Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
03/04/2024, 10:33
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-03_f20e6b22d8e4d9df82aceec26a12aa5f_ryuk.exe
Resource
win7-20240221-en
General
-
Target
2024-04-03_f20e6b22d8e4d9df82aceec26a12aa5f_ryuk.exe
-
Size
1.8MB
-
MD5
f20e6b22d8e4d9df82aceec26a12aa5f
-
SHA1
5314aae0a4db009eeee53b76c5817e21a65777b2
-
SHA256
e8120cca3243174642aa8c527b2377553aed137547288cfb8079f1ed540b6b59
-
SHA512
4536123e2b8a7c2f9b29626bed7cd0b90f72a4d51256dbd3ae248656b24a5bc140b97ad5a2fad522cdcc13443cbec7a9fbc219fa603a4ab0d9e8ea3cb4fb418d
-
SSDEEP
49152:RKfuPS3ELNjV7IZxEfOfOgwf0FgDUYmvFur31yAipQCtXxc0H:Sm9sZxwgkU7dG1yfpVBlH
Malware Config
Signatures
-
Detects executables containing bas64 encoded gzip files 1 IoCs
resource yara_rule behavioral2/memory/3444-1-0x0000000140000000-0x00000001401DF000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File -
Executes dropped EXE 7 IoCs
pid Process 3000 alg.exe 1456 DiagnosticsHub.StandardCollector.Service.exe 4564 fxssvc.exe 3852 elevation_service.exe 3648 elevation_service.exe 3956 maintenanceservice.exe 1336 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 11 IoCs
description ioc Process File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-04-03_f20e6b22d8e4d9df82aceec26a12aa5f_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-04-03_f20e6b22d8e4d9df82aceec26a12aa5f_ryuk.exe File opened for modification C:\Windows\System32\alg.exe 2024-04-03_f20e6b22d8e4d9df82aceec26a12aa5f_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-04-03_f20e6b22d8e4d9df82aceec26a12aa5f_ryuk.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\89c6569eb3e2edcd.bin alg.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-04-03_f20e6b22d8e4d9df82aceec26a12aa5f_ryuk.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7z.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_156609\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe alg.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1456 DiagnosticsHub.StandardCollector.Service.exe 1456 DiagnosticsHub.StandardCollector.Service.exe 1456 DiagnosticsHub.StandardCollector.Service.exe 1456 DiagnosticsHub.StandardCollector.Service.exe 1456 DiagnosticsHub.StandardCollector.Service.exe 1456 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 656 Process not Found 656 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3444 2024-04-03_f20e6b22d8e4d9df82aceec26a12aa5f_ryuk.exe Token: SeAuditPrivilege 4564 fxssvc.exe Token: SeDebugPrivilege 3000 alg.exe Token: SeDebugPrivilege 3000 alg.exe Token: SeDebugPrivilege 3000 alg.exe Token: SeDebugPrivilege 1456 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_f20e6b22d8e4d9df82aceec26a12aa5f_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-03_f20e6b22d8e4d9df82aceec26a12aa5f_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3444
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3000
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1456
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:1640
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4564
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3852
-
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3648
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:3956
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:1336
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4000 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:81⤵PID:3808
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD5b3fa794b7bedd44a284ef5241550c1d9
SHA1a5a4d04d3a5c5c78a79f64cb42a06cbed1b71d7d
SHA256ff8c4f9b3bb920c7e25129848c69c8cec38dbb2ebd980a53fc2a663906d30932
SHA5124bd83b74f7c8c68c15cbb005120a7b18857ea8552c6da49332228da4dcf11bc7c06c32d2500ad3681baa3869aae468f84888b5fcf60961592775ff4aa2a7b11b
-
Filesize
781KB
MD5b1a5d9b66d9b2a725c08d0377a7dec75
SHA1c9cfb76fb741922dbec67e57051c692c894ca071
SHA25627b0f3f18903000c976a1b63e1be730269a4f7670b3cb90e7f7f2a37b27ab4b7
SHA512c96a73495590ada5bfe09abd895a95f7c77bfb79233e22584cbc5a9b53c0670f9465ae9cf4843a945a3499eaabb605f72aa53558215dfad5f1dc36484f95b6f2
-
Filesize
1.1MB
MD58cb857fdcfce18c385825822bda91234
SHA1f4e4020dfbe92000e43a44874f4f906e8a3884e4
SHA256785b5e87b597961460597a19c2e30589fa17fc10fd71be4ba8e6bb90a95be726
SHA512d7c6ea5236a6af8401f757ac11f310d0feac21ce224c64bded57f1003dcf114b99b1ea3b66ea50a415df191a0a3025163b6786506c21038c43e55f652790c9c9
-
Filesize
1.5MB
MD5363f478d87779254fa9d03a0afc42277
SHA198f489b0f05232972714f4c7ebbb5c2dae755ef1
SHA256b818755d82ddb02f0fb766e011ea010002b7da3bf25b24e4ee527fd106028b00
SHA512e875826d2f132ba6ffec31f3bf5a35c40f17c3665f764ad338017023256fbf4eeb15df11a0bd014e7ff7cae7d7a09b61b2537b7fa61843fd9a76e6b69f410ea4
-
Filesize
1.2MB
MD56e14119fdf0e2591f3d20b661783d579
SHA11577a7f74bd291a72c3c30c4bdda58429910618d
SHA25621ebce764e1056f1f769af24d5de581b95393bb9b02af0ef65b4948de540b33f
SHA512ddfa3c2db2780f3fd53b8e6f2fced99a83ed032c44f85a62a0f27236902ac1f823d3a4e23675e833753dcf928041c1973372e12d1f9a9a64d325e540f37da8d0
-
Filesize
582KB
MD58b68a4ff0eb8fdaa5eacb84e24cc4ee8
SHA15f4543f8891d4e3351321dbe4720c7e4e280ce29
SHA25625ee8d1beaec40e4c12f7f6ce2750bc2d52bcb42faca3c979d4d9818c168315c
SHA512932bf826580a84cb273567beb089850c053692c25f5d6f16d8899adfbeec16a0442101f4722ca6cab7ee029eaa10e02a48b59c0d74be65c79d4c3f910f849dae
-
Filesize
840KB
MD52af6be2c355304712694136f35d88e6f
SHA16cdcc6fdab1625abfaf5d6c12f0f57aebd880f9c
SHA2565acea7ee410596d3e1036b0ff6b17625587a8bd2a4fe6263e60b5edeaa0f9262
SHA512b1211ceb1f3c7d8069d92b62a0487a30dad01e0a6ea277fefa697d967cab809f1d2102937b6372d474fb4020df6f3471f69390cd990a688b448eaa9e7900015e
-
Filesize
4.6MB
MD5f6e26f147d618809f3e287f38f4198f7
SHA122147b4a1bd84e36ad94a16e98a9640ce854cc03
SHA2563b0fdde22a5841a28e09a92539dbb431a416339f70217f1bc807be6d88a160d6
SHA512f109b61943ddd8f71f8c8045d75d2951bd0e915ef55b21cd34c1f47e44d3692c83adb738b5a80b0219356c2d7ff7e1cfbc0e706ed1f369d965800016eaede02f
-
Filesize
910KB
MD56a9483254cb918f37848022543f49fb1
SHA17f56cad92ef9c5992f6e038db8c6fe289b000266
SHA2563dfa3780050663f3cf4f14cc4340bb33b838590e77e724fb41f0b4e0e20dee53
SHA512b3c9294982e6322a15011da5b19cb5fc8b97b7f64b51e02deaf09288a79fd67d4fce208ad09f2208bba5c1b52ff9f49c33bb6b992af126df8e6265ee6d5437cc
-
Filesize
24.0MB
MD58237b1bc78fa37a90b3f6086da165284
SHA12657928fa795be10d8238dbf6fc81eaaeed3222b
SHA256aac0fe822f01257b41fe8a5c81ebf881b43e11f993c94a61a4d93974e6c50d52
SHA512750135e6b0e3bbdc62ae97fc31eb543b6601349d6602cc874b2f7027f155a4373e24dd9a03ac3c228269eb267b40535bdb401ff25975acaed9b1478e181438bb
-
Filesize
2.7MB
MD5888a03618ede4b28714588ee23467168
SHA19093cd2cee6e3f25c6cb30b23554a79cf358ea1c
SHA256d1d84b97af5bc47ab45dc507f01f4ad8842f6cb7659d6e5b94e9c2d2467e70a5
SHA512a6458b51a25fb2f794555c267e0f83d699c270cdd207b4f1750f629b87adcd381e053de7771bcfd17b9a70ed49f57ce824b0e4ce67837b3ed10f1abbf1098e41
-
Filesize
1.1MB
MD58c1fcf9297a34f102c3e0cfa08f6495c
SHA14d4c84660f7d2a7e706685822b70d3418774f43d
SHA256865b4d28dd3cc8927529f4d8052ca45f4c508514a029638c2e79beb54e7c4769
SHA5121d20ad8aab08f480978665760bfed95c5dc985dac42179c7e168e984706e54f56889d7cb57b9e7beb0e84d6e4940c162239dc715e71d8c48edd7c13ae7c9222b
-
Filesize
805KB
MD5395cca469e3d27e98394147ba75df2f5
SHA1cb1c0ac94da4905a77c101a5d8e62326134361fc
SHA25666a41b7608065e974a5e739b9a17e5f0b26585f800aa872d8e308bb262cd2fc0
SHA51218165ee4c7a42b7244b97f0a3e2d563cd158c092e5028a3895df4c4b1bf360dbca14244bf3c5ba1c7b7c94721bc63e22cb6e8e36c4de1b8a8ae57aa1eeae906d
-
Filesize
656KB
MD517f20e64a4c7c3c09d88405a333098c1
SHA1e63f0b8a2f0389154188b251cc76bcf503a31f5c
SHA25655eeb2c068f1e67c6b8797b0e16e1afbc36fd353494b5948e22d9881b7aa9b79
SHA51250fa79e451614c81052a1330e407b64e9d484cedddbe80c04114e6a4455bda25348cf305f636d76f5edac32f93d0e7bb6b66b3ae64a715636447b8516872b2ff
-
Filesize
4.8MB
MD5d3a93856d0b7ab0d9d97ff23aa764a38
SHA17c9d2092d9eda2765ad7fa4ede2525694b5b4dcd
SHA2565b7e99b2aca5de273759f3be60ffc79222109cda62d2a44a64646c02da8a3770
SHA512baeb5767b8e318158c2bd362889e596837f1a92361807ebc8f664b81fa3db3c6fd28658aaa0d53fe5700d2d2b07c4218c3b87ea361363a49d61b0389fbd95236
-
Filesize
4.8MB
MD596d91c3ae4cffc6a55e25bc8deadc18b
SHA13a61af1ff324368a04c27ab0a3bcb5e60623ea06
SHA2562269e25d2c014d9c7961fb7ea62397843622493031a4d9ec5b4447eff2bb4c07
SHA51279eff0aa67a1f2608bf24ecdb3a3eb2c35fbb3d9d6240f70f4079de1079ee6659db70d7471d3e11fff8e91d3b0dbc778df9b24bb02fb804438ec633d3f60cf2b
-
Filesize
2.2MB
MD56059c5e30357921d0f12ad252f78e099
SHA143d3ea5c046f53acfc5f74cee45c7b37fc87a193
SHA2567639a9918d850addc8224130bf1520a4032d5e55016ce198f5d2c9d44cd11123
SHA512297012b91193482f21c5f123561764a8640b1f033658d5d92620cf9494456a1cf176b4987c46bed4a744fdd1e8c428f8b49245f13fcc9f165c96c88d46f6a8d7
-
Filesize
2.1MB
MD5bb18d0457e013160df0cc964d3da810e
SHA1a773690763997420a437ac63c0c15db38d51b220
SHA256b97a892e4d3100bc7cfc80b3f6765e18463d23d7f79ee7c4454913ed9749136a
SHA512a60e516734a0d507e7383df68bccfff3cbf8d08e30a707a991fc3627d4cd6f6af4a982275d5fcbdbf48c6c610f7602b56d566d2f5eb35db91e9f1901d17f1904
-
Filesize
1.8MB
MD53baebf5c7fc27ffecd02340e7a66b9bc
SHA1a99d025d6582b9f98ccda8252561d4d4319c880e
SHA256683e3aceddf02d3aa6eb4651f62b372d09b5991409c4a904cbe15a800928e559
SHA512000608faac2704d7924aa641c29283caff07914b1acb012db41d6a0317b0057ff212476d3f2d1e80994a2d65e25c21d201a31e15ee55b5b7d4961670c8d434d8
-
Filesize
1.5MB
MD510e36e81510f26a9c70f2e8a4b53a950
SHA1feb4a7191484bf8e4af3c7ad521d949e2d215172
SHA256939b45b064f0cd8d78b955c452d9e83c672eccf12b65b455d241a14da86e31c8
SHA512f4d4e3b632e280a12dcba66e0937907664f24179f3ccdd1aa6cff469b89d0f9688c83cd3cbff33b41a5ca06116be09f0cabfaefcf37b72e8b3359201e2467d07
-
Filesize
581KB
MD5b173388fdc38e771920f7c259c9d7a29
SHA1d60bd545c50d9df5665787ac558ea0f8e7f93aa5
SHA256113b7ceadb85c5c204896f6c9a760f820e444b3f8a4b5ce7993c1610d7c6de37
SHA512dabd7ff2eb26ea44ee6fb0e7dacac087d9458d5f35e86c09a2005dd91baf04176792bb99d44b7d22c20481b135d2c33715043ad22a61da0474837700e3826c37
-
Filesize
581KB
MD5e84842d25b7d7f9ab1dcc5dcf0ec2f14
SHA13ea18f2fc320eb015e7126e3e64231caba4035c9
SHA2564d57ca394e588fa3c77c240b984f2973bf94ffc5ae7362990d10143a4557185b
SHA512f43af7897ca59ac0455d2fac55cdc89bc655bd9775068de16e27e35f3a1824a70fedbefed9d8e23528f1f1a7280f62b302b15cb0b42b2b3414798e0825f99d17
-
Filesize
581KB
MD5b895ca231ba8d145baebf183329ce020
SHA17b3bc4a03c34f5cfb697946771c1ea9d259abddf
SHA2568e4f73ff8e11043feb1adf1c722d8aea69d40ef8366f9be3acfe7682b3f4e64e
SHA51252a663a903dad4b93cadcc31f88b21dff7c87c49fa53d18b3fc97e3e9c2efe56e899a06c85db6568a6be5644425229bb7d756f572ebb8ffdbbf6576895fa50de
-
Filesize
601KB
MD5e8d4970eb6916613b2e993eb3da3ffa0
SHA1c4b1a6c7c9dcc9ccce54359774b100d7cd049d01
SHA2560ee9de3209b2337cc80f0ba85ae11f4cf2514754b93b4525312e02452702b4ff
SHA512ccda79d45eb0404ce373fad8abd89fe43e332252383bcdaa7d18e371f4b1af99ce5ae1129b3d6475fd5fcaa7e072dfa926b83c339f91f98ae23f5d20eb0e9a63
-
Filesize
581KB
MD50322de4a8556018bf7690d75d015c8d1
SHA104f83e7721cab8c07a2d3128afe30f47692715ee
SHA2560b48bc00ffa019efa5a828d3da678db0dceeef922941cd82725a7b2566401417
SHA51254c1f588cae28111ca0e1d984555a1c78525b044859fb0caea8bb186f02e6ff9271afe57f02d27b9396c33f08908b5b205436ac8c5ade6ef6325d4a6165caeb4
-
Filesize
581KB
MD519dd5daba38e45182630982ac0aa5734
SHA1927c09cd74e532add69a5112e468f9852b7ec411
SHA2561eef913a274f3bf205827e4e50f4ec8874d91254db7b40cdd165980c6495c1d4
SHA512f44da44824a27c282d86758558afc7d4221d612a081efa106a70b3fc997a21334d3b8d6869c91b77c59f3d58dffb9b3a112c537ab07acb1ec6947cec2f7dbfd2
-
Filesize
581KB
MD55e2f017e9c50c84b48db1162487dd54d
SHA1e0c8be7066e72264d3d71651763f380f0b70155d
SHA256d76af34bcd1e5463dd4c3be02df5ec91282734bec541a34649c665968eed04be
SHA512832fa50b94d081221cbe9172fb9c75435f1918d6bc6fcf54b10183ac2882209b575c7e2dafd5d93dd89b27aea2f094bdc3a1f7f77d9b3256e4543c43162c2b83
-
Filesize
841KB
MD5aa26507d16ea5086e98137de21de7f93
SHA18c3b8cb891764ef4241b31030f0624a69255c519
SHA256c7f3d6d27b67a2d9b5e5f81151442052ed47a1a66cd3407c6081d5cb497c6430
SHA5129e80ba44c203f15b617d76140a3b576aafd6a31c1e1803aa2b1c145306a79f586f502cab9d683df01903b11c859e0fffba94332becb60e25a6039cfd47eff9d6
-
Filesize
581KB
MD5a201306e29b491e765cece37460561a9
SHA1768f0d4e1dee9bb93ac29a122788598e72a0e781
SHA256cb7aa1efc2e7403ef67509e3e488c33b60b6191c717e7987f5c746a41a801da2
SHA5128de3cf320fe68ade16f33699ebd2a42fdd9caa360f6747340558208eb950699674529aa489ba7d4c8a35e9b970f022c96a6f5d99b17528ed4cc99b6069dbca01
-
Filesize
581KB
MD50fbb509867f8f6237c8646c5c13c204e
SHA103a917bca0935f165d32c2d2a61b0b3b4b26e6ec
SHA2566b03227f1d357fa9aa0f8a0943ac7737c898075952cf5f623ed7454e8ed3e72f
SHA512d82e56f90b52102043a6261743f335d9a375496e6c6e6c9c9233a4e34b5f829b41b33dce7a6de9f3cdad7b49efbf6eb70de5ed59fe0b796f8a0bc508a9f81a8e
-
Filesize
717KB
MD508a6cb04f0bb51e54419802668dee738
SHA11d9da47f2547099087891af31037f0f32db6f937
SHA2568bfaa294fc97cc2d359e62d61a582cf7a3b7ee90215f0764bf05b30f03e24a04
SHA512ec8acd584738ee5e5cfe940182ede0b8c7c31e83a5e2a05b60a971e85d4d4690a511867dd467828c9011e268f4f2e4db9ea2e6d5260b733d66c9dc1daee24f76
-
Filesize
581KB
MD5d086f6ee69fb6ad336fb7924fa615c11
SHA13dae5c1ceda565ba93e06d1a94c72a4fd1a92332
SHA2563375dfe146d4105b0f9b1f0d88406da9cdecb600537f309f36b5d0df28d34ff0
SHA51275c6a79a4958f09f199e7edb875ef5e3c21d5cbd88c905d5c7ec8e5b20d5c35684e369c6aa4fbeb65e8f3ce0fe668a2e49ea49710191175c984466d81ef34d97
-
Filesize
581KB
MD5f2d19389b08ff935f8aaebd093f525e5
SHA152680c47379b6e6610b732458b759f80b7e71256
SHA256a612485043f8991a639dad3f08438431a3c9d709199aa334d3042b8a94e90acb
SHA51256579fabcc4bd1f21089628f1ed239ba8adb226777a1c75d6b3b4ebf07b688bd74a867cc0fe940b26a7d43f62c0db33e55a7c1dbdf868de5f816d354118e74ca
-
Filesize
717KB
MD5da88c68be7bd5c160bcfc45af94ea4a0
SHA1f7251d2994615e76d281427fa4a5986c5680905e
SHA25613227c84bf3cd89cd2c983ee5d2be9729bf6f34aabe57eaf2d0a2c27c2e451f4
SHA512e0176929bc2e85f1617ddb8482605ce453547771b90285ebea5c9256faa8b7e9bec6415eea46b9081e3474de4db46a69d459d8d4a4f565f12e212b813e960cd8
-
Filesize
841KB
MD513510415705de64c85b9fcd337072b63
SHA1f62151f53c3457db733a49d6b1cae30228810a4e
SHA25651e0492fdd58254df48517ae6193e50c6cccad7a454abc3afad8634ca72e633e
SHA5127b9b434efe52a4384ff04d5b0c12ca5074b6422a864e9415f5f876cf422ea8d66a50ed854f38c07e9d2964df4cd65515b0237986802c4f5e98486b6d9dbf5910
-
Filesize
1020KB
MD5d4a334add481a6e21d0bb17f238de43a
SHA1bd1cbaafccddcb3412acbff2c5eeaa7855bd74cc
SHA256da8f3c19a7f812ee4b1e25f603a65c04374b5d6c3fa2e9030d19c4a535d32dbb
SHA512f72e11eada3db7e5e5d1ab15deff2645250a8b29795b31d2e60696750a5cfdf93ed4245988d5df873dcdd07ee70075c59d6ddbc8db4205f6e01c3a6d8ed08067
-
Filesize
581KB
MD57e79a33a72d9d43e519e1276326b9c60
SHA1f45f7407636cc526125dda70d4adb8cc66a05568
SHA25614a589064e90dc98e44b60e89e26c90021c2375c538b6ccd42e38349bd516e1f
SHA512a189b8001e41509d2c3ea280656ef0980ca93639d826cd36951e2a0f83b02aa955228e9487fcedd489f7c0fdb1e29b05d5186dacffa99720ad785886128b6fdc
-
Filesize
581KB
MD5738cb659b4a90c610b560136762fb3ab
SHA1186cae8472917802c364c1ca5aea7a44cdd95e19
SHA2568d05f4455e767d23299425487968969cf831a223ddaa788ce5de677c8afa59bf
SHA512704b82c2b9885e7d28f436d8f2bba3807e95827878642f0fcfcda1fb3448f89917a186e24a53cb05b891c2c3b869083d8e78846f9dcd7b3de38ff81338c32d02
-
Filesize
581KB
MD5a2c627c7a9326aff35fb845191d7e1dd
SHA1a09e7bf61212bf35714d675fe5e4155a63de5df6
SHA256c8fd3bd32cba9abe0af7b0f458412133fcb05572b726c29984001bf81b5ac483
SHA512364bbd4f55d3030a2587977f3e71186ea581be4aa3992b5a9f99e74ac0cb6a6fa9a3d1466a70f9ff32a0aae36633690cb596db2e319a2b5206419657333c7194
-
Filesize
581KB
MD58178e4b2f4c2d68438c251acfd6cc6c2
SHA13e76f00e867665941ea3ca2881ed154fc0a5838b
SHA256e0db0a4c6393c65f61d682f2c2fe14d79b5159bcea7898587d9e6e38f0329735
SHA5129d089666539ba5d5ea4eb9b0a3313f991215c0d30681fefe675ba4ef9f17b99b4bf3a45faf399904e2f86744c3f9d757ddc3cbe38c065e9e56fe264f482d71b3
-
Filesize
581KB
MD59db82364f4e6515ba70871bd0ad9492c
SHA1352566862b36413b95f853226bd4c038c7f3b50d
SHA256c0547dfb2b587a78822a218e41ef149a65e6bcd4574d32412979255c1d41f43f
SHA51262ba983a77b6666d69f7924b88e459c88203a71019f56488df2c52e5b4c6ae6bb8d29ea3fb2fe56e3e699655c1b51c2225d12b1373c9d28ae6723721b0518788
-
Filesize
581KB
MD590569ea80356b93f788362330d21304b
SHA10adaf5a2771aead5e6e46aa316533cae6991f17f
SHA2567c030c50366202627399e1f98f07f1430f8f8a634af10703a1c13157d8cdaa12
SHA5125474711629d1ce6355e4315068287c5ccc6ceeec34725c4145721ffcf1557a5ef5f213592c3c549dd6e3357c71658524bd74b1562d2e33950384bc9a11b2c2f7
-
Filesize
581KB
MD58a6db8f78fe1ee7ee17cb8908664883f
SHA1528c49b846a03760571f882a520f7bcfa813a160
SHA2561cde7522efd01e72206eb7f9f48cd6ee97f25ed8de0c016b1fc3e57b2f29240c
SHA5123b0857674d8d27499942cc10d9331dff1221b34a681ade9a37ef38f523853a3149afe57e298667e78a5787d386d73c7873819bce152ffbae24f9139e7a477859
-
Filesize
581KB
MD51eba58eb7e4090902f440941453091e4
SHA14219998ba3ed73b0df263fcd532296c8df4487d3
SHA25665602cf6e748530632dc3f83c4f95007253ef0ac280af63e789fcbfe3373f893
SHA512c27b0f08b0c56be9dcb1cbae986d096aa1df4e7670b938f2860540665e9d99be360d860e60229b8d85852f12f95a8685997bece03888d0413c061844ed60e307
-
Filesize
581KB
MD59ad0890ae573362224c34110ca73c1e3
SHA153a13d24140c350df90143214298bcb4eeb68722
SHA256ca52bf1b54d4cae98a001bcdf5bb3e8499a825a20c014c52e4375263cc4a46ee
SHA512d4586a15f4e35a46b15bd3bce4c42e4675439af449cf041da529574fdda58b3da5c5988094e1a2cf3c3ac7a5a3bd2a81f78c45d9e60b9522c4c598720a1f13c0
-
Filesize
581KB
MD5faad352268c6342ac27e8fdcb0c2ad1d
SHA16a40c424ded66cb5cf80bbc66c8e60390f53a363
SHA256a82a923dc96205985e52a779b1e11ddb6582c8fa49e49e8c1fcb7d480c6db6b9
SHA512300540d2a187fa12b5e3c7b4fcfce603e98e36c8d5de0c94be91e13815dda09d06a13993aa99085a1affd265b49cea5d27a699d93a8852ace20da548dcb158c7
-
Filesize
581KB
MD590b1efaf46cd92da5b76e2de21756582
SHA1e070dc05150d1644014652be174e8cbd6b19f9ba
SHA256362abd6294e974f8cb713ead92f60fef432494fba9b0f5c438ea5c7c77ce7721
SHA5121fa180b585310f7177d0e64bd913ba7cee69ed46d52f32b7f9ec47f5f49018cd39e78ab931b1f97242eca1e0bbf53d661be902700416468f1212428a6083ad93
-
Filesize
581KB
MD53de95e766439405af7b1ca9f7ea2e53e
SHA191da050e94da66fb691a2a47989011608eb7530d
SHA256b4d8e4dd320ca1c58c8d4cecf97731ca0e0db4799c4fbc74484856da626080cd
SHA5124b59feed117112026ed26f3fdecbb2498256a454cf33ab92ad100aabf8377b4c838d52754d7df9a12ee4e48048ec9f836a5eb5fd3ebac18f0e65ec6d06ade390
-
Filesize
581KB
MD5422d851b2d83f4b3e3074e794fb6da70
SHA1bf6638adc15acf3a3c2da8dfa423e93caa34fff0
SHA256b6baf9311806da87b4fe2a0fd71f8cc687294ba372ac9489c0acd32e3016b4b4
SHA512948ae2216fe3400e9de8ba3baed9aff792a11b1dc8c90aa83c24518eeee15cbd7923adde8a8ff0b9e6b9d154ed339ef25438c859ceabaed8f911fdc93e993a42
-
Filesize
581KB
MD5aa5d3f13f9ce97ab25261559540deca4
SHA14561ffa961bda95fa4b58c2613d8c4a97a0e2d7e
SHA256aca80019879f8ca8edd92d9b5e5575688880eee8ea6693699430521d24c20e73
SHA512fde7d0b0ec8bec193e6b3cabe108da9d36c2139598bcf95da81c187a1a0dab35991e32f1a63a6888712bc7577d3afe02f8ce5c051435053cad8ab66d37a19840
-
Filesize
581KB
MD54f59c94b5a218dda6ff5dbb358162717
SHA1cbf0cd03dba2cfed5d092bd337282c686dbbfba3
SHA25684ead607a4111f39ae0e1fc989c96fcf81b438392f2fc348f9edcf3450266329
SHA512684e82e83e32dfd9c686ba8a01ff6eb533d3ca06f7b7b70596277a5d470875b23b4e40fa13f832bb4f67c9f409dc202c60a772d0b189650d0dd2d5949a835b69
-
Filesize
581KB
MD5b452796e688b4c13fb5dab97e707ea38
SHA1e5f7880413d2fd99923defbef83b0fc0a4e39e6e
SHA25656f22fbcb580827d274f55e2f53f7455fa8d9a881e69aeb0dea1f6fcd277fde9
SHA5125e67601c994745020123cf74a6c5b4f121a33abd85c8474ff47f12c2ce3e9822f06485f1bd3412a55e5d3e3d035514718f20494ec154dacf09be8b78be0fd1da
-
Filesize
581KB
MD5e689cc73075ae1f3686a590cfc964c15
SHA1699d80e6599eee3938ade9648ce6287c1a8d5344
SHA2566eea3ebd6d486f69727f34003ffe72b2a28edf5ff0c1e0cb87c1f18dcd5c4b46
SHA5123c3cc7d2c0d317af6b62c5d1246afd442604d107b05b6378c6c25abc6df40c2ff784afb15df68f6a8f163a14e51542760171315d46fa1283ca60e90c2d9abab1
-
Filesize
581KB
MD571e8fd31ee2db4fa78a0734f837d0ed9
SHA12d3586b27429c3e53d70f51e372a93ee64ca1b78
SHA25647171e1a8be2f407ad1b0c057e73f128db2e55d49a383c17faa451989e8b278d
SHA5129ec67cf11fbf8c9009427f22219f24bdfee0b9cba4b3c47d0996b56d72915167d8fee571553a2a3036293cefd36165fe6f9ac5f01e728771867c82d8f82d3e6f
-
Filesize
581KB
MD5ba62e370a3e4a707dcb967c92ee7e4cf
SHA10825f0aca9a78575342081d1f52c4524f2f59897
SHA2564221c3d386a3ec36cceea4e6c879709d9411eae35769d85d96ec2c609458363f
SHA51260d6c3c7d9b2a0276eeb66b13a55b93f7024e43efba920844aeff0f93b5b182a0e1eb211d82d562d9dcbf038bae4745f4a8ccfdc9fe1679d35c0341bd10bd700
-
Filesize
581KB
MD51ba9103dbdd9b765c679b5b02f995330
SHA12d46692d9db884fb7b55348fea94c2db1c4c03ea
SHA256b7c222682175103e96772c96d229e364510676201757cd1ac3ad7fedd8da2432
SHA5124a67d0c2ccedcbcb6ff423fe9f4082fed31620845f81817ef2f9df032100373dffc780a650b48908d0c97f5c109fb41782ed39615c8ddd44f89c17e1aa2b40b3
-
Filesize
696KB
MD5cb9c81664c9da716fac3c486d524b08f
SHA1b9cc6a2103b4a771078677367053a0e2ef6d8d8e
SHA256eb60a5367ecda78ea97dfe3b6fa0fa61afbeeccb2a8aa6e601d0c9a01f2b2c3a
SHA51293254b39118175c7eb8c8d880a36a22caded31f7151ab6d26fab53c7375a6e8ee62b0e49be0507a14ed9b1bce17e3345f8cdd4547372874112ff0bba90b7992d
-
Filesize
659KB
MD59382392db3018a1ff04586be22384072
SHA12fc7446a2f3561f9d56d03d2610dac6fcb1305aa
SHA2568a9bebbe5c2e6f8461c6e2acbb904ea98cc9ff46311e295ed1b60146614059d0
SHA512539c9d221d2774e47187545049f51315d559fbfc8f4f7c28bc9aa7132010f8a54347485ee33b00caa657dc8086ca3df62ed599a2af97b81741a6031f431f1a0c
-
Filesize
1.2MB
MD54d4c0ef316b0a44ab469ea2be8dbc130
SHA1062a66adec7a0bc28be042e8479a00e12552c1c5
SHA2560b886400d1dc7fbd4b2299dcc23608e54df3170c561b256eaa6ef5a794c858d6
SHA512bf7b2d9c083aa8736e22c2e15aca6c051776ffd3cbd224d2a1c09672cacf09c599b6c68e5a073bb9623d1eab71c9c80e81c559a48057c5e32646688e7be846dd
-
Filesize
661KB
MD5ac29a735ff99500e56fdd8362644b877
SHA17ea435383acc50eae1be0ce22a836d7e7030bb0c
SHA2568b1b1c99c60b3dd71554b374430cc4cecb593b489927c9127080ebc6a877d20c
SHA5126b8120a647f6523eda0c52df8fe9df631294fc2aab163fb10ad313a99c57bb2ae1ce1fa1f63317be7f2644bab30249f70e84978437c7db54f5c128b826119d91
-
Filesize
1.3MB
MD57c55017c8daf5bebcc5d1c6c93e438c6
SHA176c33848b498d97fd4ba5061877527914c16766c
SHA256c329e1784600e83824d8bb454c90483db9516aa43220fc7cd9b53a74fd5dc562
SHA5129c7356d1e8a826888523649ed2a6d1d9c4dcf5994ed3d50ae5bb6ef364dbf41fc8accda2cb0efa4d654ac024cef9abd0847450ffc1610af7df1539675115088f
-
Filesize
5.6MB
MD5eed423a27a6024a09c474aef0d5382f5
SHA1cdd743c1d90a1dac3072d638bc8b38ff32697f60
SHA256a082bb99594e7400fd67124066114f38da2c8773797205dab698212cd26bbffb
SHA5122291b516ca65321b56ae48ea555d1873c9dd2cb42d71d18ca1f86e2d2298f97af1843cb9b37d28cdee3ea390cb630faab1d89907e88e74e744879eda46a4167d