Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
30-04-2024 15:34
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-30_b54c6004d018138b2c5e097c20bd21bd_ryuk.exe
Resource
win7-20231129-en
General
-
Target
2024-04-30_b54c6004d018138b2c5e097c20bd21bd_ryuk.exe
-
Size
2.2MB
-
MD5
b54c6004d018138b2c5e097c20bd21bd
-
SHA1
ca36bd5f31d6aeb2f07f880415abb4ed8e55dd2a
-
SHA256
5d483469af09609dd4f69ad488f783685d6dfd8966db9659e0e3d6de635465d0
-
SHA512
ba698cbb8835d0ca141d5ee7ee5291e371b0d5d87149cff2b389f46b2a9b7c4917bf94cc51769d50fc4024e9c11d69738251b1ec3b4178bbc85cc1a02a84668e
-
SSDEEP
49152:nOOh3aN4kuLbegmtGk8HNUPCAaq8Wdo0:/U4ku/ctx8t4C7
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 2496 alg.exe 700 DiagnosticsHub.StandardCollector.Service.exe 5036 fxssvc.exe 3652 elevation_service.exe 4448 elevation_service.exe 4468 maintenanceservice.exe 1548 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 11 IoCs
description ioc Process File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-04-30_b54c6004d018138b2c5e097c20bd21bd_ryuk.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\c2eaeeef85ca13a2.bin alg.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-04-30_b54c6004d018138b2c5e097c20bd21bd_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-04-30_b54c6004d018138b2c5e097c20bd21bd_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-04-30_b54c6004d018138b2c5e097c20bd21bd_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-04-30_b54c6004d018138b2c5e097c20bd21bd_ryuk.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateComRegisterShell64.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_98656\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateOnDemand.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.106\Installer\chrmstp.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE DiagnosticsHub.StandardCollector.Service.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 700 DiagnosticsHub.StandardCollector.Service.exe 700 DiagnosticsHub.StandardCollector.Service.exe 700 DiagnosticsHub.StandardCollector.Service.exe 700 DiagnosticsHub.StandardCollector.Service.exe 700 DiagnosticsHub.StandardCollector.Service.exe 700 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 660 Process not Found 660 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4296 2024-04-30_b54c6004d018138b2c5e097c20bd21bd_ryuk.exe Token: SeAuditPrivilege 5036 fxssvc.exe Token: SeDebugPrivilege 2496 alg.exe Token: SeDebugPrivilege 2496 alg.exe Token: SeDebugPrivilege 2496 alg.exe Token: SeDebugPrivilege 700 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-30_b54c6004d018138b2c5e097c20bd21bd_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-30_b54c6004d018138b2c5e097c20bd21bd_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4296
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2496
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:700
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:2584
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5036
-
C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3652
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4448
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4468
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:1548
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD58046c14441174ab75135c01cdd695047
SHA1be901eeac9c66ae4cf36f86a0d231c80e6467acd
SHA2565ed160778ed429475c8c267337879ec6b8acbbc3b0cdefd8d53d718e6d400b6b
SHA51282fcd639b38452f3556800ad6e3e4692b71c03637bf5183e67b2dd4e85b7b6f30c0eb158e69914f4279f4a0b96779f51ebd007a0e69de239bb0a794f3d79ce3f
-
Filesize
789KB
MD5ae553c2c927245b13aff4ac8d2f5d94f
SHA1c91d02369bda9813781a464adf94ff3862e41085
SHA2569a5e5da98c42534ac1c372960b2b1a51bb730c215754fe6dba1b3662b4b39f93
SHA512b1f714cfe28d4f5397ee1835290671da4b29a881ddefb70d9794952e14491a2fc45470eb28a750d02d067262fc466163855eef211df5aae1868bd72659e70017
-
Filesize
1.1MB
MD539611887ac2601d255ab53ea937a119d
SHA1965bf1b293c72a5b3e64d96e74f4b2e9edf97d49
SHA25613e1a1de3afe053df81ed9420b5679f7ab55a0eaf0a9b6117c2801a660935582
SHA5121dfce7900ec876cd663b0170abff27ea2a674f5b175904bae5a142003d6b160d2cf106a7b141e9720801c3101477cd9c37dce5684df6900eeda128931b7d49fc
-
Filesize
1.5MB
MD564d6a82482c57fa4fe18b31381bce113
SHA161cf9a293518a814db3ea60012cdc90101a0f369
SHA25656668be9875d3d340b476b9e385ff1176a117951ff07363102b0cecb9c38ccd3
SHA512b45c36836e7e47349a035df8104812abeb7c54f917cf712ad22bf067d6ec69e1a6e84edd780344f63f49de9baa9895814ba653efcaf1e6a94711ce6cf008dccc
-
Filesize
1.2MB
MD5a4a7c9ce41e3743ac3a3e9ca79686ca7
SHA14bced06c1110b27e863f4c1b561d5e7883ff33f3
SHA256f50f6a6b99855628a27b17db7f9604f2c3545e0dfc9468158014e32baa5aeeab
SHA512d40a842f385278a295290c3b6c6f84ef0ba94f8917d2829245558a75cec9f40815a5cf1c88593cd30f3e3b9da3a8dc98dcfa0dcd267ce8a47220d61640ba2892
-
Filesize
582KB
MD50cf438b49ae1b6039d435f1587a77a20
SHA1de1ec8ad8c4b33380b47c72076b690cb1911f878
SHA25625ba6e87204999b9bc69c0cfb6e81bbaf47819d6b0585b7a8687da3833a67124
SHA51246bd5e11964ae7f094b3f1a5862ef8569c1abfdadb75f05f371f02e9dd500103c8eaee87a9fa2928f422884dafebfbef0a41a60da439758146f0d93d52891a16
-
Filesize
840KB
MD549a5ff23413476114a1572ef08013fff
SHA1613e8cb15d4aa55975dd79f211f206d50a125b0d
SHA256ecc0b432abbe21ef77bb0c5c8ca7acfc053ba9b1be56144dc1378ab63293daa2
SHA512d0de3c47eef37d206027e08a3ade99296d43f04a6b9b737873346fc7e2bd584f1873463141392eb200d59f848158af58072604189ca1682f4048ce272bd15d78
-
Filesize
4.6MB
MD501803cfd897c51594a44a7b5c0066f60
SHA1ccba69d878f0da31daa1a64e62ee1988dec99309
SHA2562bef444a94370e32da908f663343741749852be32c0acb480bac8e30b631bf9c
SHA512bf00d91052609df8dc16e8b16b1bc91c2cf9ab8f3fd542430c3b4b54498aac0ba036146489edf597fe9c2071fc291303cf20a18b1411cdc0f5c5204c6b41208a
-
Filesize
910KB
MD5a1bdd907d51c49d362bc8e6d518ced9b
SHA1833b5046c9e412f0ddfe64d8314ab7b52d1bcc67
SHA25653a4be909fae17ceae53c13c065f068ec6b062ae968ee4f710bc97ab6e1022f8
SHA5121c8babcf422965c6d863ff1346caa5c0cd349eaad15522c10073c906218823b9cee21d823e7803ef8423fdd35660657f800d45b64a60275484794655c30690e0
-
Filesize
24.0MB
MD5fe7c4f32014400c155bf611b05f269c6
SHA1dee94b83de86cb95fc70acf3b077bc4bc62b5acd
SHA25657650b1b955f3f6c3ffc7d6c50cc36dd606d67d66fa0f811316f08b9d6351d38
SHA5123abc50619627267100a4ff61cffcf1078da6fbbfd2267c0afa16df78886d65dc6321fc1c9bff0da298925fd3b9758c1a04ec577f308ed6de5d37f30997ab427c
-
Filesize
2.7MB
MD5b2585068df6b07c571d7db2616ca8395
SHA16a28bfb0a2251b1fe41077893bfafca486c246b8
SHA256c2f9f86e39a7f75025a02688719b1eb92a497b701b5c2c7178ff660c62369ed0
SHA51218d77f8707d8fe181fb00690a41efc1a0341d35caf29d4cf214ae3829595a85ab3ec4c731f9299a07695ddbd10b356f8a070389ec24d99523317895ded4ddad1
-
Filesize
1.1MB
MD502d7583e9f5851d38888c3159938a0bd
SHA1542bf6cdb8798552cbda87b2dc70b984fd8d2096
SHA256b748f2c704858807167ec23b74fd5b7afe847ba6595483799d5b0ad8b1b7aa88
SHA5125a41ddac3bbc7e0032011bd076a3f6f4382a4e0c5b8dff743b7b9a0412607c9b17f6cbc4702ec60f49fb9cbd4fdeb16284972e72274549c4cd80d89276129924
-
Filesize
805KB
MD5e41b905fe6a77f7dced8bc999cb7acba
SHA10b2b270d294dbc3f5bfb4d4bb3d9b74dd083d98f
SHA256f81400920b14a6d26926233e57fc6f11a56f65820b1e680a8561196b7a5d4929
SHA512965979013682b6ddfc522775d99eeaabb0ba441f7cadefd9eb30575189c29c540aa7838fe4bfb3c01bb8118ff75a87f89d8fae83495e212f7e8affa892db457e
-
Filesize
656KB
MD590a579181f017f0a0f12c736e748f510
SHA15a41e7958136894856d2cca804d906fbf13f7117
SHA256d8562ce6d5965a0d657984e41580b1da0d0d19fe68c5b923df7cf3608004f662
SHA51220e22c7497965daafac21c7a0a5e69308a4453291f5d96ca627f523a31ec8544221e6e10272d7755f40921b284726373f94694a85169401a6c485155302138f1
-
Filesize
4.6MB
MD57cb51ec3fbbbd1e88e4562de026468c9
SHA19143024754bc701d3e0f6cb0819c4feea6b4c6f7
SHA256e3601a16c4a45b695765e216655e7f6ac42bd7f24af5469b1fd3d712b3b1b5c9
SHA51295e10fe89f93282b550e5372aead650cf2d76245174d48d40641dfd326f4138924a2ebee3f062ee8d2c2fe13dde88947b967b1f6d9c0e22a75cd528c4c059e72
-
Filesize
4.6MB
MD5bd4f114f7347b002890ce7c780b77354
SHA1f49aa64203507850e71ba6fbb4875690f35ba359
SHA2569e23fa7a089f1b0cfad75ae00260b6050ef5e18a696ef79aec1b6a9b107456da
SHA512bda6ff52a395fcc218e7d100ae666607a5d4b03a086f51da728aaa33d52bf3e682c55a1618aaff6ec8de760c7237eea1153d6250a85a1c3bbee73a7f9440f5ff
-
Filesize
1.9MB
MD5924c8f157b0212c08e65d0d17e0cd091
SHA1910901c6a281ad67c7bfd11b55c03cb6091c5e07
SHA2561551a6ad2bab72711d4a10d8c06865a0f77a8be8b9950e3de5eee11c949e54cf
SHA5126491d4efe0b61d5f51c36558a1eb28c683b42715cec78fbb599e017f1d51d697541648b426396b0814235b7632d4c7320c463716033aea0c6c4f2c73cf36d535
-
Filesize
2.1MB
MD5063ce880e3bcfcfd730b829ad765506c
SHA143a214be5b899f0b1bad00f00ac869a3fbd5ba4f
SHA256db6c0320be0f03cbdf703eda1fbbcecb69b89cd7c546d85e57da6f7edf337f61
SHA5120f6489f1bb29a5069c9bdbe250508ed711380a802dae3eee4fc0253995da10c8b56c256663ff372278690105a4f518e87d90f5e0c3a7d67372f76b36dbf3f9be
-
Filesize
1.8MB
MD5df6b004814731723491d649b3f1f73bf
SHA1c70360c693ba2cdc6977c08f8cad453b5ad7ab11
SHA256f77b2e3750515e8d781ec1dfe96cb50c2b7f3422c2ddb5ea5bef91a7bd8b6ac1
SHA512773d46a618716f177b7f68e2d23755397dce0e123c8ef4a5f4722469931b1af0ed4fda39201550ef562e60e4d7688dd743ec61a5aea6c07ac082e2097fa46322
-
Filesize
1.6MB
MD5efd00beed8755c9cf2b3a71e53b63156
SHA15113420b365942cff74e3ab6f789883d2c16be88
SHA25636f21a1b2c769f9bb4872489c18f33ecd91afffac80f19d3077144dc1111d2df
SHA512e29384c0c616f02411095444c75655e1d852c0d8b4750b684e1f5aa2fe886c57c3187a38a8a91f61495a28c0557f8f965c990164c8bc56c59fc3351631feec1f
-
Filesize
581KB
MD50a1cf5a6b5d0d7b8d8deb3edefcd703e
SHA1611bf383337cff3eba9202d8ec50a3c65d447080
SHA2561559b801b396d774484acae0292129c94e898d715d814124d920f3e17cb5fc64
SHA51206843f6fe6fcc9c27d4c84654578019514b2081c4e9d57649e0961a8cd786176c3477e9e20119c849ae6c98cfc10309068e8c11750257a2b6d1b6fc7b3df0361
-
Filesize
581KB
MD5d90e24e8281017801c8ff94d2262f79e
SHA16ca0a7365d0ca05f04b5274c169fd227f1949336
SHA256ecd3b32d39937071dff306cca4499f08515047306d5048c9ec607869994d9d5b
SHA51288fdd4e1542e65f5a9965a57f8b82d673c44b74c4a3fc5f0f043c6d4a75b29639bf56d05df033a1fdfc5933f667c65b749ea06e75ffcbe05454b09530db27a71
-
Filesize
581KB
MD58b1a23d77fdf2a0adf32745415c664fa
SHA12e6eac76b04a00d7baf37919c24479cd4fb0b0ff
SHA256cbd40bcebfc6e2cb26079007f68c8cd2650e8711344da9d90a828afb481b95f8
SHA512bad0722d23cda8d04237e6572f14a7c82f9149eff18e5950b5a9f19f97a55bcd45835684b7b13ddb3568eb7c13429ce0be560a268eac95845d11bc463474be87
-
Filesize
601KB
MD5e221a7d0a5df74722e1569b9157c42f2
SHA16b2c925d3557a504a316aa07fee2caa98ffdf434
SHA2568bc0056d74b97748f0b203c3949f6ecf522f7af747ede83edfe3d3021b12ab39
SHA5122c39762236dce27aced4dbc3087efcf28160d5a74d8fc19a4ac6fe35b16cca66d5de6b6033a3bc4bb58686b471e517fb991f8641933d5aa895b6038f91bf7ea1
-
Filesize
581KB
MD5f4d972bee797a7070cea1f4254cc98b6
SHA1ccbdb0c0f50431ba9dc810358fe5fb590b062274
SHA256384d3b9c03984ba7e48ccea8060baa8995d54bdce4b53ae5b8d6bd2f519e5879
SHA51291ce8e61c7206e477d3a474821303e220340268bbd4ab4825f193652580949138524af06b54fe8845f818e105716fada8ec77c77996c962ff4a7fddcbf9c5cd9
-
Filesize
581KB
MD54c0c137d2ffbabe5d426eeabf64d7c71
SHA15bcb4f81eb2e305267b84191f0b8b573b5a352de
SHA2563818b345358d7ea6a0262a9387139069c45154dfb6af040388a551310e9a8329
SHA5124e0691969064a0de58446e6cd4bb4b7089fdb4cf0530f21e247a93c0b22c07cf8fba39f0cc7a3e12b057ba656c424d57a8a4e0d851b6dfaea24933afb990f773
-
Filesize
581KB
MD5b81665ba555e4e76423ad9f75ad7b119
SHA1ce3dac475f58fbc038eabc0ad4750ddc68c624fd
SHA256de9d464786c1c82eac9af46c3c5b1be89e2514654c18a3c17561994f8f3cc67e
SHA512d1c46b237a993086f054967e6e1244a475c2ef4624648e0f7a6cb26a798e696cc61663319c9124c965fbbd27d4cc6a8b241b840e8a27e234a2db7833708b702d
-
Filesize
841KB
MD5e022a2811ad22808b448827d429d7692
SHA17bbe15ebfb3863d5bd56341c51ac43090815dcaf
SHA256504690e4508776ec410e655548559abdc90efa0acc578731103726b994eb5cd0
SHA5125886c09e0dd72f04350687d4ac0b73178bd7697205f9b0fe67a723d3ab4dfd98bc1108ccb699d5178fad6498149092d53237a61e09887dce07ce70f7dd34bcf0
-
Filesize
581KB
MD57159561b15c174947a8bd1ec69eec002
SHA124d29e834c48cdb5d7997ea800ceddeaf9399787
SHA256f1b40ed01f3748bbb04abcbc6bf55430b05261516ee119339511a1d725572099
SHA512d2d0089b66984dc54da93b92119a65cd5b00375dc7c680016139dea3c81d555baa95c35e936b3cbde2835e4beef575057993e264f3f65c94bb3d72234462e379
-
Filesize
581KB
MD56052c2db01c8b1bc4fdda8c13bbb82b7
SHA1b7f4132f67a52de59d9ea6ab9d2ab2b00a817c43
SHA256b4a39b2ebdfa4d72e899b6c0e582a61c42f352f48a3129ba96a4a4ae05668148
SHA5125deb87ef6a0d7d466ca1b3d18589f1dc90c65318d0142a4e7d83304ef715781f105f84486b9d37fc00f10ceaf30b854b6690fe8352dd7547698b5dfa065fd728
-
Filesize
581KB
MD57795cbe58268e3748166de51b83588de
SHA134cefa686610e4083cbc9e290896815885e7c9e6
SHA256cd47a64ddb92499295a684d3aee568990ed1bfb8eed71a2ed6b2ca82c9a33241
SHA5128075272c3ecb032db456841aa7122dd89f21837baa792a10e27f6be041dda0574f338f9f7201ad466f14bca6f60e3a08ea12282b42e73cff3243c3578d7cd784
-
Filesize
581KB
MD540a20a1122ab79b0ad8da0f931d30e2d
SHA12855471f7dcc15fbc309b6c009115b8417bf56f1
SHA25650779eddedd69343e426193baa83f6d67dbf090fe74d1fbe4863b3438b955726
SHA512873badb552d30c0bf6682d0569c4194118149acd5b15f11690303dce27d8274c40f4dc6247d41c764c4dc900331d1295d2a5a3e9f0debb321168fb31f7293185
-
Filesize
717KB
MD54fb306bfe336b03cc75936d2b12aec59
SHA1933721f3f3ac9217900b09280455192617307686
SHA2564a5ea02bceef802772fd169f923b417c7cc56b3fde8ae80ff629ff67165a26a1
SHA512a206e1aedd39b51ad30859a892ad7da0346d37d1c77b2285581301f9bc9beaf366c08ee135f193dd792b6baf8aa44ada61992c013ea6ab6d6dfa435010c56cbc
-
Filesize
841KB
MD56a0c8979c048a5b8ae69e64fa7714853
SHA19a9ed3dccf58ded89a3fcc2dda2f751f30b01c1e
SHA2563a275c7efe92f9c23f12bf4fc12c4be92481ebc6faeeb4781a6ad6b810b21c67
SHA512038e5370432bbb76b0415d09a4d3a7381d242e9402536518a4dd95412f93c75143c858ca75dae1d2ec37d854724f5a45750c58375e0e0dbc51db169b9d84bd86
-
Filesize
1020KB
MD5a8e8ef9ccd66b633743fce31cc808d25
SHA175c9b789d6692ef401896362793dc7c730c9aeb9
SHA25690160f815e02c308c97afe3db41f5e1f4d2f23de3c43d96f94b850e95be9e55a
SHA5129b2377a254eaf7b1654d03ce4615aa004c0d0499ead9954ae0eab5aee3743fd04407d9d3f410b998d2cb90f7409bd3c90bdd89cde696f68f613e5b5e615ffa74
-
Filesize
581KB
MD59c0ae3289ef32497e9092f5d51abbcf5
SHA17014100ba4b42284ba9e6bd898a877ae76a46772
SHA25636ad2aaadeaf7caaa4b89461078ecb5911c6cfdb41f376c5dc7f1c40b02dffb9
SHA512c00160db09c12d826adf71d791af348f1df8fc2f0bc25840c6fba9324fec6b3ce82b2ce17574b04863a242c6588460c32b1813083dfcd96181d80dccad70f224
-
Filesize
581KB
MD50924312940840832fbb7fa1782ce90c4
SHA13d7c1a804a8ca5175b6251d0aa1c301511479b0c
SHA2565734d058f1e55d09cb436c2714c61c2f8ecaaba75d36e27f079fc93e7535ae60
SHA51278ae2f0ecd69984e7585c4086a730a3c448f1dea1ec288967532b1f284aa39e47f94dfefab3235c0a420ca7e631878f21fb5eeb806e18246cd6487057f87442b
-
Filesize
581KB
MD58ff0f7d050df10ad20ba3d73d7db0904
SHA1048e76f4cd3b4e133f3a4bab993e3efe41f53003
SHA2564013ec5f9c645e45b2f01379c07c9ce9baa62355a4045e56bf5b1118b5ac9d45
SHA51241cf34d6e4d21da56f992ee642c93fd8e13c73de9f919d5691f3c95187ab8d49da9540103e46dd25913938fba5649f4a25968965c38e58f9eee6928f24529c2a
-
Filesize
581KB
MD5b0ffd93cecdc6e2b75fe533e26121544
SHA1a0ef11726c72f07bebc7a510c4ca7c243a4f2912
SHA25667f85218d8425b0c01143bab243f0c0ddca236085f9c96a0794e86ff68c982b5
SHA5120cd6f6ab536a3ba165535af15690584d7fcfc403c9b811c1b45835484ee3666cd602ecbc0d64e4abb9a1916d54284db62f142f8750911cc679dbf863f7391c3e
-
Filesize
581KB
MD51351c6a97a2d907a9d2d1a4eabb76415
SHA16fa55a3a5d4e3b17e9d74ab686a8a3c43eda9c20
SHA256d3e35897735b0969ac8ea3ae1b52aeba87e51d972879ba1bdcd984bba25d89ce
SHA512340b33e83aa8b4c47dbabc112dfdf8204080f6db913198ea2ddade8a990693617d78009aaf3e742b200ab9dae5cf366241f5b7db631f962652f582d47e5d6fee
-
Filesize
581KB
MD5672f3b69f3fad6515e3a87cda88e2811
SHA16178e51fdf79103cd228c559960015782cb68f28
SHA2566c989757f9ec25a8ae1d0eeaa30a1bd558c21b4184c8612c7077f6a9f8b92475
SHA512811fe06ecd40c5298acc265a4efe7870ab4eb9bfafc8af0b880864836b62c0b3b760095d5bd47c927689c9d786076b978fceb283fdbb85ecc116c7f9af0ccce4
-
Filesize
581KB
MD5d315fc39428968f3b365bc92f0857592
SHA1e14798e1131f23567ca4291912711102f5df46ce
SHA2563c587985b2d8a73b58cbb0168ccfd23beeed0fefc09d868d265c3f6872f02707
SHA51255ef591bded27022cafbf2717a795482fabe0ab613923b1b132830274867e7f5566fa0e521479b79ae376e0f44fc4ba17c65cff5909b2933bea2d4eab89a8cee
-
Filesize
581KB
MD59c14473e430a547f44816947712018f0
SHA1c80a17e825d460d5d5eca4077da290cd9684fd20
SHA256e94657ceaa5b492d1fbcf8099e06320c01993184fc3d9060dc58ab07e36ed5cc
SHA51263c2ad45ff0e27090f5cff584256ba8e413411e32de1df781b9c787e5b2c8bb8f6dbab9a08079ca5d320c3307a50583c899f2628d69f49bcde9826aa3657c762
-
Filesize
581KB
MD51a13927fc051719a1e8aefba901f2e6c
SHA116db6b56daea4e4cd225affd268def79378e0015
SHA256646c2f5014ebd79ba22b899cc0dc33d2d7ce86db85b3ac4b3672985231877a28
SHA5120b33a150479724c211d83b98554cdf16a134dfbc4387b151ab603715d220221ecebf27e7244b072e6d4699145c610a379c0ca0d0cd76780ad13e5c6fb0dcef62
-
Filesize
581KB
MD533ea4f0d2a988eb8f6eb3762ca8e292f
SHA15273c3295939061b89b6fdaa1f4aee852ceaacca
SHA2565c354c68aee60efbb2bf432e172ca5b19b563bcbdb4ad7f9b27edeeab99367c5
SHA512e7ac8cb0d6cf78ff20105101d6b189fedd7c857778c66d97ea2e5c01d9bc701bb3a6a92b13e6ec12c1a348c38122fbcf0083f05886525c9b7c5fb702c0382a63
-
Filesize
581KB
MD51a0e070bc8121175116681832c7120d7
SHA147c7f01fee6ec86646ed5273ec7fa3ae88500087
SHA256cbfd316c47f5c82e74801897596be749051b29c1a26e2a31fbab65f37bab9d21
SHA512adea1640294cf91dc34289c01ad55027fbaeffe635bc519917afe41fb83427ddbb50c0473e00beb737173002580eb240d8c396fe9f5ae03bff806e6b908f822e
-
Filesize
581KB
MD57db51d70f032c6d30c5288304bf8e1f1
SHA113f13e546db949d903fc13c6eb34a90d581c1be0
SHA2566518f140ca4cd5dd9468238aca18604b62467f1d849e87a05adc319f292f9444
SHA51250ba41385a45fc8b7584161801e7ca5a69bbee45398e68c8e9cd0f37f0c7bded45309240e766cd4fa11b8ab728e5d7615f071e1a5e6b82da432e72ad174bc63a
-
Filesize
581KB
MD542f28b4e70b0bd03c641c3a368bc9d15
SHA1011eecd2dbda7c6e5141b550c61b61a31c60452d
SHA256bd74e661013d94ea911bfc0e491c290d388da3570bc929a4b181536297c0c925
SHA5126116334bd3926b24642bf7c5ead269909f93eeffaa5959fc4badc34009279d58411a64d1da9a44d4f8001e05f4e98e6f55ec1972dae800dab3e622b590023cc3
-
Filesize
581KB
MD51f807b9d4c6e63ade7bd9c2632cc255c
SHA167c540807e22d55540c176f78b35e314230f96a0
SHA2567922b7af3607fca1a4d25a5351d43c46a86d2c22265a3bb79e74a7fe58055a1b
SHA512ef6308002c2f42c15c3d2fa09bca88bed35329e7aa93856b040bfb1459b9341c93782802c3b0284770cac94ded7932364c8181f90a29e6aabf0ad408da3ad21f
-
Filesize
581KB
MD5f3d821f5203f63feb1c867b4ba84a17c
SHA14deb8bf1a307634602bac93cc26daaa400dedb04
SHA256e2432cd1ce29725aa01309994a14bc5d57fa4f60c15b948cd1c34e42ed7440a8
SHA5125724f20c0d45a9141ef22c042520f935b23578c0b3f809ff7ac7a0380ad78e8ba01755afa6d7c8b8a2592bfb433612c25832a70faa149f241dd21ede50b6f2bc
-
Filesize
581KB
MD5ef9de3b22987f14912ec2fb40155f90c
SHA18b754ae6460b438c031ac8ae0bee45dd7b293c18
SHA256764ce9cbc39264210f90b3b13ee0348a836eff200fe35ebd4a04db863e3d5782
SHA5121b44e52ccc0985992090b9a74eead7b98cd1dd35304b8c3d8a6fdc015ea11ce261d45eee76cab985c93f918906cd0497f57f9d052c3ad91fd60c027489f5f3d5
-
Filesize
581KB
MD52d685388c29f8a0e0084b594fe44c9ff
SHA17fc2b9b9782c683e6555a3a02fce7392a7db3130
SHA25688bab8b9e7fa5a75df5c14241a4af3ab26c7fdc1e26daa6febba9b591be541aa
SHA51252a104c9738959339be56f943e68be3ad7010f5a56e30ed60156acced7b9f37c577c6b206bf0d8f746069695193b59dbccd51403bf637b83bc318554055d89e1
-
Filesize
581KB
MD5cdd361cc0dd9ecf3fe2f04778049bf6a
SHA135771ca6ea0fac22649e0941b966143d64eaeb15
SHA2564c4d94d11c91f224362410657c8b376a88b4b406c99e6c0d586e62cdab38bd4d
SHA512f7be2cdd0a62b4dfc560993bda307361db6b26bb005f058205031bf6b44a9ee17e21c8f2d2c6dd53bd0becea6d9cf983734535265ae0a81fc22d24945c68dc52
-
Filesize
581KB
MD53440fe63c96b11f384428667456b2dd1
SHA1f678eab9a18e935b93e6cc7a91fe6686f8a04d17
SHA256d3c2754ff0eca1e2273b42ff77c9a49a5f7432879c0083ace718e3ce5445e244
SHA512f6051cb6a26a6032508bb9be163c255a0fa22598dab453e212b32e0c360224ab5c63ec54937e09f407e7316bbd0ea826069f46b9c337477ac9c4e997421a5b2b
-
Filesize
581KB
MD5e857939a85c9aa5ce3b6ef3240e1cda6
SHA1cc54761d878102159221cd46c631f37f6a1d9c08
SHA2562de32ea7c6a74af1ea30dbfbf3d26dffc33bc9a32bf474a2f3d7d86c3c870057
SHA5122ca9c93efd14611c86463c2e0d387712247fab63c69bfd82ddc774018e3f30d8ff317a8e0f55e1d5f182ada7d040adfcf303ef887616adcf272b20b87722d7af
-
Filesize
581KB
MD5b9d6d2992e487b9b56a8e042353d8dfb
SHA1c9b0d395c5c44e2c7f97b496fc213d5132469f8f
SHA256798fa94e7330e3c3d75aea14d8f1f21adfebdf3eb451faae2f798dd7b02ce616
SHA512a7bd22069b25a2a89bc1989349609e6d95543beab9033ebd7e71fef67e7ab1fe2dbd1191712eea46b54fd3f4e9b3ba28b46699e37a58f58039c3eee8324a0d63
-
Filesize
701KB
MD5244e240e3f4a72979fc05fbb88a9d359
SHA1e68e36c7d6aba0906a80b1f07dce7849f652ea08
SHA2562275a50e00000ee90729f90ea91a955789d0e468eb9529d9a563df92e12d8e86
SHA5124710e366fa917b679613415e3517b3a08ea3daacd5bc3476877f8e80d8115c5508bf910fcdf93d43b473ead5432001a93bc79c8ef648bfc1164017ff2e8a71c7
-
Filesize
659KB
MD543ab36f9f052ae7954fe3937df462cd5
SHA17fd0e2417ad608ed2e1cc09c7a9761ce1469e32a
SHA256bdbfad428cc5d1afc74f5584f789b5b20d3c895266ec7270d81d3e860c337c19
SHA512fc477518d57397c950e003ac8dbecffa26fafdea891ca77a934ded01c883f4a9f7281fca2487fb5ac75896474ab2d40396489cc5e5d73be326c99f63f762a101
-
Filesize
1.2MB
MD55772b1fd1587f79c748526684e245e4c
SHA129c7f991b480b02f0a19c62be84eb20ca78f8a02
SHA25669526374ad9d8c60a797f1a0def1461fde4cbd5350b5512461766b11c7b2fc4f
SHA5126f518dc6b76e952f5988db85c7b0beb2011e3c0378332bf59597291bde8d6ff9597d82ad0f10a03b18376e49ea848f3298c491a8349ff1dc1dd92b80e98ddc82
-
Filesize
661KB
MD5df95d5fe6b79588385bee3af5ae5da40
SHA1325ab1352750d97f44e778cc495704a9309c9cfa
SHA2560e0f30ceea955b8f18d01118b6336ddabefb03a60357ad5d27f575d6a4422182
SHA51218cf5028d9b4dcb66181b681c6340df5fc2267915868e43891f1899679697658d221b8bd9a4206465b32a2b2907ee8f81c4ae95dd7f42cee9edd4fa8953bb767
-
Filesize
1.3MB
MD53b6b678f5c74146a370f1300bc0b8474
SHA1a6691dae73fb15154c29142b1c84715a35e3d65b
SHA256d9ba8c6b65f25fbae5e96de3cc3e35ccaff2432dcc5a02ad2d995e9b27960170
SHA5126954e838c0b728809a94adb0099e65dc50838973bc585db75b985e08b11eb381e8ae7c8f08ce3070cd2a4ded70c1f19881ec25efe4c3e51fdc6ce16b87e4fe0e