Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
09/03/2024, 09:37
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-09_a706739821b94c2aa998b0f897f10bbe_ryuk.exe
Resource
win7-20240221-en
General
-
Target
2024-03-09_a706739821b94c2aa998b0f897f10bbe_ryuk.exe
-
Size
1.1MB
-
MD5
a706739821b94c2aa998b0f897f10bbe
-
SHA1
ed75ca484fd0963293dacbace56d435208ad8314
-
SHA256
d4144c0b402127a5b274cdaf6aba385f322dcf4b07d2ca444c6d2d6ce88a4d4c
-
SHA512
ffa05042d5ba6312e5c9632c71216384032b22bc878397c84c785e3492911c854759c15dfdc25d0cc0373c2344cb7e4f608e387cd9da5341c77096653a04db5e
-
SSDEEP
24576:3Si1SoCU5qJSr1eWPSCsP0MugC6eTvqtL+SgvqFE1d3ddJW3CAqPSbwL:fS7PLjeTvq0re0d37JWyAqAu
Malware Config
Signatures
-
Executes dropped EXE 8 IoCs
pid Process 2484 alg.exe 1048 DiagnosticsHub.StandardCollector.Service.exe 2604 fxssvc.exe 4368 elevation_service.exe 4284 elevation_service.exe 2368 maintenanceservice.exe 4296 msdtc.exe 2984 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 14 IoCs
description ioc Process File opened for modification C:\Windows\System32\alg.exe 2024-03-09_a706739821b94c2aa998b0f897f10bbe_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-03-09_a706739821b94c2aa998b0f897f10bbe_ryuk.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\2f03ceceb3e2edcd.bin alg.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-03-09_a706739821b94c2aa998b0f897f10bbe_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-03-09_a706739821b94c2aa998b0f897f10bbe_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-03-09_a706739821b94c2aa998b0f897f10bbe_ryuk.exe File opened for modification C:\Windows\System32\msdtc.exe 2024-03-09_a706739821b94c2aa998b0f897f10bbe_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_156609\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7z.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe alg.exe File opened for modification C:\Program Files\dotnet\dotnet.exe alg.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2024-03-09_a706739821b94c2aa998b0f897f10bbe_ryuk.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 1048 DiagnosticsHub.StandardCollector.Service.exe 1048 DiagnosticsHub.StandardCollector.Service.exe 1048 DiagnosticsHub.StandardCollector.Service.exe 1048 DiagnosticsHub.StandardCollector.Service.exe 1048 DiagnosticsHub.StandardCollector.Service.exe 1048 DiagnosticsHub.StandardCollector.Service.exe 1048 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 668 Process not Found 668 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 944 2024-03-09_a706739821b94c2aa998b0f897f10bbe_ryuk.exe Token: SeAuditPrivilege 2604 fxssvc.exe Token: SeDebugPrivilege 2484 alg.exe Token: SeDebugPrivilege 2484 alg.exe Token: SeDebugPrivilege 2484 alg.exe Token: SeDebugPrivilege 1048 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-09_a706739821b94c2aa998b0f897f10bbe_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-09_a706739821b94c2aa998b0f897f10bbe_ryuk.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:944
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2484
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1048
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:2940
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2604
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4368
-
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4284
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:2368
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4296
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2984
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3788 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:81⤵PID:1604
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192KB
MD5d3a7db4f5a11d7c2d0e7d48c0bfa0a1d
SHA1a2eb92b8e20ce494967f0477d0cce41df0f7c3d0
SHA2565147bdb622f460251d62b984a91c7b7344eca0af8b973f8c5f99a9926b1869b8
SHA512c6bd6481afb6824566f873db00f797b13dc55116bff6882fdc261100b5f53bdcf7405ac3d79f3620e84d338bdd40a0617e65a91d22897fcf172daf49e2d4cd17
-
Filesize
1.4MB
MD5626acc12114969cb8bbeca4754b55dcc
SHA126c0e0699bda7460243514f5e45a669ed486a4f8
SHA256142bed6d1d6d50523a314a686236b01fa7aedbdc4396b151e9aa280cb92178fa
SHA51233e03598e2ed6d665b436948574e42d96895a6e0ad9f5b08ae032e6b7986b57a8742e64040010af4688960818ba73dfd691cc8acfdfe800d78f81b29967a9f00
-
Filesize
1.8MB
MD5b4c2403abd68cf2a50f3f2aa85ee385a
SHA18eb7472e9a72750e91223b9869418a4bc715ec4b
SHA2560fdbfac1012f57bd7ced876874b0d25c6087b919a13ebf78d3f77f9f5cf201d2
SHA51238697aa829580a13aa0540227197143845b6e2f6726c356030da02754d5e23d5fda86f2be1a37e297494448c1ae8582b8e0bbad11dd6329d25366ce6b4ea087e
-
Filesize
1.5MB
MD5c61d7111e1490e4dfc874f0d7a488530
SHA10e99092b736140f09d33b5745cc9ae607a2ea9cf
SHA256aeffedb33a66aa3aba5a9b32082f94c9c9a8b367671aae214337831682c822c5
SHA5129a9a58f089886609888962e67587b3d17d8b6f453c8202ca5782aec052a5b65eeff36109f7d0efbf3cc320bd612cef40edb498ac1123f99eab4b58553bc35823
-
Filesize
1.2MB
MD5598936424b1406be245857c4dea49279
SHA178456077c68ddf94c192277a98e2bd1b47be414f
SHA256868cc2214836e579eaa03b41091d88da1f0192c98a1319b939f18c475f48df15
SHA5126021f2a37546ddbfcdb14546150898201d92ffd4717483d45be18e520073b734828668bde15b8cbebc05f97b3f5c46086a4a0101b08ec3d1a6c318d0f29ef7af
-
Filesize
1.2MB
MD57f0482854be644190e7f56ae6215e5d7
SHA1b387995b0636e58277c30b23cb16112a682d85d0
SHA2566d04a966f33d699d32029fafabcb00731ca8f879d55a0f3cc7e4c3e623d71937
SHA512bb85eedb1918f26e8aed78f164a82bfaaeb849551639ce50525a45d6ee3dc7ddbf226a3b6988dd1f8ffb4d528c36c997faff8f9d8b1b3e9f9b0eb5102f088538
-
Filesize
1.5MB
MD578f57930279d770de4c2035eb0967fe3
SHA18938f62d33457021762bc2a34eda13a823844de3
SHA25625770858c3b29517157cda78fccb7cc16725265de4975d25137b657f97033efe
SHA512c4e7ad6dc644114504c3cc7d95dbab4d35eaa5c2f489e781a5e89abb0ac57d9b518c54530dc6b1596ff6420c48fb45b3f30d03d08fef505665bb4e5942131d5a
-
Filesize
2.1MB
MD53b0c42150fd0a8dfd8f7f64deed1f215
SHA19e3c03375282af7616fdc4d9a8693fd1ce6aa875
SHA256528842997976a7fba51f9005e3bd83e5e935ebdb0cad29d5d101897dd6388365
SHA512b715b3f2d7667c6125a2cba5f71db3b67bc30d60eb7e6b9915d912f7da51a6525db993aa6e316aa23536901722560753538359d33afb6224798793098e3c962e
-
Filesize
219KB
MD5d4dbee5c84ff6a7a840c85c5d9f63e4b
SHA1bf6ba44f1440f8326ef0575452ce0b1734e42f74
SHA2567652fe16a09587ed4269b09ed49812717f85b246096fbb981cca2eb49d63bd50
SHA51227b62be534302bdb4b57435864c79572a9f29574c787f5dab1d807b91bb4eaf69b29020c97410c6ebc5c7e31bfe84612a6e8a12eee262da7c3cca6e7ccf92250
-
Filesize
156KB
MD52d6fef2984e7a940854a119c090039ec
SHA11021530dc4bd8c89f17c04a150bf28b8977a4a14
SHA256350e55d13a20685a7ed4cfdf2f379f2259200603543ae640826296bbc39459f1
SHA512301206ea7f76d8c80d944789aa3bad1993d1779c0bd7ed5927f6d0fd2548e296dab838da80bdcef5f43c7698c9d277165804de40371263c72094dd8d8d83b5d2
-
Filesize
2.5MB
MD5ab230e8a0d6c6b0cd0af56cb9900e35d
SHA1dc69cfeef062e9ace39ebb1dc2021ce0cc094759
SHA256da5bd261eb9ed0d3b65b68f0224cdcc6c1541ad0273b5953ab0868a9097907a5
SHA512f6069b85bc76fe032d955d95a72dbd06995460c97b74e364c04d41455eb8fbae3b32a6c865d0eba14e3ce1dfedd175e960519090ab6733cedee7fb6a9bb79555
-
Filesize
1.1MB
MD52165434e3a216693677cf8d1cf8e9b40
SHA1034d6e535351b0c477757f349582180526e4e984
SHA256959a75e49df19663f258bba7408be2730a8d45e9b88b26dc1ca471a72b63dc8d
SHA5128bf579873fb1646d4bb9cd10f3a3f7240936b752ad3a78d32a31d8f12fd1dffa4b131888c534122af76c8fa4813cc24069cb405b53c26e69518e4e73c440e919
-
Filesize
1.5MB
MD5f796d09201b352eaaa1bcef1ede44e2d
SHA132aa955052c5ba23bcf8b4bf33d260c401d40558
SHA256d79c89393f13c85e2da434244c34a8ccd49aa3134276b12497a07e88379b6964
SHA5123fc9909ff5f64073e9055c951f3c6efaafcdc7eff58ada670fd7a85cbda90da39743e7be8c72ca0e51dc74b7f411406a93ac038e9a26d26ace789ba2bf65ca4d
-
Filesize
176KB
MD5bc0ffa9be4e8e11ce1e513c6d2bda5c9
SHA1383178e1149b0efd1d2c802388dd2665f21c180d
SHA25680cb3b611ff1e9a36e9191c62d54fb64b33c26cfd63b4e6221719a05c9ad4b5c
SHA51270f91dcd054eaa4d40ca388bfe53bdbed322f2a1a766e2d6b2021e093be18efcfc3238fa4f79dd071b86dc8898edd24f0129682e19c82e11d382bdcb0f7b0ad7
-
Filesize
1.5MB
MD526ed4508dcca8756ba9a7adde204c8d2
SHA16d0f61d688702321a719d7d4c0123f67c3e2d9c4
SHA256cc0ae431ad2fd59eb6bd2caf97f3f9ab98fa588831fdb3ed038ac0a04f70ac65
SHA5125b2804536cad3109fd74a403ea8e298176e4a8aa92d0dd911ffd501b2557608032bc0575466e7204160d96ceba04128e431a4903e6b60c18fed247ba0189a169
-
Filesize
1.9MB
MD523bb7b93317f21bb646edcbcd9842a81
SHA1bce7b7bf9bf9203cfe8066cd71b08daf46097fef
SHA256afb5df13c31be275d5de2e4f6501afcdf04c8cafb19af8c5bcca567a512ee527
SHA51251a1fd7266d13b1353b05ce89ed6dab18619335fa8ba5d8ecba5abfcd1a15bb11ff297ff6a0c67c487ed0f2c24e13afc2740e357573b484b040a8ef1d6a23784
-
Filesize
1.6MB
MD52b2897dfbe82390973770bfbc5617e1a
SHA1f763695d46ba3791c8a36dbfddf6b8866d2beb4b
SHA256f3d6dcbd02865f5761e96e8480f7d2fed891c518707b583c7ba3117097186719
SHA5121b43125ba581712f4affae658efca51bd4424a1f02d6bfa70bd666e40deab963229f66a6ed75641658f519fd7546b376a62c9ac5483f1b98879b8323df511afb
-
Filesize
2.1MB
MD5c8eb736fcf315daed120b98c6f84db22
SHA13f34384433e882a6a690ee30a8916012d8549be5
SHA2561c471a240a661ba073c09b6773103fc313f718370251b8998b1e92ec7dc8cc83
SHA512243c7399d6cb05d184d857dd04d5437b644d714060c583a7eb46961759cb985bf4146f12cc804a3a8c1b8c9e8044a1b52f47eee468b0ede645ee7184eeaf578f
-
Filesize
1.3MB
MD57f7d42773c0ca7067d193e1520cd5f92
SHA14f9df77ee6b26f87593173dd0e2f0727e86645f9
SHA256f3b17a62e9cd6d4ee4ffa1b14795b9b507bb91e6747f2967fc9d4851d1cdc958
SHA51227924d720c4604a82a6077114511f869ba6d4b696f8938bd56305490efeb56ebce46b33c0bbea4f157aa13d3c17b642db4ea6a32bc19399bd5b0ee808bafb81a
-
Filesize
1.5MB
MD5e04c3b9d28937f87e91cebaaef312b6b
SHA1ee3722e796a45c9584a24d62c79381ae98c33d9e
SHA25611b4da389b8be1137a0b46821d024b4c4a27636606c3fed9d64ef64a7b12543d
SHA512b5a3fe603604d31d791d8bbb0c7a77491633a668b019ffd71be7018c60dfb0df089432208a2f90e2c6834a255626b8a093420c0a4ec2186ab7d062ad5d7f8b59
-
Filesize
1.2MB
MD5db8b60f5d32202377956dd2877f55e12
SHA1956ddd313d5018dff974f6d8533f72d8bdeb4b73
SHA2563f91cbbdcdc4fc20f97b41f93a9ccf49289f398ee3be0fd15fd50ff4aa33ff82
SHA5128e1b0120be7cd634106a3f148c54e841b56a27a6fab7996a7fec9b1d7bfe011edba616bddf52b2c3c850b80499f07e1a595949e41deee962beb01dcef66f9bf0
-
Filesize
1.2MB
MD5f1a096f389f090ab09639eae4f00c1f1
SHA1c98f9ce23ea84624ff9948cedeee7fc1bdae63e1
SHA2563394fa0fe380c0cef17b4f5ae4c43346e2710930387c95324851406f7bcdaf84
SHA5124abdca7e08b439bc0afb2a258d2cdebd598b6a331c607dde186972ee03aa4ff1027607882f831ff8f311295ac54184189480c0e3eb4f613fa9be8416393d026e
-
Filesize
1.2MB
MD517961726c84fb5d4c50bd898f776da7b
SHA1c70a7bc64a7fc65ad908dc2a48142744cdb7d176
SHA2564e25069c670a88bcfec7a43497ea397d479362fa27db3083fb3421621ce2c58b
SHA5124c674132770bd41579fdb745e03fcd1c28a10c7badce83cceec8532f789d2da67b13cc7bac030c80eae9c1e931460b6600ee9a88bd04ee7747804c235e3f382f
-
Filesize
1.3MB
MD5ed6771203b4a92390ca16366d3a20c05
SHA1f976c1af812cbc60673d3d31ce11dc97653823aa
SHA25633f020eb21837dc125cff1b46c35eed1ca55d4c768aa172ad36dd0d52b0bc1c4
SHA51250ef62184f4f655de89440edb2e548c2779a2198511d263f085748de0f81993f30a9430d129f24d23e9790d6f9f1d5a2251c9064ff83246c4e67cb92038fbf92
-
Filesize
1.2MB
MD5ed3a1acf4cbf090a9d6ffc255b440a3f
SHA1845c5a1c61a64c1f10b45f05b69709094eb69ddd
SHA2560106c2185713db42fc89c8af26a7c391e5a4e5baa66d8f1f1d47be992ca8ec3f
SHA512d57161362b7da1d4b94b92068e3e609af9e56ae341267209ed7105fe515bdb2cdb3265ad5769f2e7d92a7e7c68b138eeef8612c34464c5b111a9219a6296fc02
-
Filesize
1.2MB
MD5b120543ebf9295be3683e05b05393cfe
SHA1e29c79b0d4194b3463738ebdcb9d18416154ebfc
SHA256bfee17c4c29c6d57476b302332938591cd902750aa53f0b3a05fcf173cd9dc51
SHA5129f7a72bd09ce28a3e3993f70ae13ca82600caa3985af29e5d21cee93c6263ded3f393e2316ff176915a0890c13945ee5f026ab28b199422dfc4f17fbd439b14d
-
Filesize
1.2MB
MD582b11a83b15e112507d8455d44e45b10
SHA173db8cd5f4a53261b04844743362e685079c7eea
SHA256dadbe8b283f9f4f084179bcb36dc04638f91faecd763accadbf5514698b8e504
SHA512b4fd666b0dbc60775d548c82caa3d6f8a33dedafd4f07e5831f40a09403dfd5d0c274de6eb01b686ec28d5e044acb9d18f0101563db927114632a9843053a7dc
-
Filesize
1.5MB
MD5074f7a235510a2a0a05fb9ca5f8395b2
SHA10576e07e171a02727a8c386d95ca9f99d8bf2cdd
SHA256353048ca63c1aea4536ceab05c2bb2ac007d57250b9b78f868f601acc8adf4b9
SHA512bbb3168ee79f43a45686e26f9d7da58da60241e70e5425ea5f607c1bba98af3672ddf69fd6cac78906dd1495dd68ca659abb69f9f1d57cd6087bd41b7ba6309f
-
Filesize
1.2MB
MD5e9f190f256c9e911709366b8570e478b
SHA100b48d6844d9eadb9bc6a1ca2a762129a1c4ec17
SHA256dae30f3b2f23ed699686252e47c5e6e30b542c4921373272726151dd70b79f27
SHA5128fcf32ed1998ae73c922142947bf03d8d9bc3c9eef9d6d9ea7371b735f6e577096cef392e9bc6baba29452c95bbc7959c5b0091b1e72373fa90d1a21d87640e3
-
Filesize
1.2MB
MD57d70fb18df325d812d0c7bab6579d04c
SHA114fca80df7d34d54f3e1b35d5b0d05318c32c621
SHA256dcc09669e69751570c6a2a2794773a149191aa5778e6bd3a23c51bb468d151ae
SHA512f25ed645e7f984e262786b4ec47eb481f4e0cc2b14250777fa52badb97b730115fc136202494803c7feb71c4642ab5ef37a4c83e49f2378aa2eb259ed9d29ff3
-
Filesize
1.4MB
MD5a1655991b299cb30a0307ddfbd8ae1bc
SHA161a2dbdfdfb0b84e8669fd3560adcbaa2c07ca57
SHA2562319e97c704e9f3cbe20e29e1b7d99a52f79d1a75f27fe135d4d17330bd9223d
SHA5122e8eddcaa598d2d6c5d2179b4371b2ba2251e36d40c702c9cd55054b3e49b9ffeea4f2900d5383e1dc547bb0ef4deed47895ea692a6c9e11641a254d1b8f6597
-
Filesize
889KB
MD52d20914f3fdcd9abf93a0707d7ffafb8
SHA1d545332ddc3b23e255422fd376861f590caf6550
SHA25627db4f0b12d49df306f15b7b44f5119b5857f95cc5a8608a230735f464814b82
SHA51262e6cb910c2ce4e7a2d30eeb995602bbee214749097a1c87cc4d43a619ecffdc5936efc9807622b51dcdb7fd6ce09197d06653697a3cd5565ff32591e3c2111c
-
Filesize
720KB
MD5e6a9738c4b5b59292e8e32ea4c06a411
SHA1ac62a8bbb4f36ce0aa616f2d2dc1080806dc2597
SHA25695106e6d5e94d8b271bb8904964e268f7e3d5811002df27e44484fbfdc14c082
SHA512527bee67f0f3c9831c71083db9691bdb53eb4ec0aa534752d355a7ff226e8cdfe52de6998ac8c6314946e8f1116b785357ec5fcd31c28709ccce0a12da5b93dd
-
Filesize
841KB
MD55aba33a9768c29dc05554b86409737fd
SHA1cf180479f5cc4a46055f509379990aca01061462
SHA2568e32fc28403e86981486cf6d2800fda114ff6217397d6ade94648613f6b69c2c
SHA5127097c869ec7852ab9c9adbd27b582321fe1570cef6954d72bb6764ebbf9ded55fde3f3f745d330ed19a16300e35494566a5348ece9e7ae71ed403431d3dc85fc
-
Filesize
950KB
MD57e9c5fd94b9ef6ae18c507af4018d46f
SHA1e0fd8a269cbe3dce1922b307328640b52d892d46
SHA256804199fb494a58e72d6a1f25ef69d755d322d80e5f56eea749bc03e2ef94216f
SHA512a93c74362ab177575aaaa7b127ab3e3022c40ab0206dfed0e6551fb09d9461670d69acde0744a873a40253bb0410468c328a23c6d4ed0701475758ec0bfb5c7b
-
Filesize
944KB
MD5e445070186c6c5318bb8152b3833f1db
SHA1d988c4afee2446abecc448cbe9b8a7623c8d5609
SHA2562231b9596f1a83d3df545c7add365f36c2b53806207a8c11cf333a5d1ee37801
SHA512c53eefded315e690a59385d6bad1dd449c84858ed52e261f17792bb6a80c2e676d4e913c90f5551a656cf792aca87e65c756989722a0e21264cd444bfa9985a6
-
Filesize
1.0MB
MD54ba439a334920ca19631d48242319442
SHA152d1003a9653e7445cbf7d313a6c36522fc5778e
SHA2569d92d928ad02573f1045810ecd1fcc35966a3d447f64eec9f5b41d1f4b9a0a65
SHA5127370ccc2d00e6977a3e266e0be1126ef55449e7c30fc95cb34e2b6f6816a5f5f5ffe25e0771c4df6a9b5b96b0db2ed58e92a234a3612b3dcba9d6eeb7d7c2d91
-
Filesize
920KB
MD5a2abf3ce91e8c2d228bf321a24999a64
SHA1b1027c02a5823ae9825a4c482b90f92819e09767
SHA2568a372c7bba180befc60c8b6dbd0b0a8bf36c330b5d691f24c40f7acbe307aff6
SHA51215bf26622eaa263d534f161959b6f9ccc562711ce1ed80d65cb5d26115502099e46116e4300605afe7f0dbb92443d3504da42b51502f317f217f62870f7be8c3
-
Filesize
916KB
MD5d3dbf85385c6d4998b55b8ecd529a731
SHA10a75babb537e96a2f472348fd4cc4004f3ce3844
SHA25635b389116b84cf20685a8f856b8db9379a4455d171c69c984ba06a72f31cba54
SHA5128832691a30c7250d9ab77507825cdd1d2216f2131084bad80182fa4660ec0f19c1b240b106adf5f67839e0e7e64904c69fe8c505965d7d3f8a02a19723f6549a
-
Filesize
274KB
MD5a5e67738d6667628776d49d17bda075e
SHA1f135dbac4cfd7cc776e0d2fe2d293b9c2b9dc49d
SHA25684ef6ecd2df2de58f237e4808a4f7c7577a8825d7b4eea262eab89b9defeb63f
SHA51229231b09869b7fa4648332cf7cb4abef3d965764bf6185947e8fe1a1d90354248d5b54d1742efc1613baf86ff5ac633db424bd142cc9cfa4d0b13bfb96df7e76
-
Filesize
344KB
MD5ed4a0e9c5698e1a9a066c9147e06f5cf
SHA17d1fa6955ceb6eb83b31f740fc5774fe500e3074
SHA25671b774d5bb40e50327a37c615a3b58b3e71d1de2eb3da1bcb7a6d3697e309ef7
SHA5122e2e8d1cea14a8433922cc15e03ee9335af58ad2ccf0af60a70a25fe64d4594a41cdedb1deed4b42b145728c00785a143e5e3092dc0eefe7e47e836a83d10396
-
Filesize
415KB
MD56056e5b743188de19dcc782db50e75c5
SHA12630e9631dbe5f082f725fc6d4c1b8d708aff180
SHA25696ada5c4e90b7ae9d61769bf4ce466694b549b7051b4e6c6d38d6189e52e6d55
SHA512486b3232fd31022d6c151aa3fdf32850476b0e9e10ddb5176875a1ebe5181439ff01555b54723b036c5700e5f0e1e006f638cf815bc46d232f784eb95b308c66
-
Filesize
67KB
MD5a3fd232fc73f38b2c96fee0eaf7bdca5
SHA109637c4b2cd5dfbd81403e52d1c75ba8d15b4269
SHA256bb1b20f550030c08f280eb70026ec72aabe48ddfd750c20a9b44490d22e7bba0
SHA5124eb45c88e6128084e7ec453adecb4f3c89fe521f5f0948ebad9686ce3990cd01ab30acbc9503f1edd3767adc64d6fe37345365e6ca62b906ec783c32e0a2ac93
-
Filesize
496KB
MD54f903467af569a883f821621148b8d23
SHA1de34bcea05d5b16b8c6104adad9b6c12b69ec487
SHA256ec9683577df772d80f53d95294884bba4e5a93ba649dfa394e3b6a91036102a1
SHA512812a2cae55604b46a48c300d9bdf0678c6abf7b46c11f37365d613b4470a93b8b2956f06e3cee1029adebd0d452d7b811602fa5fb87c420e7759c53dbf371436
-
Filesize
405KB
MD5f684ba8c46f2798dc0ca51a783e916d8
SHA185503e703d299d2590242a0397f8035abf661b97
SHA2563217d2dccb0176f21b49c74b6c5ae526228fbdbda31b4f55dbe541f5780b60ec
SHA51280521667d14762d0af571fb273f42a2c9d013bd999103e8eb20087b308652e62ca0cdf755f797660f0b837ca26ab22b4dba43b91760a0465be5fe393761e9078
-
Filesize
509KB
MD5198ef4f974259ab8d395fb33635a5774
SHA1e06cae1e07e7dde1eaf27581a40ff432359ece31
SHA25668b693894e3068bd740a50e3cc43a195a056fe7ff239af4fff0a1d372cd23937
SHA51247e11b85f22fa6f067e2b4841a4a0336c9d51a945ff33904e90ba50cb04afc32246c1b6368316860797daea3513a80ffd3a01aa634093a13477246cf575c56e0
-
Filesize
319KB
MD56957dadde87d59d8ebfbbb19046fbb5d
SHA166548938ac7c5c0479f4fbae333e660ec8ffd217
SHA256b51246258221b1eb2772391a8f2346cc1d0dc0565c32792a2fa232f892afa8dd
SHA5124c1b272b84b4c1ef9211171215bf16cada65cf36fe84121de3583cc779d4b4be10a0d2a50fb5bf91609bc24555caa7bcc9304030f295548b225dbd6a276e71d1
-
Filesize
251KB
MD54cf266770545a8b25647119e9eecbf50
SHA19455fb866b2a7c64f5204bb77ba74cc2f6996088
SHA2565b3c4c8d5fe72b6d127942b8a788a8963eb484bed1d0238084b00092cb773eb5
SHA512fdc4e6307564556575f16ac85be10047b51b2e50267e56a984ea9011e8e61f80695ec39e7bc15976d3c912c0a4c05a85268edcfba048a5d26cbfa49c51fdcf71
-
Filesize
398KB
MD58bbcc9b2d3ac0ed2815872a15774e40a
SHA1c78290ae09a9d73a7055211cac4b9b0b558d4e88
SHA256870d0e7632d1c4f6e09e9ade90e8621ac572a09ea6d5403f6aa531352d6237bf
SHA512d7716752db2d5a68d282cf5b14c02ce13c09ef52bc57f7d2c52f49ee6f17aebb2aa1225fab171978e538f0f2582aa629636e45c7af347250abea18f5e896461c
-
Filesize
95KB
MD557ac768d8d098aacaf8f1e421571c8f8
SHA1445c92bd66ec12a93ed154d8b24fb86029402ed6
SHA256034d8655bce0fb128053f023ddd81ad20507a06ccfafb1872fa9dc72fda77d2d
SHA51259e9062b196dad8405d4b06f16e7114d7406ab9b08669776363449f8b9f3c64ba063297a3f1a619d39843761253cdcaa09b6a6bc89e4cec5e40f04f960845663
-
Filesize
122KB
MD5959a6b94bf4719cadae93c3d1aa6d2db
SHA16f0120faabb5bfeeb4f2408c4c024b04d0c1ab2d
SHA256feffa7227f6c7bacfe5aaf3687c7d4b507ed9010df1c4b298b175e92c72e28b9
SHA512f18cc1a20a4d6447eb417ca909a1513051d1a1046b74884b5df339d08dc559a9a317000e0f71f64d5a2382103d922a0d598de8cc80b6b8fa8a6e5dade84410d8
-
Filesize
135KB
MD530e4418301e371dbe8227c9e0d160a30
SHA115d6c1cf0a166ed5de513d7f0ec6f3e9a7421d5f
SHA25698067e8409ad5b095a9bda66ed119be4312aa58fc321b0caf0e2755da8cf02dd
SHA512f14c2cc80aa4f1aeaf0df78bac495fbf5c5d0a517f60380e54ea47f58604b9fa58630a77b99d6367ef24950c2c2b8f69e7537686835bf555642802ee5040c39e
-
Filesize
122KB
MD5262929c32bd9f16abef2207b4d15f9d2
SHA117a3a8cf8ce322c8e8a65fde5a2fc885064b5f6b
SHA2565beb8190cbb0045c5eb13e9672f2268c974090f6353841ec3e6967d81fbe5aba
SHA512006fe0ad0c75469e0fe53b4ad667cc0321704045c2990cb279d7e734c99b0ceaf958e642358b20725f21eda5380a64375a9b2ec9f48f876062babe3291d55ad5
-
Filesize
92KB
MD55a64eb0f36974eaaf6228e601f59b494
SHA12b71e754100967b6587ed3957ab8d57ac77eefc7
SHA2561b485c6f6f127d7c577e28734da18030ead51b9da10dad8c264091d6728b9b4b
SHA51243b4f5111ad4807dd3d34076571b05f34487004264f0c08349f8a974fcc3e17d524a06a7931d89ea63a8548d753f17c8d54162dc405190ec49f1d038222842ee
-
Filesize
101KB
MD5ad44083726ca6aec2eb5315c120abab9
SHA1d3651295d183e59d96691f5f829bc714dc99f407
SHA256e9395832d3aa5ecd6e40d1a29f6787e7d5cb030b8da2daf6ab52adaf630c6316
SHA51214220da2b2d0049421e576ef46193cd766b373b67350b48829e397b257bf391e7a3870995f2bb680f9dc623f15b920c85155d889d26c5ab99cd06f11f855508a
-
Filesize
1.4MB
MD5f028d341508430f06333b6399a7e0010
SHA1785f0f5e71a603d6b05bcb4cdd92a58a37212195
SHA256605c7f305390491a525664beb8181438a72103458571098e879ef0af40e1e286
SHA5126ef0be7ec629a100b0deaf5cd7e24e0ccb85f41003cdbb4159bbca0972336a4a946d865374d802105850f0cad3709544b12bc33800a5332483c0e8dbf4611ff6
-
Filesize
896KB
MD5a1d5479cd9e79dd43155b9b2bf5b535a
SHA1aea03e00299c1fb69039d20faae691252abc3103
SHA256a2c1a865a7b61022d511ec1704819351ee6d7d44088efe5bbe9cceb6a6bd72da
SHA512ec61b9e274f7e09dfe99d889ad7f68b1a3ea5d0186163e03f607a1c23ae91398e8f47b684bbd9f18adad2115ca8027337ba9beac7107b7cfe6618036390cc489
-
Filesize
1.2MB
MD5062cbc81c9bcba9b7f172dea2ea47159
SHA18d08503f03f08a3958e6d46aec3494901bdde93c
SHA256ef67dffc8b98bdc1d27a91c872fa7395b9e7bfaf3e6eaab1c96c2298de4e05f3
SHA512ca869a65141f4c4cc06399e941eef707ee39257d0fd1abd57ee68d47068a4a29d87803a663c37e89e319196392217046751a1a0067b920244b4bd3776710318b
-
Filesize
1.3MB
MD50ee041efbee5b901a8fe852bf6afce96
SHA17f0e5c7b91c06db3a8b7870df4cb70d5c3b10419
SHA256cfbfa36e7014e557caca13214d65cad2055f2141483aefeb96e6c0c4b31327d0
SHA512d689d572ebb0825c5a10641c95c2b5235e98baf1e982ddf78cbe725ae6de5dd7b3379133bda4649fbe0980ea98183c8aaa99e581fa9684f4a595488695af26b2
-
Filesize
1.4MB
MD55a42346b744c28f3d752b380b84bd229
SHA12c746d783e78d70567f6fe9df0e41402b492c8a4
SHA25628a9c0fffbd342abf6700ec956412e80e5284ac76c98db9fb4e041912651d9ca
SHA51258b849ebebf0f2a5c038b4e227098bfd23bc87a87dd1d517ed3a8bd84af991a5eb2e2f913561768433300070780f65a248a99e8b84c7011f23be3459e002ec52
-
Filesize
1.3MB
MD5a097708886c072fe5eba90f8a316e1a4
SHA10379e56560de0fbd9afb33ed24626cfbdb443f73
SHA256bf0914f58ee7c25b000f82723da35e989f923bb179ab93de0cc6b3daf25de303
SHA5125c9a81f68947d1d7f4bc957f72b67b0643df2b2b4fb5a4b49d46fb5c05cbf2be8be43ab37f4493390d2975feba82b723543d638066007e2e67e80a6198c19b5b
-
Filesize
804KB
MD53ed2aeb8805f919b27894c680620c539
SHA187f918d36d62012a5c007287064a4da7b401755a
SHA25671ad10eadd253ffaf99b52fb15728dd3a6197cfdd600d9e4511d508633f550a0
SHA512e52d54c820a0b2c234c6432a52e98c50450d8f3577b13f8bda9a787603a42777caba771dd1137fb61e52f15958331c122ca3663afb18ec545538b22c7142b01a