Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
12-02-2024 09:29
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-12_1c4e86043b2c80c4ed7641c607215a36_ryuk.exe
Resource
win7-20231215-en
General
-
Target
2024-02-12_1c4e86043b2c80c4ed7641c607215a36_ryuk.exe
-
Size
2.1MB
-
MD5
1c4e86043b2c80c4ed7641c607215a36
-
SHA1
22f114dffd165624dadf61901f5b39d476b92561
-
SHA256
183eafdf781034205c75b2d5d734722ee7bdcc31593a3e069f6b72b333ae83be
-
SHA512
74a48010a9d3dd432eeabcd3c9e107f505a20bd49f0d5825c785ef2fed49c71781b3413e7f7e8223f9f8ced5251a71be55fe30fe85ed5f0562368ea73ea77d34
-
SSDEEP
49152:mXWtcDco9YXPtSjeJgEjTmucQgDUYmvFur31yAipQCtXxc0H:mSAYXPwtEjEJU7dG1yfpVBlH
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 1472 alg.exe 3792 DiagnosticsHub.StandardCollector.Service.exe 1016 fxssvc.exe 4780 elevation_service.exe 3572 elevation_service.exe 3948 maintenanceservice.exe 568 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 11 IoCs
description ioc Process File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-02-12_1c4e86043b2c80c4ed7641c607215a36_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\55438c756319cddc.bin alg.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-02-12_1c4e86043b2c80c4ed7641c607215a36_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-02-12_1c4e86043b2c80c4ed7641c607215a36_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-02-12_1c4e86043b2c80c4ed7641c607215a36_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-02-12_1c4e86043b2c80c4ed7641c607215a36_ryuk.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_103406\javaw.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_103406\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe DiagnosticsHub.StandardCollector.Service.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3792 DiagnosticsHub.StandardCollector.Service.exe 3792 DiagnosticsHub.StandardCollector.Service.exe 3792 DiagnosticsHub.StandardCollector.Service.exe 3792 DiagnosticsHub.StandardCollector.Service.exe 3792 DiagnosticsHub.StandardCollector.Service.exe 3792 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 672 Process not Found 672 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3528 2024-02-12_1c4e86043b2c80c4ed7641c607215a36_ryuk.exe Token: SeAuditPrivilege 1016 fxssvc.exe Token: SeDebugPrivilege 1472 alg.exe Token: SeDebugPrivilege 1472 alg.exe Token: SeDebugPrivilege 1472 alg.exe Token: SeDebugPrivilege 3792 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-12_1c4e86043b2c80c4ed7641c607215a36_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-12_1c4e86043b2c80c4ed7641c607215a36_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3528
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1472
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3792
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:1168
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1016
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4780
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3572
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:3948
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:568
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5990afd7d43bcb60d6f18442e1a3be74e
SHA171c95b0fdd3f45bcf9e7a48c14598e1d1ee7b70a
SHA256ae05602f5c635d112df42374e5751dd0077772a2f1b60a02e368e7903579f3ed
SHA512cf899d33e4ec1bb98f6523fa7f0b6f50684307c043533990825687aff6a09809ccb9459ca4ef9048fab673fb8811c4a0ee834eafd1a0120b6755a9ed52c3c0b2
-
Filesize
781KB
MD5b2cfc1cd7b03a73a80f1bc95a415e261
SHA117c9c0185b71ecdd9e11304d0b2b0c622a7d45da
SHA2568f6a9c578abea88f62a014fcfb7c5d9b4406984b4c76f91abec92a0cdd3edf54
SHA5128c59a13b79fc9d97b7a66549a2d35e4e76b62945bc4af8ada9c96cabaf2ee4fd55aa403588f6deaaac9df2ba017f8c423a5f614896a53d60cf844d85ebef6908
-
Filesize
1.1MB
MD56b7da47a35bc306b1116f154b3cd4ebd
SHA17039710d55e9920e5219445dcf047072f8297333
SHA256443d078550a4793a55d6b6a57b8bd929b57a1fb3cfd300a5f83517c8a5494b5e
SHA512775052ec9a718906e372ba01470296e1da40731fe81289377e3e195ff570295eb807009ac2488530ed6ab0648430fb968983671d5469cca74f3933949ba74133
-
Filesize
1.5MB
MD5d1ff005ea167269b7dfaea9e034e453e
SHA1b483b82ffb6d67590c4d04af4c1828af8563c46f
SHA256304beca4e87001dbd56d3649fbfd57a4b1b259e9dad4aa800abbe614283e4d44
SHA51233f01c41d9b97b5252ad11c318ddd338a4a43c04ba8585318bdfc16fde05b28b7eab0d89ccadc254534c28f6e4e1e950bbb0b354ed227098f0d9cf8b8a7e13c2
-
Filesize
1.2MB
MD578f594a73116b6c996bec15fe8a2d80a
SHA16331594e86ec9aa015f77e3d618713c12dde5818
SHA2567b36a211f8e3e1224a35069dcf1ae74c1faccd7f1e3db06562108e52c5ca98bd
SHA512c5b478b14225c3c83f1aab4a171c9261f88bf5cb6a3dcbcd38f39b3dfeb10613a3e5c9ad2c59a5f92b0300d2ede596f94e9305b519d46e94ddae4409b013a5f4
-
Filesize
582KB
MD53ba075a77b2461ab0bd2659723d4e724
SHA147e8fc90fd2c930d1b52c894c3368a3ba4ae843b
SHA256ca38a4004897818e4b73c51667323fe10aef421b5e59828041eb41390c715962
SHA5128c0bd11c991b69f5b31e35cfddc51e4425a2bdcec1f7ebf427802f2e51f6cc1ba659a190f7e76b6253d0f9a7bf20a0b5b70a973071806ff71253107228f440a1
-
Filesize
840KB
MD58dd631db8af0800ee6f3b6e556085dac
SHA1553d881e53a8fab07d99fb1bbb07a904e8832d1f
SHA2564093ca7ccb1a4e0db85032881d9af61f5c794666fe35b2e8ed606bbf6a6ead27
SHA51226d0f9eb95e699a9be4601858036bd49999752bf99369f5c8e733dfc7ca5a4318aa1a80c69306b97cd8f74e07bdbde7533cd825595e504865328116b9485b1fb
-
Filesize
384KB
MD5dd3896b66806980de4cf1f74e275b137
SHA1b471db39cae06242ac65aa904f159bf410ca38b1
SHA256e5c4264dd0298b0ac34a4fcfcde19433037a1ceb085197cccc44260383fcb2e1
SHA5125ca691a6ec6e800e3f3077434c9de9fde73d034cb2d2bceb5a3d0622197cb07f431abda46fbcce9e6ac9a1c3b9b78486642885f24c30959c0232d766f7a8522b
-
Filesize
910KB
MD5705126b9b5e85b777971a550c4cbb958
SHA1664b19a31e9987279bf1826c0b67c86fd1494be1
SHA25622b3030cf17c7ecad94fdb863266668e0128827f4b6cd49764f63fd72d139f84
SHA5120fd7afa8f545afa216a06d8896889a12f85283f06ec2628a7173d84b06c0be44eeef17779db1b9b61209a3cad6ffbc5416290ed33eba5ddec1b616e531c57402
-
Filesize
320KB
MD58098e7207abdcf672b5d7d9dd34d32dc
SHA14e70583e4d2fc9bf89c57eea0d41f660514af8d3
SHA256c9957e0d586e7f8d9da461fd735cced1fe1e970a3fcc3cf00fd6bb5d16c43eba
SHA512075f96c48b858a7f19496ebc7ed4dda92b2156f3e156a079e8b46990ab740099b0ccb1d631546fd683db2aa941246230c273f6260a3b1774a334cd2dc4de6217
-
Filesize
2.7MB
MD5d8dd9a2ee2817cbea90e013d455c56e7
SHA14343a1867671a2c010894d769ee2464210e2ccfa
SHA256c31b86377ec84bbc4510c1cd70ad71cc380926bb0b952e6b5f749c0e349ae21d
SHA512c2c6dc9a0d96f92ac364c07aaadaaace95c4ed22329912f2ae719c0d24d148bbb64fdb98b483417a787baee65020cf0f0a6e42ba14bbb1010e253a5bb9e25822
-
Filesize
1.1MB
MD5ad3b0f78c2d4bdfe7edc1a321977c49f
SHA16ce623d15b140e0cc20360cdd6be9fc53ebe7627
SHA256717112302b6e9bbc1c2634c8e10b58dda1af940009c8f68983c1e3e113efcf23
SHA5120b9ad4a7937eadfead6860b5718fed80437290e02f9465481817544ad87badd3373e3a063845272024c5496ca69363a3c443a5eedddf562c46add10fd4a48ebd
-
Filesize
805KB
MD59d3c89fc74499cf0e949909bb32c62f0
SHA19a7fd8499eaa796df395fc07198e425a67122ccf
SHA256fe41470c85a20dfb01d3d9ead4bf5f7217c3566e8147b31d1019836c722e93f9
SHA5121f52955eab37ac125e6baee2ee9f26ec3d74528975f2f4ab13b3225b7dced02f2ab802fd6a4c1650b5a9f92a83f12e8d5fafc0cb712cd05d9e094cb0b465a632
-
Filesize
656KB
MD5aed7f33ff373c7b2b69e7ec0d8ee001a
SHA16b31ec16380f4742ca0bffa2b658fd5e2af8789a
SHA25675c104803b5a74950923f523b76cf14b271eff430cdc371e102cedb02f505b0a
SHA51283c6b64d37512c2d7d94e6c517115469e7c783d5c0eef0db7c7df6b428ccacb3bf019a6797d52e996438b91539ec1cd4e53e0bc1348def5c9797f6e5075bd957
-
Filesize
4.8MB
MD551fc37979c6dd4193977ee96b8aa7938
SHA1b471eb5a3ffcd1dabcd9082fda8847602e14fd9c
SHA2567e169f8f881d86c49ef2683748c0561d1a440f00586a7b8c623a81962a635aef
SHA512e4b8b3a1f028dd508fbcee33cada30b3f4d8006f5bea52cc1cc383b3ce9bfac3a9c7889b4220d8d59a524a868c61c6f47897e2f50cba1924936225044313c12f
-
Filesize
4.8MB
MD546d11cce6cf715064665864293158023
SHA1f9987fcfda311d3e42fcac523b6beae16bb27e1e
SHA2562bf112f7ebbd6e6d0c5d3c319a9c8684310cd8f551ee12b2fb21e231f3fd10a8
SHA512965012bb4ae9270b0ff1af886462db96844552cd403a0f6e57d73b59964dea6d8790305c18fb9f04b0b0874ff23aef826bd152b58654d2ab173c6435e85d316c
-
Filesize
2.2MB
MD5bef57b58af661068486ab85ea8c74a38
SHA1fed86a4bf7b8e914471b54d494e808a44ec54e23
SHA256cf36e554a9716bb49539d72e6ba6edba7ddbdfe58b91dd5d45a044a5d35b389d
SHA5126686637c2dac05ae424da3e9eb67d0e23d5b48c86d181db3f79a5ba22b96748f4c386e5d132b94ea9f33f61c71f13d2948077863afb465a75d0409414911fb7d
-
Filesize
2.1MB
MD54a195a97bfc7aec49c1182c544b369fa
SHA196d0f0f475a1781b8bacf1667771dabc3b62bcfd
SHA2566734dd12b73dd09bf6ad3a2c0c7ca2025d98db1b4f6011126a2c776540573339
SHA5128b1cb7ab193dcb42c339eedacd93d7bd8ad4ea13ae9be7edc457b131e9d47b298bcb3c368a036d7c12dd4305696a31ad45bacd789a2cbdc7f7260d09b05ec154
-
Filesize
1.8MB
MD50dc9725641408efcd3de2a36ba4b66f4
SHA183fb1cdff40df5618a41b2ee72012104a887f51a
SHA25602b9d696b832e425ca95beaa2f4f82f0cc7bf999654c13da646c8f2d85cd37d8
SHA512dac7c7fe8e9c097359a60941ed6e9696d94f94da0ff6f2a4238e725cf3403d7123abddd278cffec0e1b35159df47bfe5dd147ea6642b6d3ba9037524835f6120
-
Filesize
1.5MB
MD57ecbbe8639b52003975cf39158f697f8
SHA10106a9ea81a1107e1c1a53465bd2d2c60c0e2792
SHA2566acbb1d6af613d11229709f7c4a6a41775977d037da9e7996aaba8f7896055b6
SHA51203da1877db0f9859f300a351847c2902a3ab1cc62909e9adc84f3c860fe986a0abf20128f1488200bb29a3eb5b9b646e8c3d5aa92955c0463f9a2c3c9f1f6006
-
Filesize
581KB
MD55c0b6407be7ebb0f65ccb5b3e3ae71fc
SHA1ffdd3140c9790ce9d6aaf65ae82b0734914b4730
SHA2562a916187eaea4fe8bea283cd4814ae9e31efef9c1d1a671f3d0bc43b96945ac0
SHA5128db19f065468177f24dbd5ec286668dc851774a59bbd1ad9b86a3cdca24e2b7408ea795d07b506f900493ddab75d6d325a5c03dfd9641d2c4630afbf2f87748c
-
Filesize
581KB
MD5b059072b9072b7321c5a0b71f8404a7a
SHA18ce20ab866998fa933587e53dd41632e8ed5f2d4
SHA2562dec759c0687cb5f462e9572816f36542f3ca1848c35b5a1b2fdc76d2be9838d
SHA512bdff5c230c7b1ed3c57f5dd53fc82b7fc95ad50b661fbf4a0e82fb3f3238506ad7a9c65b18a512a3e167182b2a6b32afa1c4c60cfd1135d3cf308f5064bf46f1
-
Filesize
581KB
MD52aa785a2c0c724e5fa91c9ce405fe073
SHA1e49f642cdec24b6125d572e0efbb570d8c5e3266
SHA256ec755ccab32d536b6274c028b65d8ebe2b60031d4f9aee962c833a5663c18b7b
SHA51247385306c7b4ed081973d67161c04e599e75565a03bf1e3a3968a117c1b8a34f209929a3d1bafb97c793366467c2ceb9ae079b3e566c1b9aa32dcb0d84c95e26
-
Filesize
601KB
MD5a34f3d6018f04eb9e40d62a1aada51d4
SHA1a0e329141208a94cc32143955c011a078555664a
SHA256c4acc41077a51f5b882cb6a1094bfabd68a5107e256d59563a7c98ad7cd3888f
SHA512f8ca8d3168f4487dca6bb210c2058870c54da91f00bd4e25363081a4bdc6402315f1993862b54c1ea8c73405a436b4b26b243dca9c1465b27b42d7d82244ce8c
-
Filesize
581KB
MD5e0bf089c6f2c0e75871b1f8c2fbdd700
SHA11516803bec1b454559671215eeaa355f3848f9e5
SHA2560f363cbe9a76a629bd8b601771432b32a9ba17b144bc0dd8682c958cba70c60e
SHA5129a27cb6315da128ad99c089fd7861076120f1953176c472dfc747638343eb1259c37031d03d747d8657007567ad1f8730af11a79885e2fc2d44c04cc02125e63
-
Filesize
581KB
MD57eb519872585d77fd18875d520168710
SHA1955a06fe9d33a8d5be3a1fa23deda7deb032019a
SHA2569c2fb4cf938bd9351fef82486d2c84cdcdd53aa4bfb0feffb06c9cfe00857873
SHA5127c48109467a9e5bf916aa9810546d64586544f1865694ad79195ebf8aece1bc4e66211d874a2051e28c068ec1c1378d90579adc73bd4c04342fca39f8a75e3ce
-
Filesize
581KB
MD5feeda6f8f01c7196078d0f608dbf25e7
SHA1ac66fd5d674e4f56e891ef52024fcc395dc51927
SHA256dc0237c4035019e5eb3dae7500adf6335c870ba9fd2869d3d76a387e06295f45
SHA5127073780fa34dd75a5ea5cbd8bb04065d9ee023100fc32d3c2cf8f08c7843fa8536316fd4f0012f19e0a20ff2633ecb5e9b941e0316371a5c2b6743de686a4986
-
Filesize
841KB
MD5bebb627cc9ab576f5d5d31a6e4183fb6
SHA1e556e91cc71e8d96e46f753d9625235929610541
SHA25647ffc787a2478b9c90e2a8af13613953f9413a094107395691e12327c291afb9
SHA5126489ea182f32f93d36fe18604a7d25c6c6f71208a7ac552c2c225250af4ab0ff3088b345a19b9f6521aa75c097853bc9c8a25d036780c53bf41fc924ef7bac21
-
Filesize
581KB
MD52516b1c89edcd35f161e1e5c4d1b9863
SHA16cd9fb70cce0dbcce3715cd931b46f9ce2f54549
SHA2561cd6ccfe90b072d42855339a65c252886d97042204bf8be9193273f1bf5f65f8
SHA512c1c41217c77631d7f779360e930ccd8d78aadd3ee108bfe1e1c070467b687f2a317172b05e265f41e69cedfb87ee645331636d6f5129450a10f9881aed6ee8f1
-
Filesize
581KB
MD58a37629634941b906e2df9f1e3402343
SHA17999840fc327e624518ef7c4d74f361b6310eb26
SHA25672163a2a216b54529a99f4a87baab04d03d8bb11c0117db4191ce29ac0d6d719
SHA51215ccf600be2320922ccb8ff23d3e10bf769496ed5b0f538be92696b3b3fc1ddc64054a200e632921384d7906060ba45e9d3c32a7c2de0a8b7aa6147732263115
-
Filesize
717KB
MD5e3ac124ccbd2193311a9371389f3a864
SHA1f36e58127c932faa830f846026e627ee68a18026
SHA256b3bec54d87bd3eb309e383d5d887cb3c27a66303e6da52fcfa837f6e6c64503d
SHA512951d44d41107acd02ef12c6c560c113c200359e05f03c1cc09122c525818ba6afdd1bdb0c1138a814e3f7cbb9266c958782b1ce988288d823c0e03648c1459f2
-
Filesize
581KB
MD5a4549d9d038f63327579d9be3171bf92
SHA1e4fb3933694f7d6f9749e3e4b08f1e75d2c57422
SHA256077ca01289bbe48a6ef2b4192445fb14260c03463250cec13d6796bf07d94360
SHA5122cd4c5ef3f4ada6608f9620af7ea813a49f3617975d95aa488d2f476f69310e622abee61e790c2676d94497ead33f444cdcc6b2aaed66e68d0a9779854b0e179
-
Filesize
581KB
MD5fed46915f9bbe534f25b37320fe263b7
SHA1ebcd7f47f3cdde8c767edadfb6ff9eae891c9daa
SHA256aa57f1c554d70e867d42ea723f083d6f0db2e553707f37f68718788a36f10788
SHA512f06087c3f1d871fdf4036764533e1787fb57918b8390b739b69593f26c7c70d062503ebff622a9da305397c1c06eb238b415132e2b282f78cb8772ad9166445b
-
Filesize
717KB
MD572b99848bfd50004b38002320e0c5c3d
SHA1dc605bd106f3f39d30f1419581c0bf7caf9ab3d7
SHA256eeaf977a7e5d3e25bce4b26bbc681f891725673ac88d0def0ec384e1902bf32f
SHA512e6101ac1bbafca5423c4ce476b1350732295380f692f8393417d377a10a9eeadba1c5a36e3d394e87580e622226fb8b6681bb894d33ea5864971167a00774e9f
-
Filesize
841KB
MD5ea5c35021d3653e797cf9ab3cda9c9ab
SHA1fb190890294ce2d2874914fcaf58fbafc9389c9f
SHA256605577e952eb5be33c353ffdde2df16ff5f9dbee0208025b3af65ee817cf4230
SHA51254c528a8e232941d404abc53faf22b79d6452587230ef49d3439a45ceb542b4331e05c4f5f3e8bd3ce443f29977e7b277839cf401068255000b6df885b3b5659
-
Filesize
1020KB
MD54f3b7875b342bf25b08ae530688d4a83
SHA108b29da4bdf28b51b0a76f01da4074822ba4a945
SHA256eeda3c4643db2d33ccabe39d901b28f8d4c1c16cb249d02b64e48f33990297d2
SHA512740391aa80e9324da3c227fbec6d19c6e8522f3689017f5ac0720c88429d8e1a93b5a1fd0fbc6172d7dde960ac8066f16f0afd4f1ae9bc34efc53ab4586f3dbe
-
Filesize
581KB
MD53cb2d22b075edf3024fd4454e3894ac0
SHA1415d6b22d1129732bf5f74960be94dd1c1007d40
SHA256a9974d48693d6bd0c72f2372a424d7f1c009b46184417732d8322b5c9a3af16f
SHA51255b0f16398e2e0e07727cc36f6c4e53e24490ae849d16fd37e18ff2962b9c2fec24ce803d59d32e9f0e05f2fc9caee6f0cccc1555c912a02f6223a060896ff54
-
Filesize
581KB
MD53cea9379855aedf4d987bf6521ffd7c7
SHA147eb35ab0c42def83cf22cee47237a074003b399
SHA256778af3f060cba55c29f49ccdaa634daa3dcd320ccad35407f49aa5d6d78b24f8
SHA51241bc888f22dbc739ce2c27dc4f8c6b3c8d221760ea0d65eb522a1873776d1e2fc91ddd7d4a87eb769b637c754065deeebd1914aa7a57468bff1a426480c261c8
-
Filesize
581KB
MD57e6343a3a4a7b065d5cbc651f5caa0bf
SHA1561a2aa745cdcf1e3b582941ff0ce77d2eac0a65
SHA256863fffc64426d47c46ac1862b84fcdaccb7910da011d203b0d8a9fcb99b8bd33
SHA512f1935519227445fa6f6eae2febbe5b6d54fdd95c98173791e3efd901fb32a52ffe5812f9841b28c9c98d36b1f091db964e5f0b25382b0bf3c683b17eb8cc1da8
-
Filesize
581KB
MD57365d99b5c9a6e432f10ed903192afa2
SHA1149895c2ffdccbee2b75d9837e3d35b6463f489d
SHA25670c6c2cd478c53d47a60c9618275db07bf5222b4bcade6e23a4b46735958416f
SHA512f4c7f0b5df45def6546ab18d9c1f9ea4b066ff12cdf4c8ab8f7ebfcc774886212cdfd515097748af7caae96021c57436dd9df6405fc104ea1eb67b8bac358974
-
Filesize
581KB
MD5de12d30220100d8b7b7223a3b58c9ea2
SHA1f45a28ba323f6fef272bdbae7a8fbcee4715b549
SHA256c40c501c4e393d8864fceb996d68d3b64aa2fa4870df970562e6600c0dca14ed
SHA5126d43162b393b3f7f66b7e73e52ac5f8108c001dca4d241657e291454e320285cb1bff57a754fea5608d3be9334ec9bfd11d78f97b74714855dcd8e115d39683f
-
Filesize
581KB
MD55fbf1f8175f6cdaed47754214aff61a6
SHA11fad6218c087e8e6a6ffe74fe7eaf7b193be83d3
SHA25687468b166f8b79f55496269518666429e28e1ec6cf7e96d93267f430367c425f
SHA5125806457795e166fa51da354094d3ecfc3b51d3647164694ed6880ae44934097d20b404ed6b90d39da63af346745a5aa5ad4309d79e574a1bec2b25b05fa8a238
-
Filesize
581KB
MD56c858399fd8873ddfa2c42d15c7a6bf4
SHA1e1561c0fc26edd187e157075c0bc2759da32e945
SHA256f51016645df5ba97bb360fbbef8addaf4886ed548cfd79ddd1e2a5f9f6d1a3d1
SHA5128a7e47869cbb188ee0a99caec257dffc392c91e4002c85bbf06897ec54dec5b7185ef2554480ada3ade7bb34fa3de5d21e4254074d627d7818ae382541fdd100
-
Filesize
581KB
MD55a79b4050a7a02a7b1d85b8b53d89eec
SHA18a6168980613f0ed542cc08cef7681d3b06b034e
SHA2566c075ae1a6b540d352e05693fda12e98964d2afc52b7d20d047b389ce9e17ae8
SHA512aabcca2a06fdf9a4a3ada4b389edaa9d108b0b2358711ac52d80eeadf204b90bf37ac5c308ff78eacf81451f101e710e1b6a32c50ec21fcd00526065a96f5084
-
Filesize
581KB
MD5a967d6497ac40ab94caf4650346dacec
SHA1914918ce7b8520c2c5cb64565a38de73b45e344e
SHA256f722e5c5e9de8c87f9d72f82a6c1693b0c046a26ea4d230108e98d3b94726384
SHA512b04549f2915c9cc89a91c6324e61738d39d50b205808278a19f05c079c1b04d2f38422c43015e7ad1caa53eab0a37b31a463bdcb56c86552e98e0149a59de6a0
-
Filesize
128KB
MD54b414c14f3b3d4941253e2a68b5e2c51
SHA1a19d13b4f85f81d48b2523d14251377cb0fc74df
SHA256ac2aaaf8fa90b7fa8dab95a9c60858da1d7017249b2fe5fbbf2d0aec01237da5
SHA51221dcf398473a685ba89b52f32ec60f5c90c6b7c7c5c8d5c22759daf6f6dfcc5abea156055f5979ad3bb15259b8cad6f11c55430870c393c21789d0412ab06d9b
-
Filesize
581KB
MD5c25b74b773c77c1c017fea2cf6b3c0c1
SHA194ee6b352f77738c71338e1f07f9aa8cfebd0765
SHA256f2f1327d391d2605ff75f055b363ea3fb84a4e0bc5899336fb3e1d35a3dfdcc7
SHA512529c3193f0864f79cb7dd1b6aeee00c6af5d5c31079a88019420cb5e2a0587b8a37afe5d1fd9a6fe3d9bafd85335bc099d5e6b32896005e36203341cc8d40523
-
Filesize
581KB
MD5af25705300eb3cc173ea9cac31d7ea69
SHA14c4d2af249a1492c6cc9221fe08c93228f3ec711
SHA2562f8fae121b6f37415aa763cadcb747c58463258ecac4ad48efedb85bedda7ee5
SHA512837e15259f88ad48df311760822d3754b6c7b014cb58fa44eb80dc38137cde1b6d8f9b7933650516a7961805450f9316c81fbb2e99ffa10896a909bd90d61076
-
Filesize
581KB
MD50b3ab3a6167b989ef11175ebb1d8fd6a
SHA17407281801a537db42a53166dd9228652a058538
SHA2562ec5b10d678f44f3c5aa923fafdc191907e3259a651600bb5e0384ecb6421f52
SHA512645dbf18f9239e1076db1e74a6d5f8267a00f8c7eab7c07a7519b7c63b117bf8f74a7cc21b9dd14a3a9c7eda923643376483fee3dc539a207addd890c44ff55e
-
Filesize
581KB
MD5882e422e5c3b0eb695ff1998e7ef1caa
SHA1beb222e4ecad3b20e657e7aaa11974dc72821e5e
SHA256ca8e8dca8c795b75d3a28a59282b3af17bc041d675cd41032a1628e9f7807166
SHA512fdb9b08269276095ed07c6f7d4eec9de3aa2e7f0db7dd88f5b92ac003ce527b7b2a9f16732e577030c0d7c270320b493c95c95446a5162b3b052f21d8a6ad8a0
-
Filesize
581KB
MD56b4e9a59ff98480481164ccf81e9c12f
SHA1625ba6d42fdb6a8a4f4fcac6b34ad99e9587bc1a
SHA2564e2a10da8f8abdd71ac43dd6b753672f36ef74d479898a90468a418bfc66333d
SHA5128fc4abce585d8069839f1552c75d9de40b9a71cf4977ed050d033e61a6ea815821cc43b2e76db8ee32cdaeb9f8584bec2dded6226f21022e7c48bd45444d6884
-
Filesize
128KB
MD55e6a7c88f612a733f5ec28bd2cfb241c
SHA15f7aeb78a6a1ae4c691d38156bf4e9646f0c8988
SHA25606102b0e0bcd52351e657e3e21bdb5e38f9b294dc479488b4458b15daa13b30b
SHA5125f60c29f01376d1421be33fb7876036f698bd3774f3cd6843e5c688951f507d2d3b66913951362eca1aaef01f9e1b86dd35d53d47171208980c87f57be20d9fa
-
Filesize
128KB
MD5365262eabc46fbce2524a431c7131338
SHA1cb55c598a8a1d9475d9a501b310bdf0b903e0799
SHA256e6fb19d3e5001c20e4eb7f6a7b294cdb61af8a6af1c5431762fbc4b90c0ec82a
SHA512140cbb28f80f6381b416eaf312a7df1f49cad1c9cf34a7b3ac4fad8ca76071bdb72550f38ffba4fffd05c31f8765bc30444cbce20f344a7d3e6b55cbc5c29f18
-
Filesize
128KB
MD54e9ea1d9aae57ddad709255591121515
SHA16c90bc18a27c599b484ae1bc932d7bc497362f36
SHA2560a55e6cb5ea9940b6ce8f7d8ad3f207c1b001568a3851c80bb656d718956f856
SHA5121b51b6ad6b7171ce83e10968d5ade3befc5d86762065dd9757501d8da419e79a131723f985ca0d6526284813a80939d678700dd9ce034a3ae7a810d8feef3dcc
-
Filesize
128KB
MD5b9095c18e7b33a7ef3c9a377c742b3c8
SHA1628bd5857553069fe04544c2fb90e9c0ae7e4c3c
SHA25615fb18c2ea96751b9541b49133607eb2038ae7c51312872b34a608deccf2ef3f
SHA512fa1a04116b25c52bf3f3b1be4095b9cd727e7f4e4cfde466cb243eb4464224cd63389fafbe943cef82cd924fdbac303071311610bd3b4f2f91da5dd1419d508e
-
Filesize
128KB
MD5cfa0bbaa41d44fb4587f3a9e5a6ae116
SHA1b87b37bcc5874f01df7f5c3347d49355077a12cf
SHA2565bdc022a37c531d8f83a07759cde89ab1ae204dd7cddbf4a6f2faa00b6385b90
SHA5126c913dea999cf6959fb5569b4da6ade99fe16ee9c53787e392bdd4acd590e73671fb6099126879e66e24579a343ea5b8e05143fa5af49be11cc470511bc95912
-
Filesize
696KB
MD55f08c231cf75d0cc68bc47afeb430cda
SHA10cbff4f9118ae863111410f57ca03e41e090e5cf
SHA256ca5205026e9d7a3789eb5455e2f7907810c0529f831c988605af4d88c8fc4914
SHA5122f96ad053c221ee17d4df49e64fd4f50059153a109d60dca505c81c0164d208074bb02ef2f9f5817a7e2af033fb4e117e1c37ab54b5ae94dbf3a40c5bab81db1
-
Filesize
659KB
MD50eeea77e615042c210734154a6b5b861
SHA1806859dc0f3d59b9e8de15c4873c20b4f46a7c56
SHA2567eef11c9f1c03798f80b4c0ebd2994d5100c386852300813867325501efb3ed2
SHA512571082fc99530813659a5c41a51a65996792f17531c526a7d7bb4204da6d158c1960241acdb8ec48e39bc69f0a238486c0ec75060ef62dc0764fd09d69c38002
-
Filesize
1.2MB
MD5a07b7f68800c8b2f73ff0f72adfa7d74
SHA1b3309071e34a311893dc586aa9013fab46493c44
SHA256f8fd38e3d2cfba509ad4c24aab3d013fd5fc20befa6b6cf4356e5b1ad88f1a79
SHA512a986965a6e99ce7c740040340521bddfa6a72e982f9a41f8668b3522dde9aef195b143145b5aa64e2c81691f72289880e59876d82ffab53e3af97e009ed07baa
-
Filesize
661KB
MD517f8755f14a271abd3673ba47ee10f03
SHA17040ba0cdc79668ea5e52be9512ae162865cc15f
SHA256f020a96c115eadb59c173f25aedf394fca5ca8102e2de0c500cbbea4201c2de0
SHA5125b742c86835eebd2333d8135491eff6defe8b5a87228d2024238a29466dd4c871b248ddeb04ffe5dc902b98686c01d4b6dc2c9baea4dc9fbdf0ffeec61bd9b16
-
Filesize
1.3MB
MD5a14f18f0b09a9160a85eebb110840f0e
SHA100878ed3897009dcbed7ada9329d6a29888be4a6
SHA256acdb8b190c875792962ce1cfe6f4bb378be59248cce0d5b58d2fc6c8b037da2a
SHA51298321dcfa70a44e23bcc722463e37a46bc19d2bd0d645843ba2e0951698740a21502409e0a8c464f9d912770597d620c7790ceef167a5214ce75feb858914571
-
Filesize
5.6MB
MD508a7e0de1962c99e0f9be317f68390d3
SHA1592c4df2a6812e0911cf6528a2a1e70504fc5d3b
SHA2561de9d00314050acec31df229808f843abbeaec34c96af7fb9bb96a72d6691be7
SHA5120e14a3e1fe730e1431c7de2b24d2e1c8cb3da5e5da6ef2ce73a7dff2540416f64afc7259f788f3eb4b3a0b64fde70624b3219375d1bc92927bda42454cd306d6