Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
25/05/2024, 23:26
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-25_aecf96f3e89c15eb1623ff87bf517cd8_ryuk.exe
Resource
win7-20240508-en
General
-
Target
2024-05-25_aecf96f3e89c15eb1623ff87bf517cd8_ryuk.exe
-
Size
2.2MB
-
MD5
aecf96f3e89c15eb1623ff87bf517cd8
-
SHA1
a34bfdd51c87da38b61e8c0a6aa2eeac660d2699
-
SHA256
f271f849c2483c5884e943550f66c822db0602cf13d6f46103775aa735e608e9
-
SHA512
447c3d3e0e06d6df2fdfa6df4becdad1b85ff84f81beeeccb3703e5364d51b13297ca4a9033a7b6ffe6b2f6ec73fa6a496fe890ea74397cf0c2f7fc50b87380d
-
SSDEEP
24576:BOObVw4TaN1wdkukCba4oXtgLhU3wEdmh58ft/sBlDqgZQd6XKtiMJYiPU:BOOh3aN4kuLbegmtGW/snji6attJM
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 3060 alg.exe 5040 DiagnosticsHub.StandardCollector.Service.exe 1464 fxssvc.exe 1972 elevation_service.exe 1976 elevation_service.exe 4456 maintenanceservice.exe 4300 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\system32\fxssvc.exe 2024-05-25_aecf96f3e89c15eb1623ff87bf517cd8_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-05-25_aecf96f3e89c15eb1623ff87bf517cd8_ryuk.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\4b1d5060bb5459c0.bin alg.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-05-25_aecf96f3e89c15eb1623ff87bf517cd8_ryuk.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-05-25_aecf96f3e89c15eb1623ff87bf517cd8_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-05-25_aecf96f3e89c15eb1623ff87bf517cd8_ryuk.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_97390\java.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log maintenanceservice.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files\7-Zip\7z.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2024-05-25_aecf96f3e89c15eb1623ff87bf517cd8_ryuk.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 5040 DiagnosticsHub.StandardCollector.Service.exe 5040 DiagnosticsHub.StandardCollector.Service.exe 5040 DiagnosticsHub.StandardCollector.Service.exe 5040 DiagnosticsHub.StandardCollector.Service.exe 5040 DiagnosticsHub.StandardCollector.Service.exe 5040 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 660 Process not Found 660 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 736 2024-05-25_aecf96f3e89c15eb1623ff87bf517cd8_ryuk.exe Token: SeAuditPrivilege 1464 fxssvc.exe Token: SeDebugPrivilege 3060 alg.exe Token: SeDebugPrivilege 3060 alg.exe Token: SeDebugPrivilege 3060 alg.exe Token: SeDebugPrivilege 5040 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_aecf96f3e89c15eb1623ff87bf517cd8_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-25_aecf96f3e89c15eb1623ff87bf517cd8_ryuk.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:736
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3060
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5040
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:3092
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1464
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1972
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1976
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4456
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4300
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD583097f5c29297b3320ca608eab81291d
SHA1a6a891455c9e10a674f7854658031270d7eb2858
SHA256021bb8916a09d126797cad60f48c548de5c5bc02a3980b0e174f48f5a5ed7052
SHA512e02f72a788e9c4d0598f99a7a91384ebd4f3666cc8f7c52bbc0e266665ea3f67e8cee38c5025e00efccbae5943e8353bd4437f3a01f809d463420535be52c47d
-
Filesize
797KB
MD5a72b5d2f83935ddff1efcddae249964c
SHA14b4492636d3c627565abfcbe33a8b388249449bb
SHA256685fe5101b6b6a3b1338a7dc6306805288d5212e5ad96284e043094ac978e06d
SHA512f529662e6309b4542e72623536b7aa385c697a2374e02d5864a4b01f0a605e2eca4cec1164c540a353a82d942a73e11967db9d9768d8c35440ec77c909a6b2b1
-
Filesize
1.1MB
MD549b54c67f9f13d9da9cd1ea816fba0fd
SHA1827b636e2d8686d85305ca2ececc694971fb667d
SHA2565d8cb80a694a0424f03e29818500b9a9211cb0a5dfd5fde2a9f642af1bb0b917
SHA51230b2a907443765800b477bf1b95db8c02fcc0422b4db916171b988c82690ce28c2c2301ff7df3292bf12bba354f3ba26166be2cea8155425e5b08adf2b4e9ac1
-
Filesize
1.5MB
MD5f0a250057f6896a6fac703f91e5b36de
SHA17eac2812c2f002b5b2f3e7730051e30f726f1316
SHA25671abf600694d03bbe441ee121fbcbffd6a8d4ce5532b9b30e46702ba255b937a
SHA5122dd1910323bcc743669ffb60a9467921bbab1cb70a1f231217881710970cfef243c808a53a7fa3df84fa450e14058a4043d3080fe98a52585d9aa5eded24cd21
-
Filesize
1.2MB
MD5065c7956d7a5698d38edacfdfb2f6afd
SHA1d3f82f84a7cc087c93e5f153e6cb357dec767f57
SHA256f1b8606edbedc6de5f582c93209c0fca24b3b484fbebd6dab0659013e5539f19
SHA5129ce996a43baaa04557b06aaca4454c694aceb378267bd917211323a286ed62b9178a28a8b5c3bfdf0c7a8873837a0291814a773225e54b0741a2f73541bec335
-
Filesize
582KB
MD5e10a363ef499617eb6f7ad1749471cf6
SHA139acf18dc18896ef303a5fad5bb4482c125b1456
SHA256e11e223cd53773d73cb64308525773e784814d374c65925e065b397228408fab
SHA51232f045772da0353b742a5424031cc07c898afa176c0852d56084f201db5ed5450e7866ec21508d4e88c5582dac02877c62e93e7d84a904c2698cfbf5d026ebe2
-
Filesize
840KB
MD5a3f22085d38b6e5d97a99ddf347dc8ae
SHA1f1989083a5d6317c54cd1d2b9e53c133e23b6b7e
SHA2567d7e79ca9bcc3901d52b6490215335102c5b304a9c9ac34a4bef051230baf674
SHA512563896c85e5597e48ae00c81eefcd60edcc6c95623a92db5209e1e6b4834b4ca4b156b8c86a08e90c9aa3829fb522a3ef1b26a7a629e02935aa0c52107260e4e
-
Filesize
4.6MB
MD571e1050dd6b7c5ebae9789757957e319
SHA118b5f2dd484d35df61f39eb59fb3c38b3f4e338c
SHA2569dd06be5e600b6fc6ee2ad89b95d23eda6ae8b26c1a235a9f92ccb4d1ba389b1
SHA51218230e16cb6f81cc86d4d2f829a2a08461c35fb89f59e79caddc2b2c2b5f00e22c0077969785efb037c7cd2e06572e8432b92d8ac25a1832fba5e63792d2e782
-
Filesize
910KB
MD56bf0e11bc58a67d5c1f9c9f986a67448
SHA15e35db477e5d5b8241a56ee15f1808873823ddf7
SHA256e6987436f7ec58ee780ac3fcc876ef4ba28c032fe9076f559ef0dc5cd9cc6a98
SHA5127faaa1c334b1e12102f08cc6f5e5c3757e578aaaf81ed3f845e2cd56edfd8fbf213b9de14cbf52d414550a387338adcc27a1b571f675163f63bd2e7df3ff873d
-
Filesize
24.0MB
MD56844e3af2413256143192e6f98d225de
SHA1adbcb68f9f4ca939a8fb71e57f9d632ae0c36900
SHA2562e084417eb18a05dc271a390e3178ac5b05683f57e0052159cf1dc63715646c7
SHA512b3c99f3840cb07a3e926bdb0517afd82543b0421e12bdac0299a549883e686b4788193e5053cb805b74f1cb4081c2b4015fc4cea168b92c08a220d6634a7d4de
-
Filesize
2.7MB
MD5d4e3e78517b205f4a6e38e22f498a27d
SHA10e305b7fbede90b5cf14c13a4fd0b7d17d7f5db2
SHA2561bfa839e73ca247141a932cd36e16b68920f056723b24536bd59bd5a2f1ca1aa
SHA512eea4269803a644651537d07dc32c78583ffd19b1a9ae7e15c881255adb7ceeb7ecbbe7faead79ccba54304251faccdbd82e7881d5254e1d84bdaa0b55d90fce8
-
Filesize
1.1MB
MD5c6c5f0f144827b42765b55b65285c8f1
SHA1dfa2784a710a0cacbbd3be6d4627e31a34e4d5de
SHA256c494c4cf038159c31a1e056806731fa3ad80688d7a3b99512a64601b33da8c6b
SHA5128ce9e89c33738465ef74c887ecc912943f221d640f44d97c4096bde7c2dc1ff3c9dc1a9ad0432e9f4aae340ec0c4e2533c791aa329aa6264c40b35335e110aeb
-
Filesize
805KB
MD58d2cbaf9a7a954ce72ab9779c0b0039c
SHA1e8b287df27a8d40dbfbfc156b5297f42266cdf99
SHA256d83ae002345b93a536e453bc9f31e7a71acc83d7a3fd38979a39b1f16a75dea7
SHA5122e3713a850be710b1cec72f6324001a39bb85b33bfb7efc1d3243047c838fe7c1080197d933a1335daf46a5791ee4e5fe2478ae8e1dd1be21659b12ba714a540
-
Filesize
656KB
MD52d5b4aa9ffda196c5779623438f0229b
SHA1c207ccabadbdf9e3b47880405631279e513906fc
SHA256cbd00ebf687d1eaeefb1eb6befc21d65e14b7ed0975db0a570673c84ad5da02e
SHA51282a3f2209bc4b1bd6ee72c8a13059633bfdeedeec7bc24139a179f8b9f4446ed9becc0d7fe43201223304a3a1f97b2873697344607442df95a96f32b82ab3aec
-
Filesize
5.4MB
MD5080d259bd5c718bc6d756459747d7137
SHA17991f81e47b62e0b2c5d069accca1ba52bfd6216
SHA2566e95f72f8383d9a65c41b94bd1f91cd815dc37f43288b4685a77dc15e95f0d4a
SHA51254b9fe94efc6e28f36fc26659e3040982436c2b5b9bb25e59363d428a3f814986c88072413d217a62afcd1bd9dde055195e67c70033113d233c5739061a1dee9
-
Filesize
5.4MB
MD5d3a0dca2b1daacd35ce673870d5593a8
SHA19f48ab161e9dac5f8dcb0be27e494707d9b3b0dd
SHA256e25ee7d898a33330ffb5e23817d5e54f5ba7725fb70394e99188ebbe2c1fa72f
SHA512c568d28c9abe77681c9ba9fa54775c040138da6234ed74ad619ab23d9bf315d9806e71edf42e94cc5dab099a88016bfc7e8435834ec7a5b74163dea178176d1d
-
Filesize
2.0MB
MD563031a426ba3e6d782e8ff6f856d5cb6
SHA141241e8b90fd54516d355fbe429ab9f8c8c0cf00
SHA2568b6cb1eea81a9aad67356ecbcc3c9f0d902d239f1697d1f67d7f5601ced6e02f
SHA5129884baaffabefd1f6cac5e53feba006c65b00a64257ca6b1afc1f967d207aef63edb2347ae40bb1661abbce2f87ca7f572b8bf59246af21b91cffb3b5ad7fbc9
-
Filesize
2.2MB
MD52b74f18a36a270e04574cd2f929307c6
SHA16ab7465bfbfdb9bae4797174c05eddd67d6f4559
SHA25649740d20d1ca3377008c4e089742360ca49eb1d341e6c9bc47a4b2fa58c51dbe
SHA512f26cbbca495394fc41a27adf77c492ba845392174b0e389d7ee14d7ff783332fbb7d683251b8fdae043d892af98fa27ce1017782718793c830f042a56758d8cb
-
Filesize
1.8MB
MD5952b19861bddfab37d56f508cd0930e5
SHA1f8a13cf414f3aa673d3a6def650f017af728f7f0
SHA256210466c1d3a734a9f936511486983d1f918858c11611c24b713dd4ebf1385cad
SHA512fc466a08492919d21711f3ccb906ca091531e53b6e5541a26ce75352f538b6dc1b60274efb42bdc6ff4912c73a3914bafeeee5212b2de3428a5d289d94fac8fb
-
Filesize
1.7MB
MD599210db1562e5b60ff19065ec7b15ba9
SHA1cca4fbdd7223441484dacfee3753b718f0b424f6
SHA25681a8c4666e3e59b6aa3144806536e46478cf5a1b1fd638a38fba6e0a52a54d0d
SHA5122067ae9851c7442038a3b4bfc671ebb5ceb7da7d943e7730d3439315832f47b9e5bddbb52970049c2884c183a0873f8176d8517556435490cd93831dce03d2f9
-
Filesize
581KB
MD534b8861f6c5e30475a275f0919176e55
SHA1a023fd20ac9676acdfa9f48e9ec8980a2b7af192
SHA2563320ee735c34cae92a9a6a37ae19a8b2891a92c36df49a25678a45b54d834db3
SHA51232aa0282cf52517baae9ae6be24dfe4a5bdf88688b527f36e1c14a90fbeb44c85494a219cb83301e389971a0dc367eae866941aa5e8481013f12ed5216a14799
-
Filesize
581KB
MD575f049b2a100e0cdff19df9c6304d8ba
SHA17b49d794fad12c42124e26a4390c5ad0896a7112
SHA256f5f03d65308074f60dce5c09789e687ee1c1d9df509aa9e9b7575a52adf56a81
SHA51255f4ba357b43ef40c2575db223dbf34710ac1b1fc744e50787165d1dd24a990e0bacdfe7ae909e81de9d1eb9bab3447354ddbc310d349d8959f730f6a2264d7e
-
Filesize
581KB
MD5e92fad8d7d76dee839b913c52d26f65a
SHA15411383bf4dec612d9337cdde7b84f923298ca8c
SHA25665567fd505e706027b667d6051ccebb140c0ca8ffd70e89e440de8ac9f292c51
SHA5121cf0514ed655b5b835b2c1fd5fe36ccafbb8614bf3ed28ac287bbf1d3c9c3942f07f69c9c8636ee75b4d2d5fffcb92af3b2eb9a809251d23fa36623bfb9e87d8
-
Filesize
601KB
MD570af13bb9221d56ff2c1546c74f3c1ec
SHA1e5e8b31a56a9fc2c90121bbeeeea28c7120bae48
SHA256a76c8197a459bc14258354411dfd075c8eadc2d0ea44ed1d310d0db0363ae864
SHA512ba4b37d216dc9c5463be147fdf5422fe97f53b8f6330081656dcd821dc132270eb9f780b46ff0db89cb981aaa7cb222d84a15763c9cfec9a5825d045999ddb2c
-
Filesize
581KB
MD50818f2a62cc6d480edfeab411ed4ac6e
SHA183aed4099f3593243ff64eb678e9c76f3749053f
SHA2562eac0e5a4af6108c3b395444b4d080d5e6e59438d367ec01167acc4d7b3d0131
SHA5125f15009bffe4de01594d023619cd03c42be5dd829e2c60dd01e0dfd14260f0a7a1ac3385680884dd62cb2510d957f51972994ee7f4e323c4a150ffd1aab1ab2a
-
Filesize
581KB
MD59269328a3397d1eb399386d5b55bc702
SHA1bc8d8f737f38fd89d07d53690530f20bb6edbb6c
SHA2560fa2cc1b45d460444258efeaef9acbd974502c1eaecaf031f04ba70ccf4622f1
SHA5124f0581950068444a9b664c8cdce236aa1e082bf4f48a0f5ce1ac555c8ba9be43ada0be26e8b09d7dfc51480a6175b6e2a402f7651da62c5aabcc6cc245e08de0
-
Filesize
581KB
MD5b71cbe674041bcc3cd225ce8a87bc5ad
SHA190caf1e3e5b82de0ba526723e93d7cc2bcfaa7b6
SHA2569d70e13a98170c1c7a9094285848f15b25043bc9c9c334e592a5e750be162207
SHA512870cade2d2bf9d1f3fd6141ce59620a2fb85dc90c53df42f59ca2dece563a0298e3a41ac2a1da6c1058909c0970c512f4dc92aca2661aad196981816f5a3769f
-
Filesize
841KB
MD56ab121245532a6a04ed69bd73456b3e1
SHA12f6916335c47035a7f5d688da8cc33fe6e3532bd
SHA256c3343244f5055297c2b32c4868a917975749d420aaf3e7900727d0213d869ff9
SHA512306655221e0fccf906dc9ddae5ecb6a594f55c899bd155195742def7b1ac4d8a7681ccc8061206274c34cbd78b6ccf854b5d1f0ca12a085d2ff1b23dab1f594e
-
Filesize
581KB
MD5ed49802a9e3ea0e55bf01cccda1af3f7
SHA186648e7d2a147044d6c2280b9f58ed8ed381f24d
SHA25664ab34c9a4feb7d064faa4f5a85fbb6a8cded8e91246c07a62d4422f4cf1259e
SHA5122a1a98e7a389173b969c0a232baba9e2a5f65d9001dc123757df93703c56ec6311a7ec5e8166dee91ad32aa502ee44144383ac709b685098972d35d7deecd1fd
-
Filesize
581KB
MD552dd85e026d0d8d75104e7e641517969
SHA1ef0869d22e76847b6eb8b5a1fa02fe8211677515
SHA2563cf4fae67e701e8ae7b59936695e6a3d5c963bd4991f95c437643c29dafaa7e1
SHA512c93f195ea2fe6d85bdec938062b471cc4c80716dba7a62681b5a03eab10692c653be8c14e59226a2924a654ce3d26bc79c05ede9ff9908e0bbaec286940b7386
-
Filesize
717KB
MD5f9c41c77dd345dc3069578a06a764486
SHA185551332ebf78f4b03eec2964c544a0e4aaf29a6
SHA256d314a37ef6aecb44d439e5ab8982e57152177494c0b2d73592c4bd0c22c4db65
SHA512bfbb1b84423c13b491b77caa5cd39e8bd1e2a86cf89fc6650f9190d3e27cf060d22fb42555b528ce1a23dcc3a4e540d8db53efeef436894ca35e21b13135e742
-
Filesize
581KB
MD59353b8d7fb799755dc639c7d24ee66f2
SHA1e98a5f5e3719c5693b7b6646abc7e176746ec9af
SHA25658a01fd809a7b72288cac7bc92d25cc0ce55435484736cffe81bef43df999f76
SHA512328ce61d7238a64741549299baad44bddb1b63c3353f8c0c2d78155e18d9bc471c4ff5a84c0fae56640075a84db8187d9de6c5c609fbb08f3c59f03cedfd5669
-
Filesize
581KB
MD540b6108bdeef9eeaf12d2f68249a8a50
SHA106f70e0cff22ae3895e0ad3ef23c5c8df4a8442b
SHA2566f2805f819c0a64639cca9f12d1f73ded0d7dcafdd125ee00ee1ab3dfd7014e2
SHA51238bf3fb5a9f68420f62dd835dccf3c2dc025ecc3c4f37fb6476b5783fb34b19492ab570e7e9cca442986feca3758856bb62179a9f4e9f0290581a93e6938f4c4
-
Filesize
717KB
MD5743035ce14e293cb2d684c6ace214daf
SHA11cef9e6768c3b11ef97886dd12a18dbec8c41bbf
SHA25616ad063d0f83527ee672387c0c8aacabfe968ce007707c8df01fe433592a9032
SHA51285de882e8dd82c040ea06d79eb2e26d6131b4070669c3f5963cf44be64a843f61c9c42069b8f48b50d0e7101dfd718054bfb475355110b132a75c3c7ff593207
-
Filesize
841KB
MD5683e58c815f3c5b6e009fb55aefcb1c6
SHA1bf830ecd4a8e02a1ca607d36a5b410ae07fdebea
SHA256ef25d3d52f92fb163fa9db3484cf868e03e5f1293a310bc794de9225a9b60cb9
SHA51207f31f1a9ed848078bbd72168e29de3a60ebfc86b31b33a3f99f1c747cd6d20f2a7f90b233f53ef260e496e86e557d9769451ebe21e5eaff9418c7be0af84fa5
-
Filesize
1020KB
MD517a5b5d3e70c0d7c673782e82edbeaf5
SHA1216f0846f3602ee9d4d35291f03160445cdd85aa
SHA25658098e99a697c46862f5a4374aab99db6cc915c91c0998e74a210af475324f76
SHA5121bb731da2f482dc69049fefb4b238a4538c9443e9611c3c052e4e199621a8d243787601f679b93fdf362d1c8a0e82381be0b4b5c8c437af5cca6ae60b94b9400
-
Filesize
581KB
MD5141306899f72a36cc2e906fe6615ea7c
SHA11bee97a218af7a8ad69b86ea861310f2e1afee1c
SHA256cca6839171823935ce02ab24d5461a2f395c3d37e9f11f8a8fa0394be987de4b
SHA512d154291d91e3bafdabfd321a57d62ba61023ddc984858a11f2fa40a817903085863e92ee17a32c59db26d45126d2601c95e9f83a0440f9d0d8d62029ab082dde
-
Filesize
581KB
MD5ffb6cd2a9686bc5c26686d82c84916a1
SHA1575804dd466c9db017b1b6b0de21cf7753852699
SHA25674e5fe700190e99f386eb9992763751e1b44db6b31757dfdf79bc75a865466f3
SHA512c22598058522b001b0c5f398777fab64763d232ab0bd64c2de944f6a6af5e35b5baef9ba6d4f9b5f086f9704092d34876789480fa9073e0d52a3a5e2bebd04f2
-
Filesize
581KB
MD58c49c142f147089ffae838367bca8859
SHA155f3fece90dad4d7e6ac7ab89a2e0259fc669703
SHA256e46d1baa39f84414abf2c1585a9d24b7436f570e52aa276e16fcc6c8b7e170f4
SHA5123a47133bdcfc1973618a36f6800a375905f09f3fb952654f4969fc14638a0368481a2f5095a3637f4b48e8fbc2fd0d463bf907aab0da62dcedd85260bf99343c
-
Filesize
581KB
MD551249b17c772d347bbb0130770fa2a30
SHA1eea475525251d11794a839c24964c4ce0118b12e
SHA256f824793f73533957ad2248bfa783936d60255dba87b50f705e3d3ba2b2e61d91
SHA51244a99734c2623c8e6d194832f995e223ebb3f3800d083dd96a4e1fca29010d04862833d429741708cafcb39017d75161acaa947cbc7134f0f24540d2e8030b1e
-
Filesize
581KB
MD5d97deff353cf6d0f6a6a77e6e49b6911
SHA1df4ce73544571f16f204211fc785498f8d7d61a1
SHA256e1d2b8a897d4a9474d251bdee82d30b0f78dba3d2cb2db6f3285b21053042eae
SHA51225e60c7a94fc84a9f84fbf97357f4f3699083551d9b3ae41289ef3e67ffd2047b12fb125c1abf5ec3cc8c8fe2e9b65f38234d27520c4e7c12c2e4a90467968f0
-
Filesize
581KB
MD5b224a52c0f463dc3aac344d6898508e3
SHA1b6445e58617611b78cea5adeef40292ad7fb6ba3
SHA256166ddd30e32ecaef0b8fc93fd169bd05e036ad0ee9f1fb494e6c6ce35240f8c8
SHA5128abee6c4d2d8f7b4cca1eef36949744ed53f4b652a9db8be19dc1aad23e62ad1bfe3d0ba46939c70649d0ffd174838163572f931564c78dca7695e43ea897c14
-
Filesize
581KB
MD5fc639522910b811928b714f25037dc93
SHA1efa265100b49ef7846ae612fdbaa9a848bba0f38
SHA256bb9414a0389f3d66f9a2317220d763192ea4db14b776877539af26dbc3de9b90
SHA51289522222faeedeaa60218bb7103d6a308011dcefa5ed73b9bb2df5bd19f59ff15d6b22571c0b10cfb3929dbfdf0608266d4c822db53b216d6b5cf4e44f7ec2e7
-
Filesize
581KB
MD58e7fa98e95a6f021c3af49182e08fc3a
SHA16cf125a323cac7e41074df702fb9ad017b3efa0d
SHA256b3b89327c08f5009975fc4f4dde6231cc4dcba245a3050e46eaccea5a95367e2
SHA512e3e13f76877230d7d12376a5d842b7c78a99a81d75de4bd83741498eeef3fd97c19030c3d8d7cebcbf317ceb2b86d7294ee305969d1da7474ece014f89f7606e
-
Filesize
581KB
MD558339b15bb66ab5be4b76fa59f418d78
SHA1221ba394d21eee97b29abf49b46fd9661a50edda
SHA256638b0525573bc857d42d13c9c6043d592f3cc0fa263013f7345a44ec3fe78640
SHA5126d08951f1c35d8474f9b85a75ca5f98539080a713853048725690615e54977b5e802abe901488508fb71d54bfbc3a30a27de413c68bb611d35c42f8ee69fb752
-
Filesize
581KB
MD585671e4ca7c8380c9eddce3b59bf858b
SHA16ca04eb0689540fe1eb06c6e26de84767072e03d
SHA256a52ce6ccea77fc7b50ad324673b100be9cba67aa193ed05d293bdd6a733b32e2
SHA5123bbc24ffad56877f947f91b48a94625b98c65009c106a78ae42302fb0174ac8c43b8ff7f7614776302142200b7e45faba93f02a8aefb8b387c2e6ff8c5ac241a
-
Filesize
581KB
MD53f2d5be0442008dfe5627679895e32be
SHA11352d0301a9f2e2f39f304a683d7efb334e3ada1
SHA2567b37fc6e4e15c7842dfcc841bc55eb08f780dad43bf31dcfaa8d72c176085917
SHA512275a1a318d8be6b372d00842fb7169221adc10a526565bdfcb578aa2337fd5ab062a8057c824653d7833d65fd3c8ab28a864a4ae4d85e8c07e5ffd82100c3df7
-
Filesize
581KB
MD50c31c8e1aae795b4ff7e6692bf7a7a4d
SHA1fb1b74234f1e125c871b350ba94377afd788cb40
SHA256d0075fe0e6c88eb826852cdc4a63a0d4a226e919715480c5b28c883b973efad2
SHA5125c01058f31a7cf2ce5113c4c26323e0d5cb8e3073ef74d5cf0d08a3a4394eb83f2aacd32cbd8456fc021e159dab54cd2c861f3fb6a4475560419b6e7f232761e
-
Filesize
581KB
MD5fdc394d6b02710a6a12751a2a7a69a7b
SHA1d634ed4c6dc40c5da9f5848a612e48fc3fc46ebb
SHA256a7019edb4e2842b7fbce316eb203c4d3cbf9443aee2fdee099d55d98f311617a
SHA5120f2fd95718f54dc600981d2475ab930e5b7a50e13ebda96675c05237ee40acef28b541301e6d1cb673354cfb5cd0616606dfc552b37cc4b8eb4954fb260030cc
-
Filesize
581KB
MD57bd8808755d1fcc2ae398474f72702f5
SHA1eda8652f40f6b61aa236ee4b3bb9f18d19e15f4c
SHA256f914e51e41dfc71cdb7e94fc11ba9d690295719908ebedfd29ddf507a33c814e
SHA512c6318e44035494ac0dbe58f285625be91300e894d6adc04429c781fff3c66c261a7b66716ee3d6276d060c27ca342dbe0fe6458e7029a7590ae1718475a80334
-
Filesize
581KB
MD52f871ad9be194f88a0b48248cb52823e
SHA1b19558e96689247f4aeaff0f2f1d33dce4113755
SHA2561aead996f1bf51f562d8be321f9d3a330c772114d210377485a23b8ffd144791
SHA5122e8d5860aab293af9d764c6a2aa68734fd36f92f809012be2361214be14ec52e1ff339eee347a5f40803777f4683bd330b941bc9225be334b2e77b077051c100
-
Filesize
581KB
MD554cea3cadc85c04e08106bc9e4216dee
SHA176edc0ac6472849699bcb8659180a36521af6e6b
SHA256c922e61857c35cd5a377cbfd456cc8f121a4acb5273318f7ae8cf5037aab5fbd
SHA5127acf61f6cea608ff13f86c25930b9d7105dbff46203b54d29ded1d06f1fa22baa4d9bee01c80a9cc18709b6e9b6a0f3f87253163331552e58ca16e9ac2a8b7e7
-
Filesize
581KB
MD5a188118f20aced46700ebddff8dbec05
SHA1a6c361b8f0907df85eb16b7c48842b13a7316dad
SHA256cd2b45906ebe5d7da0bee1724ebacbed7a5c3d757de543598b9a0730354f490d
SHA512219b8791eade29e1fe12576ba5b8845496af7f1c57213fdfa2f96b2f575cc167eb2a73dead45ea9a96b62ef0b8a29c6b96dd5b1326ac619db10ae6ed96bd8015
-
Filesize
581KB
MD55614a656e376dbea9ecc06a9b6249fd1
SHA159861e2039d87c1e28736d286aaf15fcfdab3839
SHA256bf8b07ca4195c5f49fdccde55fd43a04d81058f540685326a9fb4b317516d535
SHA5127f006811928d925e82e429b4cded03c133a40be01d5c8736ecaf123e4fac33623679e81e32d9b6f873b0d7dc57df2e9c81a82775e059c1b02c710a0bf5d509de
-
Filesize
581KB
MD59b438c0c7ae6dff46d52347103e95a81
SHA162fa2bdf8f1404c3286e89147a94af6d28d12352
SHA256a1ee2288bdc2f06bfc77b6ffd5b4514086388dbebe206dd0cb00230ccc1b3b78
SHA5120cdc664e4d794037118a580bfdb5e3863c2e158c0c00816a9c95c7af304cecf6646fdda4bec0e245b3f1cd8acaf787d9120d03d3a74141275be3d07fed525c36
-
Filesize
581KB
MD5041c57f1e7bf5fabad617b7bd31bbf50
SHA12566f38cdf4fa62d00ab4dfcee5ef845516cbaa0
SHA256fd0adfd0b4fb8f073dff2dc449a50ac03ef4ad23ffd0f4e297c3cbe51d0f6c1c
SHA5129d675db42a1d0ff746d266e7d7b612ee421edbc6f279fdf9ceefe69459c0680590838861d4a919a10dd7728c86f59d599aa99471408d844de05440edbcbff8cb
-
Filesize
581KB
MD512a6f80ff67605210730a51ce61351b1
SHA10ba90e42a6c917ac8a5a01cd28cf51c2bc479589
SHA256113fde4f4ee8e1b9884ba2b3e3def91a81f4de451375bc903a269015b2ed6363
SHA512dc1193e49f3e144e4ea00b3e9f62e89abc5b7c5204e873be06438e33cb16dfb01d14328903451eb70cecfce66c50e502d7446f0f3e56b47279e0284057ff0c31
-
Filesize
701KB
MD5afaf29b03f1089dcc2a65fbd16feb084
SHA1d4957ab726953f85d1a0b2d7fced65c97e480751
SHA256c58a6cd8785e5675ce395b671a6fb7339df335bc00f3d32b243e8f4895f76d7e
SHA512a504729bb5ac46cd30a8f42e9514a6a1732c2068f02fd66bc995a97855070c8e4d59fb39ef019d18f3a0967c5b96e43a15c13ee0347f71f58c15fd902001a3b7
-
Filesize
659KB
MD557d38550d38277e1a6e12b2fd9bedfe5
SHA1fcbc294ee67a9630088184d279bf6fdd692c0024
SHA256984d2d2e24f6a9ae3dd811f4311cebdd87e6eb7492d32cf4b060aa064159081e
SHA51261cbda442128047614ab325deb45d994bf5f397ee9fb11619923732a3f9050dcea1d0731af7fdddbd1d07d0fa2cb1ea10509ae35460a138f8cdd5ac09a33f4d5
-
Filesize
1.2MB
MD544653d7f7a282942af13302e4a1182af
SHA12e4e35e89e5a994be2182ada139a1c6d73c41b7d
SHA2569ed05e411b0d34f2283f9e11697764d2e581933def18abc9cdaf1f854e88876d
SHA5122afe9afc41e378b9437bf5c9d9a31d6ceebb88763264f9d81c02e27d228409b51fabcaad25bc6e21627660dffb9a552eed17de6178dc6b226a857c77822a3050
-
Filesize
661KB
MD53af71a7e26c07707bfeabb6758c1671b
SHA1a112a3978947ba2588339bf8cb78974ec5f0822e
SHA256f70a374b34f484ff2ad1742ef0786f65b9bb5cdd29eb38203fc5abce2efd9d1a
SHA512c041b1b545ee96aed3e7d6036522c749ea37c95fbc5315f1cb3089e7d926f0529d41236dc719e110e20feb44e3861c6d0862ac4ffb2c60cb2fcb8eaeeff6c4a0
-
Filesize
1.3MB
MD5a8a53be8b3c21ff2f1aca86b376bd74c
SHA1db4a2a7d2d0da57986b5e9400abe05338a5e6683
SHA25671851402a7ef21dc7cd5f10283edfc00d1fd72d3dc7e9718184e0ca3cd319158
SHA5123307cb7fc9eb6d2f7f1d73d9c108623cf9de02bea1be38ababdd0e0092ca0509461138797e9834bd860c719b92f075abb7dd9a027e1f77c1577575e7390ab176