Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10/05/2024, 04:46
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-10_9cc4cfe85c6eb9802496b749b5e9f8a7_ryuk.exe
Resource
win7-20240508-en
General
-
Target
2024-05-10_9cc4cfe85c6eb9802496b749b5e9f8a7_ryuk.exe
-
Size
2.2MB
-
MD5
9cc4cfe85c6eb9802496b749b5e9f8a7
-
SHA1
155eed6ad10fe4911aa57c88e2aef8eded30de7e
-
SHA256
f9fe8376b717f0361624d24cb90191c39f197f16f7ac8fcf2a189a923b21b150
-
SHA512
b2ab4c8c01536379b715aece3d27cd32cb67bc28faf41a98773fc63ca01ac2e929209437f39afb6228f2be1e78075e9288955e44999127f5240c0906dde1f4cc
-
SSDEEP
24576:FOObVw4TaN1wdkukCba4oXtgLhU3wEdmh58Wt/sBlDqgZQd6XKtiMJYiPU:FOOh3aN4kuLbegmtGH/snji6attJM
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 4616 alg.exe 904 DiagnosticsHub.StandardCollector.Service.exe 5096 fxssvc.exe 3484 elevation_service.exe 4976 elevation_service.exe 1876 maintenanceservice.exe 4832 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 11 IoCs
description ioc Process File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-05-10_9cc4cfe85c6eb9802496b749b5e9f8a7_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-05-10_9cc4cfe85c6eb9802496b749b5e9f8a7_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-05-10_9cc4cfe85c6eb9802496b749b5e9f8a7_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-05-10_9cc4cfe85c6eb9802496b749b5e9f8a7_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-05-10_9cc4cfe85c6eb9802496b749b5e9f8a7_ryuk.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\9717fb02c8648821.bin alg.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log maintenanceservice.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe alg.exe File opened for modification C:\Program Files\dotnet\dotnet.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\dotnet\dotnet.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_96109\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{14DF0EF0-439C-4CF1-9E8A-D1E954BF645B}\chrome_installer.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7zG.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 904 DiagnosticsHub.StandardCollector.Service.exe 904 DiagnosticsHub.StandardCollector.Service.exe 904 DiagnosticsHub.StandardCollector.Service.exe 904 DiagnosticsHub.StandardCollector.Service.exe 904 DiagnosticsHub.StandardCollector.Service.exe 904 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 660 Process not Found 660 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4880 2024-05-10_9cc4cfe85c6eb9802496b749b5e9f8a7_ryuk.exe Token: SeAuditPrivilege 5096 fxssvc.exe Token: SeDebugPrivilege 4616 alg.exe Token: SeDebugPrivilege 4616 alg.exe Token: SeDebugPrivilege 4616 alg.exe Token: SeDebugPrivilege 904 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_9cc4cfe85c6eb9802496b749b5e9f8a7_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-10_9cc4cfe85c6eb9802496b749b5e9f8a7_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4880
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4616
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:904
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:3160
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5096
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3484
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4976
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1876
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4832
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5c4a2956b5fa7a51b14f0f1f3d2ea9d5d
SHA1e7d470a9e3b6870de4513ef084fb1c96ce340254
SHA25607b9fe77cc54e3b3063e2e82a19237a670701c783b648b9240b0f730a471f357
SHA5128b5a2889998da2d0a587c88a1f3bbaba433bd12439965f422465c93f489de22ec116d9d651d98119a4a78aa8fd49ae999ea8e0495840775e078dd3813465a1ad
-
Filesize
797KB
MD51af82ed0f9d7ff7c03bb46817265a700
SHA1b7378b2b11c5e7c8721c7047b87698d3c1ad79b1
SHA2569164445aa81845820afa6a40573396aeab50e1ac1afdfc1e398376817839cad6
SHA51298dfc46801a8e7cc510ae239f8ec1cd298f40623cb94e5e75b27e3f957adfe39c20574e9f3407523094d522a04c8dda0e71f6daf5a8a67c4f0b73f9b5db44ca7
-
Filesize
1.1MB
MD5aadb6324bb5b02b1edd4ecfbe4c2e5de
SHA18e90a6d065fac2a5f3781fc75328a88fbd4dc5ee
SHA25648029a3d9746deff0199a33cc839f4152571a107efc293889f92111f9c5451a6
SHA512cbf021863e00c69cd04a0de1d83011a6e222674cf3edb16e2244228e32a523803ff13c927fd9af104008cb5fe9aad70fe3e245e80104e9faed90316e28eaba2a
-
Filesize
1.5MB
MD5e9b5321c3f578231950eae6955c80500
SHA1674c11eeff0944435fe3f5949410fdc3edd74015
SHA256ad63d56185fbf4c40ede9abd844095e0e035a89618b27cccfc71130bc899fd26
SHA5122646c07ef629637dc2fea1138fe8616ba6ab370fbe891dc8c37b9c1b6995731cfe4774e262996c93552f0139986a9c6bd41fc4df994e885961b5f3a12d30745b
-
Filesize
1.2MB
MD5ecc347bef595d815fa93a9f788a531bf
SHA12e93251d37519ad1faa578660959b3e886cf36f7
SHA256f75e3567439a11180566b6ad79c6fb74cbfbd08bf1b6c81c998dddcfa462de93
SHA5125ccaacb067f888b4fee75ce4111b9f27f412151f12fcb978306ca9569e5896a2c54b9434c708ad4c3b55fa271590d2523ef9bd43fa8a5f9d86f94f57cb500ffc
-
Filesize
582KB
MD55e01960f28558df6dcea88104a4618dd
SHA162f16cac2fb5e939edb7fcf4cd2bb12ae4af6feb
SHA25648bfb39dc6faa74afad3bedda7fa5c9f33d048b28aa07124804cd9b2320b17b3
SHA512c0653007533d1322def5244aa3977168587d6988a935e5e135ef3511bf15e4a79009525181666816b93c0699e44c74adb6c815518f0723d82a2b158b92749c21
-
Filesize
840KB
MD500741d1b7d65ed3401539b51b90ed50e
SHA19549957a3950934e1eb2bc443d366d62eb8551de
SHA256a6f589a6cb5a5058e55252dff30bb1ccb8df9780dbde5d48864cb88cdd13a1d2
SHA51264e7e267ac64c932ddf4cebf764d65a63e230e409572107b9754dcf32a68cf9f876ff69aa988d3611c65a90c10faa38956911286052c7b28e332918bf205bd15
-
Filesize
4.6MB
MD54349456f3b8ae37ac7f2e4f532ac6734
SHA10e9928aab416c9d2d0db3a38126dc31b2c59dbd4
SHA256af7f0a5034f2916b6956f8568b1f0287f3f0341ab26b981f08ed1bb1ca644742
SHA512c7d8d2655ae193085ed8e135a3c4e1ae5e9c5843796476cc736932b34e25520f84e77d1180a20633b51edcd2a7967f6546183a88a8f1f12704b2656886877fd7
-
Filesize
910KB
MD571ae5301c29ff7a72adcd719fa0772d2
SHA1f5c9d0381a9d7036ee0025ea842d95b3a286ec06
SHA256f6145a4d847ad46f4f8315d9a208544e3241569a8e6df504f80efb1d37137dc5
SHA51256650a3598dcde17c127a94895af17dae09613254847021dbc9f1efccca50b2ab742dec28359cb8a3b729bfe469562ee61ea19d0b2765fafafaf4b3a6085b570
-
Filesize
24.0MB
MD5b5e76eec5316ba7d3cd329510437e042
SHA1b1191ca428947232d28ad7994598613e3275f1c4
SHA256b7e351c7c8173a882f5466a1099d8aa7eba1f4ac534ea1e38a36f506259a5e77
SHA512138ba4c0be7ea7931a7832168f72904a53f22b35a1cb4452303b4bef673a3e1e4a544f081dbe04797b0f0d9f90b631a4ae590fe43169f6b3adc63265a3345b69
-
Filesize
2.7MB
MD587a5666072f4d23375b3faf36f9425fd
SHA14482ed50339380c5b8044988c4e795310a2bceaa
SHA256237b2934496712ec6df24d2630e206965d69b80c74672889665148aa4f45a533
SHA51212e5954edecf1c13d2f9f3e980c0d9077df141515763ac1d2b7ef6a18e42ee0d85321566145c2dc2eeac2e8d74602afd007862931fb30730a919df50b29a964c
-
Filesize
1.1MB
MD54b428e3bf86c9d6ece20189c18984f86
SHA1b0b3d98869135dfaf202bbfea02388dbba125b92
SHA25676b16fde50c4c485c4694daa3ef22b214b98d606ea512cc251e55d755ebe6275
SHA512ce01aa9f5c9008bc55cbcc6e84d471750ea5c09d3870cffd11ed91353ed788b1080b16fd9c0054a70ece0a341c3f30ceedbca2c72b09f30e85c8685a03e10f33
-
Filesize
805KB
MD5c2a14a84c25bda511725b26dc3fc3c6e
SHA1f9843bf781af79e5310c94da19150a97434bcd9b
SHA256697b115784e6b4e2e92203e81629ab5eed89768d617f6fd5d96c668a67ba2cd9
SHA512c1b64c4c22a6312d27cf3b263e7acb8a64f3fd7cdc3511bc532d85760664bb9126b87dded548ef0273842a213c5da8e245450f4b947391cfa8c62ac0ef877b27
-
Filesize
656KB
MD546e13c4dbb1f30901de6201b4134725d
SHA1f3dcdb9703b6d958c537a69dee474e5161f7c526
SHA2565587c50598a08ac2a979775c4aab6c78c4bd7626b3793904e86edb4efaea0412
SHA5121b07acbe216c886281886ced40b187d7e503143814e1d7167b456ad707aee4669ddba2dae9a763c3aa28c423d58c3e9b4e40af9fee43f3e4ca67fbb15f311e50
-
Filesize
5.4MB
MD524d8fd4750b97348163319ec02d9308c
SHA1c2d6b8b583d1e25cc49643c7b15120600859783c
SHA2569384c1e6c6006b902f2cbcd830361bcf8b4b64140bdfb5219da40292261f7c11
SHA512afd8ecc8303949f5bc4af089596cf5c4f15e7937a2225993a3a69aec8ee8a7b191d143bf8c86fe84782ee70140f748bfc72fc96f6d2eb7b4989b7ea38e6e67fd
-
Filesize
5.4MB
MD57614ec1d4fcf60fcb4b7e2a5c5e8cf0b
SHA1253955c5f652cd3cc94cc3ce0771448c711ac642
SHA2563d90e08e87a755f7f4a0ef564eeb24e9804abbb1ffe1d9f1f1cf6a51b936d6c8
SHA512f860986aa14dac5b1afbc9a002ee010f1de683be9b76f57fb27220fea6bd2a96379f7a8b4f078fac87745247dd115dcc7096950ed95d15675de825ec27ff7dd8
-
Filesize
2.0MB
MD526a7cad78899965e13fd383b04c1d800
SHA1966eb811c0c78caae379a3bedfb010ce1e4c9cd7
SHA256c05967170f34bbf48268ab23a758883ae50cb93c7063fe33884b7dc16c17ad25
SHA512f35ac1b141ed21bfd00c50c14fb87e8b9691fed1305e358241cdff7e2f90e8bb64b591297372c7a5e085dc4f42a72fc90ac678432e53a4a07e4dd44c4e462c76
-
Filesize
2.2MB
MD5b0dd93ce0bb268d3ac17ece6d55ea072
SHA161db9cdb788d8376082d4860cf55c4e4e4e2dfa9
SHA256471893e739914b9070e13821c612a37324fcd704a82ddc863ece09de08902f50
SHA512a8f9b56baceeb78a60df58851dd772933fecaf4d9ac535e6030da18ff0b9dda57f6a876aa71edfef18023febb92adfd463589343ca2732b9b035c660e5af332c
-
Filesize
1.8MB
MD50d61f0ee5e81283f5e16d353595c3042
SHA15c247ac57c042986abdfbfe0094ce67e407b2d9b
SHA2568008861f4eb8c1d9f9f321887aa1cbb06ffeffa9eae5b433e71e774e3f223202
SHA512c65ccc2c59dda2b761277c100c61a5b51631adfcb77855308cc1d362f3b428155c7cf7f989b809d8ebfd3804a4126899c0f674f15b38ea11c93693603ab8c197
-
Filesize
1.7MB
MD5126e213a402f1a2da58939d6e56dd89c
SHA10d50d2a851fb6da85f1114b2cbec996c311bbc49
SHA256bb377d96863227ecfaa8b3297735381d5366c29c46e1cff908ff535fef4c397d
SHA51285ecd93fe0aac6ebc8c97cd736a8f1aabe552ba3a9c127b1fc9439cf15e81e1c6984ad913d750b9b5a9f8d127e9ed50bb5dbcbebcc0330940cbeea44db8798ff
-
Filesize
581KB
MD5dd8d2e2249e8bb3b84540a94cd729e2b
SHA1e481585be8e7a3e5559480a2246d75b132fd6d1d
SHA256f310a7937823665b9b548d9563ea2321021f90c1bde0deb385e2db4b534056ed
SHA5126c1f0ee5c3ebcabd845da58ad9a771b5545b21e871008702a92d01f86c330637bffc7e16f073edfbe1160a0194e2627eeb7d0222804d1b96998f4190c87dc5a9
-
Filesize
581KB
MD501c8a4fd1207a8bf98d7567682b2b995
SHA11f661a6cacebb1bf71d4efeea2161d250a6a18d4
SHA256c826522fac1a186bd9ab81cdc5a96cc1e5f1e9af3c19a41e2c538053c1ae3e9f
SHA51294d718b076d88fb0e9960a02872f81087278f266c1da2e10d43b1a486073901fde20a5313adcd6335897e12adbf96fd9d1d9ced5acd2df3b0b3bac5f2ddae932
-
Filesize
581KB
MD55526259ea949202e322803c84f51d1a1
SHA15892a99292dc4b66aa4b140e4708f8116e337d22
SHA256c0fbc9c3a9fc0354194aa42fa228c47fbe692a3189d4a5c49730d2fea4822fa4
SHA512d4a1e79a816dded8e17a395eccb0c4c51fe1d938930888a2397310a2779ed2aa1af96b8f1c4caaaf137926c5a8094afcd5cea696a9514206623bdae64a6f9bcb
-
Filesize
601KB
MD50ea9520a0e14b64addd0e5cb272f4da7
SHA1d1127a67b555d8d5becfa6a2f0876518e09c6154
SHA2565512c47a4a89c7375a6ea87ee3ef573063246a064672d2382598cfb6a4e92ee6
SHA51283ca7f064f61c0a775e53200ee470d7e45805556532b1c25a2650ca31cd69138afd95636096929e6ce3f5178c4a0b15a66bf7f86978490f7dc5954d540ef138b
-
Filesize
581KB
MD50b9b8255dcfa576836eecab7c00387a8
SHA1d2c509ea7203db18fc372c037a29fe0e1b691ee7
SHA256efc66916d68209f2e2ba9264405b112abebbe81810b4fb1b2b9f292fd4e4a518
SHA51288527c974020c4ce0f6a6ed0f73c9858d2cefda6bba870c65246c1b2b7bea7092b7a923c543886c2e21c8a733ac0f85c9702c1c8b5ed256411e2bc53e6dcd227
-
Filesize
581KB
MD5009e4a252aa517bc470cb84827723424
SHA18bc4bb859ec36722352d7b05ac1f328354f2164a
SHA25613a1283df640eed3ad02c44448a64bc71d3ce699c8b063f1d0077df0b97c74bf
SHA512bf1a103e41ecf959d850f551d46ace1df4bcdd2f6c8936e77fca83b29ace93e959a04c35879eb3264eb5b6ba98d6ff65b16f0668c1ed7bdea077d75f7b93e4d8
-
Filesize
581KB
MD524f2979d2d4caf568767ef365199ef3d
SHA1803771f42a0e82ea2279ae7f9020ab95ab19e074
SHA25648ee1dbb3ffa123ce113af01ed8706bc506c05c0b332bc35422f33c28ba200f1
SHA512e3c7c08154e7c6bb130280f81cd2d767f17d7869bde2882cd4daccaeb5ba7c87eb155dcbfde4d64704b31a738e4ea784a388edeb95eeeb31be478bbaa019b9bc
-
Filesize
841KB
MD5c8f3c9705b30d8d037a311932aa58823
SHA1b3827e4ecccff80c4069afa8af1e9eade6e49e69
SHA256d60ec52f4e3dabbf1e8f5ee9b31bc97f92de13d5246ce4a0a8d95e763f7e46fe
SHA5126450afaa646217ea9ae04b6d996767d125ff378dd21ce7256350bc7da006cd1a49862a58b3fad0f31e79673e782d28a28cb47139fe03920d48c2cfd73b56959a
-
Filesize
581KB
MD599635d108e62d783c14f229a064cb00c
SHA1cfe6ee6f2feddbfdad7c5be4dc41ad0ed50c6993
SHA256fdf962413d9eb50ce016c34a27cc6037ac31720f4257ed35a24869002d3443df
SHA512b43b5fa6fdf5cc27ba67d5da8b26750a1f3d930c591d0e1edbff694537bef5126ff7dae80b0eae3494330cd96886c059d542c3625394b256d0c001abcf4ad07e
-
Filesize
581KB
MD52929959ebe61d08f8674057f046babf4
SHA1c6564834f0212a743a3bd0a7b824df3ebb44a30d
SHA25610570b2b8b813d7a8b2111dcbc1592710da2b7bcf0b2ac884e7b6175c5610104
SHA512409cbfa6c948abafcafe389007edde3c3723ab8e729fdad6420eb5be078377deb82d1c014251346a2da63e83b72db0b361df68c8090f7cfcf7fbbd20c0c6c65d
-
Filesize
717KB
MD56c0b3c3ad96ca37d672bdca1902183f4
SHA12f8729d382318395e93c7c52aa8094a7a97ae6ec
SHA2560d05352b2dbfd8dde85e3f8e9525086f778ffa4ee57107bbfd5acded8b785016
SHA512929fbadad6eb50521f061632585335aad42bb79245df925096348c411486fa7f1dddf1821e9a31bb54059fd2fef6d2041ba037100fe8af5b2b895a0ead8837e5
-
Filesize
581KB
MD5233f46a6e70520b1a5415e1109e9c863
SHA1e11bc8673b09e0655f97b54f44197316dbeb15da
SHA256b628e24815a5bd37e16cee5ffde7af1fc2f75d4c85163a32293be5d0a4b350ee
SHA512845309fe612e0e53b5650ce2bd5a3042fd27896c92d3413f1d5629af7cad3254e094fa4220100bbf6f86ad96d35a205b979142cc09534ea11475ccc77c0a5777
-
Filesize
581KB
MD5e0b32bd98f3d5f96152f668659a7db8d
SHA1e013aaa3b707a512993387b56eb7aa980254bf66
SHA2564b5504a5edb74cc8248253445f1253019e8c7f771f1a4083bb033e6e140afb13
SHA512f0dc5a9889d836c7aca4ed85b77354f48f13ed967712635a9b102ee0dddf5257799ca517e294e2a8974e0ca821db6900982122e4a11adf2aafe3c11270c191c8
-
Filesize
717KB
MD55015d645d3140f19035aa6a8d42f388c
SHA11cd79e24bd823993bce3ffc6caf69f30e311320b
SHA256c2a21f8d185d90942176b726a2f55d67589a834880ab49096b1c841d177ebda5
SHA512f5f933f65f147218ade30bcf75882ca8bc028216ca1ba2dde4d4dd0f53551b12cb3cd1f8c701b3bb748c7386b9e1920de310d63e17624eec9b296aca5b3cd34c
-
Filesize
841KB
MD5f4cbd3242a41481d9945a13529b4ffb1
SHA157dc6cb2341e2c6d5c50a7dbb708ee6ade0761d1
SHA25679620c9b938df4c6818f65ad803f95a343d71db42b8f4ac4b977dea032f7af04
SHA51261b8b2a9b4a4600bbeb793529f451179d8f04bc5794271b057139d65a667541595a53fe3bdf80dcfb398d6e8d2955e00cf2b22d822d41c7d8cf027ce807c6ed2
-
Filesize
1020KB
MD5a57afccaeaed6479fa68ffb0275e6fa5
SHA143841cef0736fd9cbacb8ef080fab15beaf937e3
SHA25656807f214668d079a939d66ba71e4b2c66c813ef3cf6323dadc17c389349eb3b
SHA5124e7a16fe3f7b1178a4b42ca771af5106307c5f722904d9ef289346930d2b4db4328af269d9e17445fc39cf74868e73d3a2594da8820a0f4a22ae8c30c3f53a54
-
Filesize
581KB
MD56dfab49d54de9bfa4d1c139ec74e0ffd
SHA1f1b66ed822d1eb159a401cbd35cb7340b4090bf2
SHA256a8f3ed539a213086eccde047a77a91f2a0173530ef6665df9a1919f9562fbe2b
SHA512de23542b6ea0cbff2d83f191168c7c91c5cc5b8bce12de90cf3a1ae9d1746499a8a136f8fed87ee382fd3e6835ea26a730dfcdc68ec7faf0d4aa03f4ca613346
-
Filesize
581KB
MD5d73d5c3e1ca31bc5459d60ba9c6cfe48
SHA1d8eb201c694bd1f55f130188167af3211380a030
SHA256ef3b73abe0dd77c1152cced3b532197bb163ade1834f4a5569724b4b4a190a4e
SHA512a59aa3b0513890a1b4a1806c44c89142846e193676e2eb27cd3dbad0cb8a5f26104ddd34d0171cbbe3c122b66c60de2d99f91385711b5f4ff4ec5ec2bcb47630
-
Filesize
581KB
MD553074524278282379932d15a248e52f9
SHA1b7241754e536b5ce4a52bbc73f539ce0af62df8b
SHA256796f6b1413e47b504b10250d2f7c7581599d012db80cd22d7d81cdf0178c200f
SHA512d52afc3ef070bda704b56e627372eb9d339af98898e896615bf1b47e9176b9d99792cb7a777d30ddbf4eeebd8d823380c7f822b4173807a01a733d75f4bc7dc3
-
Filesize
581KB
MD5500a23c740bfd9b0166ed8b55ba59d6b
SHA1487b3fd1bdd631af12973a87d8a8f02be5370cdf
SHA2560e520d4563030a89cc2625e047f53a352b697eabdc494bf49df90ba7c0a90693
SHA512118a2c235248d6fb4a552671655ec26523e77a40fa84fd04ccb6903e408bf8c73d524df1ff0a47228315dd44ceb9ee2c1ca19ddbc19a997c8dc57e8f1a3b63e7
-
Filesize
581KB
MD55299551b705d28d8ec8407238ee3e746
SHA17a66262300f27921636f04dc7b603158aeb3e8b2
SHA256a83774f7e657224680c8f20383926a30bdb8e6d8f6cddfdf936a1328a0f944a9
SHA5125a688524ead268b4808a7f72a5e83d5b4d542ec5149c3d4e7a8a77b6cb7d9bc0fcb8383fd472b7142dee1d55ec3867a794f997e9e93de61068c9180c02a4918c
-
Filesize
581KB
MD5655fe203fa8c3e372f14831ccd7c84bf
SHA15cfd255aae40d4a05a007c2fffe556e8f7de330b
SHA256019eb4e7f1245612183d4b92cf88425675ba2a17c4ffc6b6014d04c30f2aa5e1
SHA512f763897729176e3fdb118c4d73ffdbad16981a21fc9fe7b009237abbfaddaac00ce3a609389373f6d08cfe151008f6210d72d191e20fef5e473352153b65b702
-
Filesize
581KB
MD5199267dec1b8954748e04c0f77a590d9
SHA190ceacb49df39a23e9c775a7c4ea4cb63575a52f
SHA2563f04154e2c78d45db83a7c0debc998758af125be32700c070c21b2cb63de02b8
SHA512b3359630bf94197a91ec2c33c11f996e5e514d0b763fb45e55801ed0ca0a9f7fac6cf8bfa5ca52be6fd91c421c8425919fcdb747d18919c15ecaf9cada75d504
-
Filesize
581KB
MD5e9b189abe77288642bf6ae3146e95f6b
SHA118ed6a9d455775f69a292544ac2a8e626153f22c
SHA256e6a854cfdead6271d83c5086cc3c732c9a10c53388ee3d22f51134c1e47fe8fb
SHA512f0c30773edb0e338cd1813506b1466aaf0e85817aac743022529ad33824d9f89964bde687ba2eebd6393b2879fc3b45b7b459e25fac0526401a9f6f2a0abe0cd
-
Filesize
581KB
MD51e8fd6cac3c00d3fd20d3af53507bf80
SHA1da0844829bd1910553baefa59ba3b9257e72cac5
SHA256abc1324c3fdf0c09549fff75517df09988eb47fd257f9ba5a50cd75c5c944fb8
SHA512ae39240fa32587e6652f423fe494a6ced88f414b25689b0cf44d5b2d04c25667602d4b84d61d2fea7e7a921512cd12458209d679b1c6eed8fdc4de7eec20f166
-
Filesize
581KB
MD557cd0b920f65461b50fb585ba2863fc4
SHA113852939af09ed912b6ba3a9d72e304089003c8f
SHA256abfab2fc59142f1f6194c06d1be44502619d383dcc0e1c2fe48c9e586226e626
SHA512f67272af376f41899a0708118f011fa585718dd2012ed866b6534289a4b280abf103d2870627a94924936dea97f14ef3e9125ccaf624fd6439b84b749516a6bb
-
Filesize
581KB
MD551e4d4d5360ff9e98af543fcd180c85e
SHA18ac41ad37c825a14c8f124c0a8e8503e1b6dd811
SHA256bfa03f70c0269a742eb20f5128d704b43b8510523177e5767d8dd1ac1cbf2dd4
SHA5123f1c21251bac563e62348e628b610ef383ed4ac39b0e6f3024bc69fe2dbed56751dce7fb85521ec4b6429fb37da1ec93018c4160ab707805f0fb080a545da567
-
Filesize
581KB
MD513e7296c248e6a56cf3f58e98998d493
SHA194f27278cbbe0f328274174b95e57d865eb24ce4
SHA256c2e299dd872c13a725272adf420e19e0363570448442518b169b5c67a5b31f92
SHA512b21c3a350091a05371e156db7f311eefc45e30d4e5bb5d626b7f9a3b5549735376f3a8ed44bd9e8705ffa0e7fdab4a8a7f16ec912a7483312ea7bf0e8e8caca4
-
Filesize
581KB
MD50ffbc3860f94f9d5525390f5a14a68c4
SHA111a6a4c2c898bdd81d40153cf648ca547d6b51d2
SHA256d6562fc5c1f50b05a3bac71883093e33c59ea729c2009799052d962bea370536
SHA51286b3067f47addf992be6052dedded278ff149da22d981a0b5df3303bac2e94c6b6e2c5fece5f685aa0328046d0227455a37d8bd770c696c7c586a9dfe561da58
-
Filesize
581KB
MD540e1cd356c0d42bb0be1f14954d1cdb2
SHA1edfad09efa91702ec36a828ba032c7884a278c3b
SHA256c958d54e3f7acca92560ca97ef52920951f28ff08bfdb70ec04a9ecf11830dc9
SHA5125be2f5f1790305725613d5fb8496a27b94b9b07591cef3a61e86f94d5f1a68527514f227b1c8ff2bd3d3f4ebe959e7f31bef5884a096b90366203e3642c91b64
-
Filesize
581KB
MD5c66fae5ddc812e630bd9b479b223ab3a
SHA151b1743ad24dc170a4179a4a70309d8a5a64861a
SHA2565709a704201a1e4623af5de804bb421c20dfead324bba6b7fd41b17095d1c339
SHA512f7738342bea245f4f571f8d4ccd037280a3f21b5602523f21c79f2d676adf0c28e458ed0250420ae84c6227a269e205cdb4b943acc1498e046e04e87e5d0dfe3
-
Filesize
581KB
MD58f5ca925098811a2e1ab8ea71c30864d
SHA1467e6dceb75ae57e7f468293490f5777e9b5d76f
SHA2566ec322b12c1daa4f80503e65a092a60540c25c3569482e7be715b76f664507a6
SHA5123f87635fec6438186873cf304365812dc4b1513753933eb8fe7225ce0d685c86418dc84aae7da63e4fbeaccba731b5cee5618b69d5278d635038e78abff43546
-
Filesize
581KB
MD5d086b6aaed322a6a02d0739e75703603
SHA1a62c81d499c70db8d589daed0e130e173ff6d24e
SHA256845ea8c5ef717597be10702129533ffe2237cb33562bf006bfdc7db209f00503
SHA512a378f8df7ff41b8a7723aa61f71a1f21b4dee23ab82b5d95e52b49e124687152c13040ab85254bf4a04b5c16752afea7b74de445de3daf30323a1baa1031ca95
-
Filesize
581KB
MD5075a47b06f987afd9db77a251486de1d
SHA1e889de15ca20117820988a7c60c552d733c1a80e
SHA256f0deab6515a4fc2a217daeb9fe29d3d913760e068c803bd4335bbeb52ee77293
SHA51297766a3d9c30d9f665d2001a4360cc195131f5fc1437812be8cccab104705654c2817b6459bf28b047ff8a3310e07ee5503ab52287266226f769838b071efc25
-
Filesize
581KB
MD56356462108ab000af0a839ade860f833
SHA1fd1a464b3c5c1bac72dbc0d41d6ce73f1718f307
SHA256b47b89dd151a00e17c509f874f5e34865f112a16c67a135821922fe09725cdf5
SHA512815d40981b644c0e73721c29ca1a4c2996ef7405cfed65b2f77020764ac88c3993d77cb9b988da047d9acdcdf5c64e9ed8f6717d2f539eed3c719316a0dc9e6e
-
Filesize
581KB
MD586d8b8382c3c4bc23bcc8f17177877b7
SHA15aed040a60e67101fab32ee07c0250257c552853
SHA256f12818a6b8f6e0d0df9f10c96ba40534bf9fd4534ddb748f4d3baec48c07eed9
SHA51276e8d5b296778e59fbaa7545f1f87578ff1ee9d58ca81e1d0eaa45eed4282ca2d5f6092e948ca2c4a5b2fd2a88ee74b4a3d16689ff0e183e788d5878ed851e3b
-
Filesize
581KB
MD57d5f010d29ff71571818ceeede0e1ee9
SHA1abf12aeb38c4e91513515e318c773a8520b56a2a
SHA256d4f9e1471f6b70e617cadb5db5ebb9def1b46ad69b80ce300bfdd34e8bb364db
SHA512555a56aaa29dfb5fb6ac514a0240465a2b103eca2c8801fc80eb03daa39563e00306241c104a1d03d3514b7d2a52c785ce92ba8ec2af152a49f0e620fe618dd7
-
Filesize
701KB
MD53f103ef79515736f2c098efc98214521
SHA1306f8f1a0cba1139458076adb58fa2791088b611
SHA256c4b247d9fa1a6dcfa89db359cb2e3b1145cb0297ed7a8fdced5384239eab3302
SHA512463450c048c63dd10b16e997b595e2500215d540b0f819587bcbeb9e66dbb5746e21dc3578770550999fdb09da5de51491726cca5b5e888cfec65357191f1251
-
Filesize
659KB
MD51cee249ae393afc0416b86c3b3275339
SHA1699df86c9434a10d42d9d7486b8fde2e1da7ed8c
SHA2569ea15ac2ad5ae4ea1a8bdab7f93aa29389ea51e46406a9666b94b7c9f9f22918
SHA512c5c5073f371c8d8b9676cb424875d58f6104ab91e28bd7069447c5d87df5e93d8bfcd75555ea9409e8f301158d7abccb3ff6e465bb6d625256694e606909390d
-
Filesize
1.2MB
MD55a24e5a098b63d4592cb8b03ba4e9622
SHA1139dfdca3fb055e065816b8ed380c2e0f3ab69dc
SHA256ce6f694ac8db9b7e8adb500e94084cdb28195b842b09a791a83823c7a3772743
SHA5122af3ceeddc2377f3f6acb67e935561be78744408bd53aa1a8aa3c5e7741250c38538884a4243461c73d1c3f9d4340aa180bec3d5c69e47fe29b127e249d0d5e7
-
Filesize
661KB
MD58ce8482ecd0e4eec21759ca8a3238c89
SHA1b71cfa28bbaac5b9dacec82d77e97f7320dbde82
SHA256683565fe98d90b07732661fea824a8c1c1386a768549f90366139003a23a8510
SHA5127121d006727db84ec4eb392c848f03fabf383b51142293c022e011759b025f14fa796b669384429e45fd590d5880f7be5b4be92152e691951adebe84d465f319
-
Filesize
1.3MB
MD5d002ff5809ce0ae7869fbdf2d13839ef
SHA191a3e78036b54bbc13c6b56440c07adb9dd3e883
SHA256b30f0799f7dcf32b7ad3f1d427d71de0256c5f255bdb2f46ebb01d4202bc358f
SHA51270f4d3a8d9148bf9bb48f8c3ea70de6a73189bdb2b2875d30ddda9796bc8aca4766ddf19db72e0b7411782db5e4117ca7eca122695564b293567400306d50391