a8d90a0c34480b1e3c93c6bfa2ab1e682f
SHA5128785e2bcbed1791bffdf61f347589de6405d20adf2e40fd5d3071653df1ff7b8a9f747c367647308b14f1b25e91d3e9726702c228347af262043d476c8891a3f
-
Filesize
717KB
MD5961f6568042746ce4f5e4af2772f3bb0
SHA1b3f692b03998e1eebf028db2a08d339d8a981e87
SHA2567824a33269437764fa6222d366eaa493c2fd6efd6d8df838a458a65c39c63c6f
SHA512861f1045b3441486f4db18f6f5ef02cf5adeb940cfc088aed3daa832115dbd539de9561c4548d1c601377b856573075dbd411ba6aa8699bc02288c0ab938c4f2
-
Filesize
841KB
MD56d7591b75875eab75e57289f6a1bb1da
SHA16823065f57b134a0bcf04f10e4b64e6d7aadead6
SHA2566943ffaec68658e5b0e323c233cb9f209ac17a3f0f3fbdbf66f2c99813dc127f
SHA512f24fb1f585f71400afe4f62d6eef682411362c8b13a7530965383c2d82dbd11c825975d67525f27df99d622c630ef595be3cc5ad0ac2f09ee75f9bfc3d6e8fb8
-
Filesize
1020KB
MD57cec009bb276d1e7f743b3d2fbbe740e
SHA1dacded9995bbfb425b6d3c49f19cd3f7931e0912
SHA256354f8fd5fb711913e8d2ce4b30292174206b77032b5f83892b55d763368f1ad1
SHA5129e707375065390d4ccbde84516086be88a8dced70460ce19bac1e626f6141aa09f97f3367fddc78ecc7286606bb444d45f508535664b60303edc32ffb0b56e9b
-
Filesize
581KB
MD54999016d6b65fe9962b985784d8733c2
SHA1e0a7792a0bd667dc1009d1d6f5084265fecbcee6
SHA256b662993759b99e7595562975e853cfd3d2fd5afc18189227b559e123fa4a8ddd
SHA5126cbbb0c1d3a62973ca67ac59c6b3d2ed110a19176f3a70204333f7f1e693301e37b315764481f6f993e318589177b9577acd61f320e018e644208c512c2ecc40
-
Filesize
581KB
MD5f54b419b2c9816f75c1c28e8e5bc3c0d
SHA14f37fa878ef095b41a6eda263a3a34d1111dac4f
SHA2567016464be3f2620f78ceafd456e290731f8ec9394870f580ee226556e9e71a18
SHA5121e7186fd4e1fccca908cc5b46a84128298d2e9256decfd23b46a55acdd31a0068fd440df362bd43999b401d0ec4bd3bcbeb1aaa1cce031836c9daabe5c86013b
-
Filesize
581KB
MD5b9d29dace46ccfb752117d9deeda922b
SHA11c9237744165a8affdd40fce88aca87f1deba228
SHA256f4e5f018e960aa9281b75b5a97ae8575dabe23ee9038faa608558e8cc9c5a890
SHA51237cdc79e309c62ea54ef747c0e630a1d8726b8ed5a377a771575931454d6913710a48e41afd66f4f92e78c600b2dabc3b4eb5a2fe1fd2cad278b53c438423a91
-
Filesize
581KB
MD500c0438aa07347761de556e6f4949089
SHA155fd0392c604dd6c3b2fea673448bb0faa6a1e9b
SHA256ef7670f2ccfcb1351e32be5dea6533391f6ee4becd987d5cf0ba472c2a952869
SHA5123abdf877049cf06af817514661e48c2fa5b0d8a776d44d24258daf4d15919cdb908875a9a59a5baa9d75430aa76c9be09847fb81ee921ed0a74c50de1cd067cd
-
Filesize
581KB
MD5dcfcecf53de25d6c85faa29320c82b54
SHA1dafbc370f54e7d1767cb3507f2994c629cc96d2e
SHA25618993af998b118d3cdd0b06eb5e0326c6fb368c2de35e2d62b721f4958cf179d
SHA5129b91d5a69f86aab79a66d6c2faae5ba10dcd72b973f0e2026c5f9677895a844a41bdaf89b0b3872fda7e13ad017a327319ec497f26ac08011d7202e181d6c967
-
Filesize
581KB
MD5cdb378de90dc4311e42222a5db7460fd
SHA1bbcbc3ca86d237c46e47652acb96f7f9974a0f94
SHA256c31623730c2d77d81e49aac2cc0da9f05d26efbdc98c3c0b41ed8dfff84a4786
SHA512f81ac028ed601ff79194c05b0aa7670f5f444cb92367ffd4ca805641fc6d239bda86c70e09fc71ca8d0a7afce44b19c0bb31576b924b18c7542343c87eb0534f
-
Filesize
581KB
MD589cbffaaffca405c7d06d27995d7436f
SHA15533b8a926bc77894d36c837bc0967fbc647271e
SHA256e78ed2887a6ede062df98ef20ba128712317a24481a85b7c6249fca76184b1bf
SHA512da938e94c5d64f89a78358650c99112f4d2ed092e56b2c3c43691ffc50e99678f84019e4695f65d3a567e7a00bc22333aeb5b2ce8774057b5c15f7f6644f1fdd
-
Filesize
581KB
MD5fdbb920ed0058221f0943771147bd48b
SHA1aaccc92a9cdb6811c490ae5ff66205df78d264f1
SHA2566ffe56a517e5cf9f51da6f9e926c8e1213d4fc3ea174fad2fdc472fc36becfa5
SHA5120b4c3ae9af33e5c09faa6e22421e8ba72833c372fcd2a5add358c51bb3b43785c9b59befb4b4cdcced24275ad69ac78467e02a8929da96e4632a452ca8d03258
-
Filesize
581KB
MD5edaa6a96cddff1b0854aa433ec8a9695
SHA10bee584a6e0aa93863b8409b944c7e698982d7d6
SHA2567ab769857f2cee1901d67b23db87ab4ee2a621185495e36abf314705e52122bc
SHA512d96e3c89d444f73e37c5281280de1e4d57bd919434a9c84d1fab6993e9ed3f49be82418ffad822f06c0cefa6b1b730f737c1a083780c46e5092201a60520ce94
-
Filesize
581KB
MD523c3c561d9a1bef7773c363bde12a7be
SHA1c9531d269bfba2a13ec3edbe34c275de606ef795
SHA25665f73b90d10b3b8d9b01e2913d7eb4c12b1437414dfc1f09135da20d63e9d780
SHA5123b86883885b079fbaa8a71af1ecb7ee601d9bbd8fbd0e01bd7c8202d131464028f25bf8e068c97f336d612008d12d05334e780e815557da5e3eeeeae85f7a90d
-
Filesize
581KB
MD549cbf3284ebfb97b4e43caf29feda598
SHA1277f678f30df9bb6aad48a35edb8b46c87727b7b
SHA256250951a7090df4cc1abee28a976bd69173ed7202544ec21264c9fa025c84711e
SHA5125c83b1afee9b29a4fa9aa42e8fb3c1d8bee779f4992d118eafb632a82966cb7df17b775466975c4074f8137bf1c27474e0b1086fa2afbd2f38c2eb2225a62a59
-
Filesize
581KB
MD581d89de428cd93dfbe601e582598098c
SHA1570023549304514961256a187c2baa2875bf0307
SHA2567c3010edae5be33632cda95275974d443c6be906edc41ea4fa2bf14a418af177
SHA512462c2d94370d0804eae6f0f813bbe89901cb1f9904a35900a17a19ba45d25a33b80193e7fefa6d3c94282aba1d127f3edc49e47e78807fc6260dde5811734527
-
Filesize
448KB
MD595f07edce08c9c2c231869f0de7e78c5
SHA1468a4fb71fbe876285b05bc946d45f9d34ca3b0e
SHA256902ff40b6c973d19bf489b2036696a4f4474d237560458836a40dc3685aa6706
SHA5129e0e425473e3613811beb512261dfef00cf2f4f0efbad0b2d40293acb8b01829fff7e84439add2a76b40e1982d0b783d69c6f992a2321e77e4ac1bdf6c739642
-
Filesize
512KB
MD5072d7031843aba229143aabc3416b95f
SHA158b0480cfc46a37aca03bba13f51b3f208d3d2b9
SHA256871307e00ab974bafa743f336e9c02b48f12aa88f24accd47c5d4cf47f7f5d31
SHA512dd38f998c0363be2f9c99e0ccb278e5b88cb73e432604af0375ee8af1a3eb3579ec20cacecb89fe366292911b2e01b40b25915ef790bdcb391c92a241a3a9a3f
-
Filesize
512KB
MD53f1b129b2915346ead2b6c68071b6cf9
SHA15a407f48391b141c70bee2c5f6168c5db5eda36d
SHA256ca47c19bcc97ec3c2383078fa4d43b117ef6b80e5aea6a96fa65dc1d9d23f1de
SHA512beeb1b093e5c8e8abe49c1a495faebb7d52f2ebe4dd5b1c0fd5cf9d649d6a022cfd3c4c190fae50d86ab3d816a9b8f1ef1ab5aa80aeb8f038ae51c8a60422684
-
Filesize
448KB
MD52d5de97e850e9870d58f02afe229edf2
SHA14d61a64fda20887f399580e2d92a0ae3e8777686
SHA2567ccc36fd22ce903b88575353e6d3da40913747ab7756ee168336b71d5498f4cf
SHA512169a6c5a377b1ea1ce22d9bc8f9ada63b62a09ac2dd14060f2222ea45e55ff07d51ef5c06c2dca0c515c75bb86a9b9a49e8b8e09e7109470b9e9f0faf10ccba4
-
Filesize
448KB
MD59dbfe046d180712c0f350d127b0ce8df
SHA16fe16e40e430eb2538f5cbde7cd5131bc21a93fc
SHA2564050177376a4562c8906b76d3e19585a140a1e25eff1c4ec46add09f89bf7f5c
SHA5125c753f32abfe79b691a919d3e830aed18e1db684dcd323bcd9d26fe429a282e3d14c6317849a9657b367f7bf27388b1f1f354b9df0e6d1c6c83eac62d70135e0
-
Filesize
448KB
MD5458e43d5c3ae0fa1a0b812bd018015d4
SHA1132348657b7ddbe39c15139cc9cce53e9e5709aa
SHA256e92efe026d4722c34b9bacdb1740b488764e71b71e445442250e622f78345476
SHA512e8c880706ed00fb5cc8887c18911ca4bdd87e721529cfa0c8c266510355e93b89e3209d697886faf444da58521277b92461b4a39c4fe54f99781b9863627180a
-
Filesize
448KB
MD590c4fdf231dd612538092698cc7e8cf7
SHA1822e1364f6db343857096e7ade9936c776fa4b67
SHA2564a7e1e42dc73584043f692fff622c997ce440db6dc3e38c16499fbfdcd20f313
SHA51283cc29d7b51b8c038414a544114ffcf5a7678ed4b5fbfce52c341e10213dee981181f0352188dd0dcb4baaaa8810db6142b19d9e6ae0b3f3a34113138a565082
-
Filesize
384KB
MD5575a37630c1d8ec572a11cfc9326646c
SHA1b5214c2cf69494a0152ad4eea628c6c4ecd406a6
SHA25633484b516fbfebde1a4e27700182a73fe12eb82164ebea7e7caeb8e9a072ff70
SHA5129b141f05e20df4ba6498b12bf5e1c7aff94b3486bbf356530c328fbe0621e82300699ecd87b69b8d08475dbb95a9984ac780ef6acde7a182867148fe0513ff25
-
Filesize
696KB
MD5a5665e89fd163f4602f6e2576fb722a0
SHA1402fe719028c3d1c19fc88ddad97b2ea10850263
SHA256450da7a3b5a09549649fd8267d938cd9c4434306710230eeb77ac2e9ebc1fea5
SHA512eae77343848d1e7738c81cc4e44c6b8858ab19dbe9159ced5280bde6521bb76d0f16ba7bdcda7b75cb7586eb23ff1b2147f321c8eec0589cab2d0ead36a8c1b9
-
Filesize
659KB
MD57ebbeda059860e7d87bb263ec9d750a4
SHA1ed104eef1699ba1c2fc2a6793a57294f9f159253
SHA2569202a822083d0c8112a2ab3e7ceb7abe04e1b4fed62ce9075a1fc9d3c1942bf2
SHA51254b56a432bb196760fc3d3d61311f434668ca52b96ff4275a8857dec2a59c42acd894beb58255a125201553d475e23e7fb4ad2037fd27eac3ce233aa7daceb63
-
Filesize
1.2MB
MD5a70bc2c4d48457776a8fe15d407a4be8
SHA13a2dc757d558d00839c62734eb7bfcd779c3ce65
SHA256459bd0501eaf4064b6fd7cbdf615d214c7c349b8247941a73bc3ef1c0eb3b0e1
SHA512033d7852b48d4183675ea276e7535449e80b62d2fe369a7949582063494ad3b38d8c6fec64c1fb0f3b7b90363972eb73f61da9908cfd226e19530cf13a2f501b
-
Filesize
661KB
MD51fccf33a5da52d442ef83ceeb8fa795d
SHA1fd78872f0b075c7512d2fdaba4e800d792908338
SHA2569bd05d5523f9aacfc4d049f11f6fe1d28ea4304e80c17f70bb50dfa5dc22362c
SHA5125e6570dd41bb89d1e5f1d9f2435d939db86d65094c134f586dfaca3dbf2f4a608173e716acd5ca14460376cd2b785d060ee4d4b5daad1de1e50faaaacfdc9a47
-
Filesize
1.3MB
MD54ca9df7d02112db6c96e01d7df66d723
SHA1d3cadbd1d2b4831b0a3892de97be4020a0f41d49
SHA2564ab6994d055cd5a17b9745556b6c7bb7aac10cf38b6236046bcc9b2c6816e9ad
SHA512b645a792a021869cd076ed7fdc8d2366b1ea1c90313c377ac8ad8357af7b3fc2dbce571b1fe94b618a4ae3e4971949e5385275814c83c073e36efd1f9e8f9c5a
-
Filesize
5.6MB
MD53f6854a2dea85a17d201afdf1b51f0b9
SHA17f7c22a257e68fd21109a62b8e817bed615cf25f
SHA2564f67ff9f8f2ca30f12b6004e57f613b6330fc6434e7ba728040d700f3086c6c7
SHA512b4f2c90dd6fae0b95d4b9195f2fb7ddd41576979dee5b922d7a11fc3577186a09e86d45107b22b5f0d0b963783e9cd3fc12d8604cfd55030cff0953bf5f231ce