Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
14/05/2024, 17:36
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-14_e68c213ebf05bdde837e71079ca45eb3_ryuk.exe
Resource
win7-20231129-en
General
-
Target
2024-05-14_e68c213ebf05bdde837e71079ca45eb3_ryuk.exe
-
Size
2.2MB
-
MD5
e68c213ebf05bdde837e71079ca45eb3
-
SHA1
dee79e927b36cfee029b973e3236e7a671db6282
-
SHA256
238fe60c1631f7143579fe9f20a3e12d0546534956bda449dc3749e81e294c7f
-
SHA512
913f116e857993cd6feb68383e40c89860c4a359312236efb6d4099a5db3e672acedd2a9a1375b44aac8ac535c7976122ec53096ad42def0f9c69c726d09c265
-
SSDEEP
24576:pOObVw4TaN1wdkukCba4oXtgLhU3wEdmh58g1SwPHU8X31PfU17DhZy0lxHZ9/I:pOOh3aN4kuLbegmtGcw/3FPfUNDZ4
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 3204 alg.exe 3348 DiagnosticsHub.StandardCollector.Service.exe 3372 fxssvc.exe 3696 elevation_service.exe 2016 elevation_service.exe 1172 maintenanceservice.exe 2100 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\system32\AppVClient.exe 2024-05-14_e68c213ebf05bdde837e71079ca45eb3_ryuk.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-05-14_e68c213ebf05bdde837e71079ca45eb3_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-05-14_e68c213ebf05bdde837e71079ca45eb3_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-05-14_e68c213ebf05bdde837e71079ca45eb3_ryuk.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\6c46ca01293b476c.bin alg.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-05-14_e68c213ebf05bdde837e71079ca45eb3_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe alg.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2024-05-14_e68c213ebf05bdde837e71079ca45eb3_ryuk.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3348 DiagnosticsHub.StandardCollector.Service.exe 3348 DiagnosticsHub.StandardCollector.Service.exe 3348 DiagnosticsHub.StandardCollector.Service.exe 3348 DiagnosticsHub.StandardCollector.Service.exe 3348 DiagnosticsHub.StandardCollector.Service.exe 3348 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 656 Process not Found 656 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4008 2024-05-14_e68c213ebf05bdde837e71079ca45eb3_ryuk.exe Token: SeAuditPrivilege 3372 fxssvc.exe Token: SeDebugPrivilege 3204 alg.exe Token: SeDebugPrivilege 3204 alg.exe Token: SeDebugPrivilege 3204 alg.exe Token: SeDebugPrivilege 3348 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-14_e68c213ebf05bdde837e71079ca45eb3_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-14_e68c213ebf05bdde837e71079ca45eb3_ryuk.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4008
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3204
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3348
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:1164
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3372
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3696
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2016
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:1172
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2100
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD58158248c174536177bf570568860dbf8
SHA157ea483e63f21eb82c8016b1ef2222488586c26d
SHA256d93631db51cdebc48f5a3812756a7bd025d22b2d92e7beebfabc92cd2ec8aa4f
SHA51278bdcd72967f1888f1ea081bcbf19f440bfc1710fdac6c46aaa20c84c77bf61fe0e0f7c7d648e4c3d84d3cf42cebbb678c9cec774376ee9892b9e3fe0207422f
-
Filesize
797KB
MD5c607e42518fbf9421d0ced9f2fb275d7
SHA126139bdef89fcac602f9a5374a69aaf578243bb8
SHA256924c6c13b683c961eb3abc5330d42794704a0b90ea48419f363860c5abceec17
SHA512ef2f50fbe8f89bb378279d6a357f3fe255c7109a86a5739e568759cc52527bd709c3ea8697b79d75ee352074924a4e004354f3b3f6ffbbb082b1d68de0709064
-
Filesize
1.1MB
MD57296c7929f6f326c2e68d3deb5a283c4
SHA1d4d63ab2c0fb36bf31e9c15cccd6352d59a07d57
SHA256f48d4f46cad6f662b39006ef97cf2ada511760a2149cc1a754e97986faff1c4f
SHA512052467b49955982438241365fc758a6dcfeb2f3c404c66165fb5b304c8701509c42f4e2f0173c444fa73aba871c51624a668f9331cc718dfe69bafceb9434ed2
-
Filesize
1.5MB
MD51782678f0f86d12ba93ca44ee7bab1c5
SHA10cec1a4d3a73f8b7c186b1867f91fb5ffb82ceac
SHA256f942ff1f17c89f3bad9a258c968f79e5af1d094f613e994ee536aeea7b449804
SHA5120feea4eef342a6b46feba9e9d3c76bde56208a6521623ce5a13f2ae21503b1e75bacc61e81142c600bd8a5e2429f480a48b33ca93726130d84a323ec073f409b
-
Filesize
1.2MB
MD53a3c7fd6bdc24dd4419a4329eda46749
SHA1fa8f62f25dc389ad5e765316bb62142772828fac
SHA25683831bf082b73b9e7cded874861f8f090e6c531b876cc175e1bfd3827fd61bac
SHA5129546459a3ed1a8691e1ef906dccfb31f9cfafba5345ea786991cf4d208de0b2208c30a671d389af005cfc1e77c7aa552aa65c7192452930f35bf5ff73860b197
-
Filesize
582KB
MD58453931e44df287b75e36a55c4bff50b
SHA19e256fc22368dcbe5849f0da28a52207892c7f19
SHA256296629a573878fe4288477ec49a26f584280bd1fd6ac1bd8f51117238d3b78a9
SHA51282fd2c9524b0e29458dda3ee5eb4c0c238026553e07807d1c6306e3467704e3489ae5ca990707f49d45bb3614f7624ae0464c6e27a751b62fad9deba1beed63e
-
Filesize
840KB
MD5d04c11f35e18de4d7c17eba1298d99c6
SHA10d93b4ab0cf721f520f8ecd3bc0543565e6da349
SHA25655cfede8f975d3e82749f2a385c59ec2cc26cc1f35c5944dd53e818801187580
SHA5122c56b3ed71764bc1442058780ba2ffa22e21d018eb7cba85dacd2c39ee69aa9a98a2e30db8d1e1ea42541f3bef3d8a2b46ea238494a885f8b44e45f5452f050b
-
Filesize
4.6MB
MD553eca4a95d8fa3e231690efc40af735a
SHA1999b39fcf119a4a11de50e17e0571eedbc9f06fc
SHA256f3fce1cb9443859d918c82f0b68c1ff0f5d6121e9c707200ad1c89e21ec9078a
SHA5129ca271d51e719a98f8b964065e65215916b011bf1be60de299459e860be0dfdfb781c42e6e66516a5d2c54e9a81412356975c726e7257bdbb72c55872d4f3451
-
Filesize
910KB
MD5bdb50fc2fa212d87a5a75517394014a7
SHA1008f3daf88ebdd77f6bb2bba2164ea18705b5f94
SHA2561eb6624c98892e28a3a55e9971930af8d4c76cfaf9d0de3c823ebc43a2f2187c
SHA5126c439c1984e5ed499fe56fbabcaee6c439c9db66247ed192f1e36cc060deabc419780f51d4c193be6d9fef57be658e8a389aca3b955f1de9dde403098c5d67b9
-
Filesize
24.0MB
MD5cfac249506f99d626ac5e7bc465bb559
SHA145f325c71741e8df726209d98ecce7e0cd265f53
SHA256f35ddfb91dc85a2592d81b55815694f38158b9e52f6d8a48c1a45b97b5f560d7
SHA512c7799ddcfa71fbc595572be57fdf3718c8929aea5c01f4eb5eb314e6905b2854d0f4345017f373de6a60e5ed3089860a776a58c6fb24652708bcd323935a0b01
-
Filesize
2.7MB
MD5add08fa251896fea700708b5f22c727b
SHA1f2d1913d231f548924643d8646c4bcae80d79903
SHA2562e842d0b96a08a8179a7aa4042167e0d9d9aedd21f20b9d6125d52ef4dadeed4
SHA512d05b21c015528afc5721af8c1dc20b91be50b5eadf5e620d97a76a335dddc55f01101f5b8513f780403cf30ef5c2b54cbd7bd92081262de7524a0dd98933f560
-
Filesize
1.1MB
MD5a12075d826151cdcb66fc607fc07a95a
SHA10d19b96b95989f5d503b83be6fc12b45e2fd746b
SHA2561a54374ed315d5e8756565edd1934066ec7a7e4089b2572c908c5e0ffe4ac082
SHA512ccdd37c52cd0cc70ed1aa05a899b7cef908a5cff1a1d13e4f81994a7a9618096f640ff8df96123f59288de668648fd1ef15e6a88347b2b142575b8d1d0bc1070
-
Filesize
805KB
MD5adfe582dfae412bf3393de3d14a1053c
SHA15e887c586df7b9f8d6cb8b722a0f96c781a8437b
SHA256c3cf5b7bdda4b4a628d581e6b9a2a9cee95dd090148c0181d160dadc12df1d66
SHA5121acb01abb94b6d5c57792b694f35f07966d3fb80a202d32a7b3b0ce518255a531a142b1ba78d6ff971dc77a4cfaa72ec6a7c4cf1616e75fad858f6f6ff9fb064
-
Filesize
656KB
MD518ada1d47fb3669dfd76494dabb1ce3e
SHA12c96883f59812fb20966f1dcdd5f8bdaefa491df
SHA2565d847bcb5a3bb67554f7edea959cc7d222e7d86577b80bfd0d8084bd53700efc
SHA512a0b3ba33c2974a4583c0532229f17ff75d4a229178f6da5150823b05395565bb153e1758c30308e937cd87009c8c9438246778905bbf379efd60825a91e45eec
-
Filesize
5.4MB
MD5081e7c4e877b9961b6a45da207de6f21
SHA1a15e9ac840a384395685b99e0ca5b7f0daf03678
SHA256f4510b590880fbd52d47157a678ec420159a020f763d3316291b86ecc3916192
SHA512ddc980683f41dc0a796c336718bac00da54081a1665d8cc51bbb5e41e53c14fb4cd2126d03b85b0384780417c190b45fa893ac8c2c911d06c521b6825aee57c1
-
Filesize
5.4MB
MD5983ca856b3b862f6c2c978cdd588de53
SHA11e093654703e238074821995dfd306bf67ebecbd
SHA2568d06a0bcc12fdf50e573736e0c420f29fa62a743eed0d0cbcdc2542241376cea
SHA512b2dcaedfb7d29363d5bb1a19a745f46f9704a9f16f7213e221c14fa8324e36a408603265c7c3b33810906cf6b3f4def53e10c7b8cd33de84303ac1c73b970de4
-
Filesize
2.0MB
MD5c7c56eb10a5ddf549f18e63084dea11c
SHA1a2692153cd5d6e21acac3960e374b0458174908b
SHA2566275c2463fe6dded3ee499d00cc58cf90711108991e6cb65c5973f4fb07f8164
SHA512cae71c32728ef3038b540a680405445ce6f6fd7ff2512f325c44918137f0a2b958348c6f0c5c358fabbf3f4081607662c473178ee50634d67a7b5709d3ae96bd
-
Filesize
2.2MB
MD5e973f5cc9b785e6c847cb5c793afc378
SHA16be58bbb0c4a39e9e8c2081e9cb6e6565981027e
SHA256aaf9554d0c0c571e5fc921c74f4c9dce09500954aaa17d9ca7685c088713e2d0
SHA512438af42dee9a2d3d6bae3daa282e8f1921b41c9fad91e76b1bd7001928cb5a3b9ad9e997a399544e91c27992a077bc8034a9adce183ff5d4bcb69327df964911
-
Filesize
1.8MB
MD519628df45448877f53ac356349387bae
SHA1af571d490e4548dffd2eab2e8b95f95e762557dc
SHA2568173c46955b20fe93449826f9bad6293d62d9429e77c45e7c3f4b623a6dece56
SHA512679e3e7c1cad0b5bb2eddce77188e5ff7d64e7ed57ba1324e2e5bd9b21a7797d7f38ba910356aa93293195e1d293cea64ca14c548fef3351c2b289f3fb4950da
-
Filesize
1.7MB
MD53388ae319eed9f27cd45908ac2991353
SHA1879e2fa077d753ac73a08b2a97e62091a8ac15f2
SHA2567d7e85dda42bcb89b834b8412e5697a1b8403e36098aa577de0c13908aeb9695
SHA5124b4e85e51dff6bbc7ef13d2eaecf73b70617def83e1d5095d8348c02f63d769b757c659f2f77a5fbe2f1db193ba903039caa386ced73c87c06e2b27934e2e501
-
Filesize
581KB
MD5167353f530a5d82b4969e13c81787540
SHA12cb3ba9d11163636f39b1ec1cef45b680f2f798b
SHA2568e84a4af9e3621cb9519c8620565a8dc3c5a5d7e033de3e3dfea96628e5ecadc
SHA5126a3f0962828da2a774aeeb5ace84e0c68e57e4c2e95467c349f621cfff9a8f5395a288c578a7e3189c66606f145fcce0fa7e96194882dd3cb81c0fd58db28273
-
Filesize
581KB
MD5a6063a3cf9e2defbd9529518091edb36
SHA168bdd93aa292ff7f1355cc74999f7928502c811b
SHA25623c04b7ab2a0384e00a167c32ce878649d736cebc1770d54de033e36c1689888
SHA512ac7c19d50780ffba3ff1d2514906dbddc229189ac573199ebdc1faa3dec07bcb4739d14c5a1cfdf46ebaf0061a72fa7fc091182fb701af2ceeeee500c98c31c5
-
Filesize
581KB
MD5f45e7e5525fc559a93f1503da928ae1e
SHA1853a3818fc494a2f04816c0e0e2eee20b61f3b52
SHA2569562b3ef665d720b2eca13f04f1e73c7d5a52c3fc2c012ace0d8aa090df271e5
SHA512faf4d3352d2cf8fcc6bb343b3663785bb25c0df8b69ed3b27cfcc934199ec5357337f3c36bacb8dceb83a12cb234b0ad429d9b728d0900b0b0a6faffad24850d
-
Filesize
601KB
MD5942fe906867a2e143e5e4fb81bbec328
SHA1e85fefb9475e35a53f8fb3dbb5573dec77fe48e1
SHA256609ea67420ad53b6e570b5de37f46e1c76262904bc8669532a6126e78938af4f
SHA5127e8c21982f04e8d5f729bcd2b6d49e22c802d4ed33f014040808752ede83db8a4825d38073aa1180ba09fc2119022fd6aa9d0f45f080a046b08f37bdac64523f
-
Filesize
581KB
MD5952d0c4317612c933e72e0f168c9b6d5
SHA143173babe0194c1eeebb4ca2cd07c90d55550c2d
SHA2566f041dabeab3ebdbf58311049264aa4a9ca9840a2420dca9f6807550bd29628b
SHA512703c15a86cb1ca8377daa2ef87b28f5c314d178fcef0b57cdf5fea9c727452ffaf7bd0b0470275964d0f41d5de1e0f7d8b3c2fc8d2146e222f727ec84d5898b4
-
Filesize
581KB
MD5dcfd90bf5c3c6a01422e79d82174fba6
SHA14778609aedad522d539938163e89bbab7632fae4
SHA256bc658481f58e05a11283818bd18e2d4faaca1e543effc50b1a32b98bd31d512f
SHA512134d78c0aad08640024fa80c8e17b1fcdc77e65fa70bdfe51981fe7e521c76619ced2564c60212e69be82000118b7f4a72085ada7279d75e20bf13762e25fe80
-
Filesize
581KB
MD58aa42b8810344ff11ad418da69bbebf1
SHA1e44fe718ec8e15845f798a842497b0a35c353b12
SHA256599c9c813a7e56b45551cddf38aee601a0538fbbb002dc8a64e27b6306621e4e
SHA512782dcd521119bb1f9ea301dc6b40d6f5deb338a8822bc9ef6efdc5f962195487b475ed667563b8d44ad7b22963c3e9690cd7591fe5e01419059282beca6a482b
-
Filesize
841KB
MD53b39a48ea23589e72bc2941bb34fb334
SHA16e4f678af447df18dc25a3a8e6545106cbf8d638
SHA2567ac173340a7832cf2e28b51a5ce94d333acc0cc00a6c9089f801555015497936
SHA512d9e6d6ae01cccb44cd8720063176f4a25d4991e32f487fdf77a69c7120fa02ad79baa6403e9d011860e5055a1daf99e0fd11cbade27d3d9c84699a617edb9e82
-
Filesize
581KB
MD5d26eeb7d2aba65e20299a5cf44113db3
SHA11b6c83c00aba86497b3755ea8e8ab4d4430e61aa
SHA256896b706855ed72d21113f94d851bd16a886dae26d5d5be1d53bbe71eb376750e
SHA5124a361937ea2fc03c5a65ce61ab6f1307ee1a7f685b47d6a7c7a023bc4db2267ede14ed69d4acfe635da515ac778d39a2e7e8385cc03121c643841e8e00c4040e
-
Filesize
581KB
MD54df2659304070fbff12c3d2002e887fb
SHA1bcfc84dfe9f5d01b64ca23357096f55d5f5ffb15
SHA25637110c12ae98cbf66b6a1951abd8bde36942e1779c67c37d6a85736a50b12ba5
SHA51291a2da5cffbe2aaf7258d032130541517cbf0ca684738755939773de6ac59820ed3cfbe961bc7f1ec10c6f66ba856f4fbbe2ab04e97b6fdca34352bbb6da3568
-
Filesize
717KB
MD53c4856db92865795602eda3c7111b796
SHA1e59b74685e091a695493f2da126fd7ecd5f1091e
SHA256520a4773141185c2db275341c754f7e19b5c616265488d382b5cd0d9f84c197d
SHA51248a9837758683b8153717cba6efdd4a97bf3726e84867a297ed68b37307ace9af2ff7b9b942d5dbfbc37e1eec911c29976fab067f177f55686a6a786642658f9
-
Filesize
581KB
MD5a92fe5657c4c6fa0adcfc90234ad50a3
SHA13fae2f3d1370dad65cca7cdf19d5e51d0cd36055
SHA2565caa744bb3beff160b48f8ad4785b4943d9d10c56bdf13d5ba3d1178b89ef124
SHA512602192c7a5c12540f9c963eed29697adb99e6f5f1de5912f27ccc32f9ae0225e9b472175f262707e33db3efd890a011c0a6f34305fae2d670550a30409eae802
-
Filesize
581KB
MD515565bcfa7fc2203a69533bddd7511f1
SHA12dd9b65bd61396e949c1d3d7f7920020bd1d8dc8
SHA256dc1e7eab9a153baed2e1edc8712961c862a2e4d938cbb5cb69c5efdad1e1edae
SHA5127b24f37eb593db3e0fb7c7c01688a0db1ac3cd1024dd475be0ffbe1a5bce50b27fbc1af1642bb41beb5a63602cb5a0ece3d1b477ff1e5762404e8032f614b91f
-
Filesize
717KB
MD5695934ae8216ad6fdf35d04be703a4c2
SHA14fdcf9f7449b1ac1d50f4dc889af29a82ddac69a
SHA25609f81427773dabba448fd474e33e48ad77d71a225f41a66ccd4ee3fbf18d81bd
SHA512c12850ec60e7230041673ed69e9888160b11ed60537a49245f50119d7b4ed1bbe06343afe2bc1c31bd23c48800248adc031c50527408f178b1e6ad7b66e184a4
-
Filesize
841KB
MD5a5405c434d1c22ae74c0670e71a8b497
SHA1cbf39cd52fba8ef84cc007d9badc1326f24a24eb
SHA25699797be7b2d6e356876a450ac5d682fd472812fe45b3b8483999c3de541f1790
SHA512beb1c6d2a90a34ecd44119d6604b7f441cc4b7bc97083997c939d1ad6282e02f753f355ea5dc8781535341890192faeae332dc4a575dc6fe119fe890a77a1a69
-
Filesize
1020KB
MD5960fc89e877729eb34f578e084080665
SHA1934e9c36a65853233f79bd0a6029515ab9b4cb93
SHA256365efe56446bdc05bdc418b4c2401da7bd4ca4747ca9af96cbe7d0041e297c58
SHA512a3de0499536cda0d95c1cd44c6f945dbd94b0afa44712f269cff2e08c8eab24517726cd79f79fb4b039a0fd771c3bd4cbb3a95ecb443bc79131be6ef931400d0
-
Filesize
581KB
MD5581b4ac3a21cbb9298c0356bd61b7faf
SHA1b2ed8a1f54ea136bcb5234268bd1eea32aaf220d
SHA256d863f0ae9843c2c98ca988cb1801bec0ba441f4ba5d110991d44faf9faa4720e
SHA5128ef0542604ef457bbb4ab4bd776f5c94bb67750df8bc4e2b56ca2a59b70d4f48783d2af0620fdd0d7b79e9660ba2df205959f28be53054c96789e60a337a7e20
-
Filesize
581KB
MD56cc93e2bbba0559c79b5aaed2ae67f0f
SHA1deaf8633469241ef6326371d86c4d6b621f02a45
SHA256229e3091d11844757765c13387fbb427d8954909df02cb756c64eb92cd788734
SHA512f44c09eca288b652f0514cf860f274253dcef37773766872997affd1e217a1b0bb9c21d8ebd8ae719bbdb0b197f21d9475d5c9fd836330a08801fabdde51a4aa
-
Filesize
581KB
MD5dfd55cc70e666c60b5459db852b9d330
SHA1ca218ba302bab497687ea3dfcb7210164cab8136
SHA25696058ed2c4a8762fc0eae56759449d9cb3aff2cbf1d875ab6dc07237dcbbf953
SHA5127f8f5e993e1d0fcfde0d23d6a2a4ea0ddd9117175150f6c5a72308f854d83a691884fd2c7e8b74c4066922acd87d181470bbfd9c47bae67559724d7b8dc61a0e
-
Filesize
581KB
MD51f0f1b7e33bc7dd508d8167db838205e
SHA103185521743ff8b37d5e58832f44030dedc6c32a
SHA2568300776b08b3486f705399a9135286eac22f30c9883285fc1522caeb3416d94c
SHA512d11cf7d2ab9b3f4cd1ad0cb515f07f8ff22f69d9c35b26dfaee463864723fdad25e5e8d169804cba83764301be8a4457baf9032f262273033d31c1f7c932c45d
-
Filesize
581KB
MD56041131b943c5e39edbd3f8ea2f2e058
SHA10cd1747e7a62dc4e4229a0ce40f67091d0c28994
SHA256cec88e06cca178a58eb354b31d1dc15d233f727fceaa783ed49490ed15d8713e
SHA5121a5ce0d596be98aa5a824a6cfd0f0b29ee8f2878d0142d4d725c2c53126a380345977a0c8a521eeddc4e6eb394853dff63e40ba3a197509a5f4f6e1e040b35e6
-
Filesize
581KB
MD589a9de6492978bf2f0dbcd98ae5cb5ea
SHA144d217c8f396f78feb7f962375822e9d7b96c958
SHA256001b6ae80f913930789ed72176440ebebc8da7513f505f895fdd82a1b50dd17b
SHA51275ecabdff185f6fe05d34356835248120746b579835970c3ce917adbe6059bbf80e1e4c9dfdb209c766ca0a9f9c74b50e4627ef75395fac9af76e9e6971fa908
-
Filesize
581KB
MD5a0651c2c19b4936429c1e63d63470b22
SHA15ba9d7c06e488c303607dd77476ec5dad88a7ab8
SHA256aacc1cf55465876a863b9e35fd0b113b1f178acb876262635e19745dd1b71a3a
SHA5127fa31846dc76a267fe47b3a93af59c3ea4ef041ba395b2c4036b0ec8db1c30b7c9de06053ceffd1000ef9b8006e71354b35e61283e37fac2f45c4add73a11627
-
Filesize
581KB
MD58a4e890c042ab8f602839c414790424a
SHA14a0f5b445a48368851d6ae3ca6c1d27aa99a868f
SHA2562e1da61d4e4e74d002315f3c39c84d1d304b5880ce295dd9eef3bb6129cb726f
SHA512c40fecf3173cee54a8a19f8ba54de27026654fd181f6ce2bd46f0e24c343fc032abc79dca87ab39e1f35fad5e61c83102b4a5b319939bb30f34e95feda6afafa
-
Filesize
581KB
MD54fd6e6ad128657ba2b71e32d0d2c196e
SHA14ce4a737c0af2da0c59328271affbad5b4d93825
SHA256f9ff29e2babea0a95bab1807092508cf80f5ec0371ebdd7de492f71dbff465ff
SHA512de25a25713b09a1e14aee11567db7f3246d2ede2567af0228ede89b23e66e16b4d643bb72e1b21a3e868ac4bad5c6ad477e0ec35b4495e03e249a200251043cd
-
Filesize
581KB
MD5de1968572d69b4e7fa7456a1dd990a17
SHA14b3a0e25acb1b1f2c82d7867a0c6a615db1651a6
SHA256390575dfbb62f152a60cf9bd8a03b4c941e412d50d365c655ae4e13719d2eaa1
SHA5126c6411fd02e0e04a5536bb32d2047cf23e848299a332f03e32f7e6ce54ea13e0cad664b7d784fddfbb2900227ec05be30859a1bdbc4b248aa82ca3d257b54e4f
-
Filesize
581KB
MD5ef1dd08cad72029a0289499a6efb533a
SHA146b2a45dc2bf20f9a7540d5356b51e0941c84360
SHA256c5ccd4fb28a81a66af82f735d614420e3c675981b7819533d6ae2a5984cb1568
SHA5123e4f9ff7af3afba0e3ee3df406a8a93e5139dc989cb5c0dd064026f6cb29686ab3175891c40419bc6c2a9e5f62f9789c0110b4559d6871e862b8190a9bbefbb1
-
Filesize
581KB
MD51a6b1786785f8eabb47cc59ef007a245
SHA14ac365f74165a725ecb417665ff448988d72ec36
SHA256157b2b0ecedaa22c9f50bbf7a291fac5839d27083793200b33990b7e5b809266
SHA5127172cdfd5ca9e1951f0b878b5b45af8514f96bc350e3c79185d4bc5ddbe0ce28c9f8fd099a04f85b07185dc88132ef0ac1610543e27a58373091a179a756c308
-
Filesize
581KB
MD5e905bf5f95fafd10a931268f03cbb4fc
SHA14790aa2b511b435df0fe44441035c05cdd6bf52c
SHA256dee9d782f4e16a2e8a0840a7ba69d071f159e1734b200ae66f44fdb6eca4a40c
SHA51214c5bec2c99cdbe346c7c6f1fd37b2bdced45abb45a837bf5c1b205b1b14bfb6e94d710bebb3b8dad200c4cadb617f429af78a6f82832a7c65002f569aaf9347
-
Filesize
581KB
MD5d565ace41dfa5ca740129408768c3aad
SHA1773968eee45c831d764c134b2d3a6da5c909f2fc
SHA2569dcdcdba2d709f67986153304f3832b2121c7a15956bd670901f4de2b62a4f9f
SHA5122bacccf3c8308c7f3ec7f78a6dfa008243cd8e3a4ec9fc016ae41d0b48cb6dc7ad23b6d4598b036d15084f8075f8a288b54ad0166950a405a96884ec74baca89
-
Filesize
581KB
MD5590ccf80bc8515580351d43ac285f21e
SHA1a26e8378e9741fdbc36cdd3715c239337e2777cc
SHA256544747139d4cc524a9c0fe0f67cfd2769804345140b49ec2ea7d53cd4108f320
SHA5127a9f57ff053f31ab13e8ef6c710e87ee11a1f40e1522ab62b9d39a483ddd1bea0d9416d66946a4ee0ba883cd301ea58ff685408781d396d4954604ca14267266
-
Filesize
581KB
MD5debe81b47b958957d6b4670a6354ffbf
SHA10a05546bedfe86e0770e54b8d7eed2998e444d24
SHA2565a596662805a05c6cd81f422268923b411a7ad88d941e1f4e2c0dce371f62eec
SHA512ec2b6da581b2f0ba53f4a24966deccec9e07ee0a0b5fc5929e02fe36fee5043e2cceee7c38e9c5bf45c6a1854563c8187558a60ff714d32fa8d28fdb6b5c1054
-
Filesize
581KB
MD5645577afe43efc8933a9eb7f6d03e655
SHA15b72fef34b8aa603c7d71f6fcf076efc40c0db24
SHA2564f22114f5998ca4ff93e35f48cd30ed17625a9b792ec2dfa2a712a56059235ab
SHA51253bfef4e6d134d7eb86caab30ae1bf236b8eafeb1765a98f008f3f519f89059cb0a7a49aca2f70818ccd95707d63a564be271ff98fb18a29d88333fb6224ea34
-
Filesize
581KB
MD5b82d536b371e423665ba90f70215e859
SHA144ca49300329cf42e0b1069048bad5bde74568ca
SHA2566ec09854f2701872f4d78d0ddc980058030855e97fa53256b09c881591d83344
SHA51290b0de06d5445676d77a5351b4aafa8d3320916db12aad57cdee0ac26a77f75ca8c74ea9509c4df91ec7282951374fc5ef0029d6dd1d68e8b511c1ff3b7273f6
-
Filesize
581KB
MD56822cb614d249708ca7547d21662aa20
SHA1540e9bacf57df427aa532d82d9c3b6bbbe44f1a1
SHA256a492f1db0f2663738f468e199542589abe3ede3bb693f0ae0c05c1d1d637af16
SHA512358f485dceee2bb83c04969f393b9aee82165f3c5ca8032a0de66b50dccaf9eee63fa73714976fb505411956f6df1da50d4b18e56dda261ae5c91880da204dc2
-
Filesize
581KB
MD5c09e6c7bade0ef642bdf69fb87603e89
SHA1eda6a9c4ddf9c9aa95e6a09c5ff4b30bc26984cc
SHA25682e6f3308c0add1ea7b815db4c845498ee30e9e6e42736c7c3459e9368c7b77b
SHA5124c6e929d2af21cb6a7eae221b9343b6ad1e82a3f592b3414bfd62b0fa024f6d27a8deaa2b45769d99e26d428a7d9dac610520ea1963a554773c13923b922afbb
-
Filesize
581KB
MD5baa7dfd4393b73c3768ea74caaf8a8e3
SHA14797add4440d2a02b3def74f710e17883db1796d
SHA2568e49997548e566466f874f656f1473d6a6c343f20fbcd45ec947ff5aeed46544
SHA5121153e6ef1b30ae6cc8477273c146c9db1bc3b53083eff71e543741aca0ebc6edf5c36519b0d8bdb631f36bd047dfe92ec3581c21f2aac263284086c64011ea8f
-
Filesize
701KB
MD5365c33252173834259de6faf7fcc7e6e
SHA11790c46cdd976114353f3788cc39862aaa1f5b8e
SHA25690c99c7435a69a596d47720e72def4d4b707a52226dfcd186a5b79f0e2e7844e
SHA512b0e8905fe8861895aa567dba93dec76b55fd23f358aabd6a5d13fe499bb6c2a3e0bc032ca3bf90db4a58f0f95e9bb9163a79281bfd285e3d67ee891db0f02533
-
Filesize
659KB
MD547a3f9a6caa77d12af75882089fd530e
SHA1c40f49e863c5544d43118e3d75b6ba2755d13e66
SHA2562cb69f223db02067165b8d52a677528f635864039d64e7bb3baa1c80024b0945
SHA5120aa7c60567019ec01993d49f3514bc45d825fce98f80f985a2ce9fe32fef14c8a436ae5864d42ceacc132d93e6d7a0a96e17915435fefe91bb31d672b5400b98
-
Filesize
1.2MB
MD5e5f3b15e4611ed2c9ce76cc4db2d4d4a
SHA1d5898d354fa3aab22c92d46a43e802f2c4609b9e
SHA2566fd13784720ef5df0e368c30050f8a6dd47e2e78db7ef9dd16215bfb55ab711d
SHA512efe2139c68b2d785b1c7f986128a1f0ee62da2e9e40c710c32ae44acefb50fff1fb84575dd40858f5c47ec09414aab6b3980a7aafb72ce28c075c4eb3d970426
-
Filesize
661KB
MD5abcf5d2c291fbb676bbf344fdb4888ff
SHA14cb2defe24e97cbed593a3dae9f0699c3ac83c18
SHA256b6d6875897fcf600bce9c9066383b7fc1db25f0a7dad986da3011227391a9713
SHA512423d72a1e70702c218094249dc06666459556f179639a6583c19a2fdb54bc618b62b70293d8bade6179aeb7cdce440d15b577aaf35a2a5311ba37b2f2579ac11
-
Filesize
1.3MB
MD5c3ceee9de36c0aacd1dff339bcdc4d23
SHA11a5afdc26ca415c5e54fb0f0fa1bba9598e1c47a
SHA2560444bf9d6f778a67c478aa8413bfb215ee574f805e44c48e6c58e4ee394c8bdf
SHA5123cd295c62107e3a341189addfd764b6bc53cc2ae33dc1a05acdfa57f3f86de740e468f19ae8d39799c271945f51432e32b516c0c8588fd97137b84b0df88db6f