Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
25-05-2024 17:49
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-25_36703d9d0b16db800a8fc996ee71b10d_ryuk.exe
Resource
win7-20240220-en
General
-
Target
2024-05-25_36703d9d0b16db800a8fc996ee71b10d_ryuk.exe
-
Size
2.2MB
-
MD5
36703d9d0b16db800a8fc996ee71b10d
-
SHA1
7afdd1322c8f9a1e9d0f6f817d8339f9ec5ee438
-
SHA256
f882c603d0c88575e4d33753c483b2473db21e6e2f8bf1b086070188cd2de86e
-
SHA512
3700745f3009e05a58553b9bc53734a28dd00588de8f5f8cdb7d479e79fcb698514dc8247e00523e7068c293f61568c4de5e6d21031254d27c7697725d36d248
-
SSDEEP
24576:cOObVw4TaN1wdkukCba4oXtgLhU3wEdmh58uSkQ/7Gb8NLEbeZ:cOOh3aN4kuLbegmtGukQ/qoLEw
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 2576 alg.exe 2352 DiagnosticsHub.StandardCollector.Service.exe 2068 fxssvc.exe 4696 elevation_service.exe 2360 elevation_service.exe 824 maintenanceservice.exe 3924 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-05-25_36703d9d0b16db800a8fc996ee71b10d_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-05-25_36703d9d0b16db800a8fc996ee71b10d_ryuk.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\53b9867cbb5459c0.bin alg.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-05-25_36703d9d0b16db800a8fc996ee71b10d_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-05-25_36703d9d0b16db800a8fc996ee71b10d_ryuk.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-05-25_36703d9d0b16db800a8fc996ee71b10d_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{3B9828FA-6A18-4F1B-A570-1997BB7D5CB0}\chrome_installer.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe alg.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\dotnet\dotnet.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe alg.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_97390\java.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2352 DiagnosticsHub.StandardCollector.Service.exe 2352 DiagnosticsHub.StandardCollector.Service.exe 2352 DiagnosticsHub.StandardCollector.Service.exe 2352 DiagnosticsHub.StandardCollector.Service.exe 2352 DiagnosticsHub.StandardCollector.Service.exe 2352 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 652 Process not Found 652 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 816 2024-05-25_36703d9d0b16db800a8fc996ee71b10d_ryuk.exe Token: SeAuditPrivilege 2068 fxssvc.exe Token: SeDebugPrivilege 2576 alg.exe Token: SeDebugPrivilege 2576 alg.exe Token: SeDebugPrivilege 2576 alg.exe Token: SeDebugPrivilege 2352 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_36703d9d0b16db800a8fc996ee71b10d_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-25_36703d9d0b16db800a8fc996ee71b10d_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:816
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2576
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2352
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:4848
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2068
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4696
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2360
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:824
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:3924
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD59709618b0701da831724e96e20697e46
SHA18fb520d45f7154a30a5743d1172f39d68e0cfc6a
SHA25642d7b271efeacb7e78cd8cf1046ea05a2ede6fd79db169df9ac3f0239f41319a
SHA5124e0d2d5fa78ca9cde5d23564702d2d4478e35e4cb6679199d1d81bdf07eff548d54b0bc40186982043dc3466a13c66ff321b8a01073d3d24b4d62b11bc2decc8
-
Filesize
797KB
MD5218cbe284ba2b00f35b1898e001fe502
SHA15d32ebacf94876c3d4938f8fe8cb749555d07715
SHA256df088517f72f8957ceca796bbf7696922c53031150cc8c48f42ea7c1617f77a0
SHA5127fb993e4ea69d680dddfd1d5c7d02997518523f93284a099e0955cb989bf59a894a889bdd13bd73c57338ed44e0d8dc27cec76ba58df1a43d3ce69c9b8939b74
-
Filesize
1.1MB
MD5c597c5297da64847173d1180e639b0fb
SHA1e55fea50396b3828157d0dcf88d3387db249ee39
SHA256c5914746f0b234fc8befac26d5540f4a06cbe56ade6cadfc972423f97cb0a325
SHA51237276e6f61fee1eb6ac633ea4e7df5000b0ae7e96aea6a0e28fc45159cc81fb80c2f6c761c72f8ed3b3b551d06f800f6a3aff7ebd62b460ad95ee1be787ed56e
-
Filesize
1.5MB
MD5b39308183793e73a5652553de7aa25ee
SHA12dc4a14fef0fda5cda4297c6fabca4510eefc184
SHA256e5e4378778809df03171f4800c8d7f230c50d51acc95eb64392a839a5c7e174b
SHA51280a98bfae3668d42059097affcaa60a22986b0470e643db0325b48626687ffcf7ca4ad83fb68f0839c1cbfe6a45ec6db6c4e2218e0f8704019bbc4065fe19a0e
-
Filesize
1.2MB
MD5be56b8946d13b2155ccf0db2fd9a2759
SHA1c247334c29dc19e34710d18cf8c748a3d92363db
SHA2567f268629b0f99c594b60b5e161469d4798ed2128098d62292b33e80c93bfd0ca
SHA512176f95ca8c0127b63d2c947d22381af4b7abf50da653679a75ddebcc0b1c0a203daed403f2fb89258d204818dc9a68a1b3ab59e9f1e5fb56185719c0b1bce061
-
Filesize
582KB
MD5de3030a576d1613c5a2e5f79cac4a37c
SHA13f49eab1e93bbbc1090a62eec61fc10c57fbad2b
SHA25632adc43de216f240c32b21f5d023ca7f8a39f1566482ae41cc06d362a495293d
SHA512701f0e8d1d595255325e65476418e35abe83514c757876cf0490ca3fb5b205f3fa11e0a99df89cdde9af72fc6412778de6bc40997f5652c0e34ee0f718028c2e
-
Filesize
840KB
MD53718d18b43a5e7414663f71d627df3b7
SHA1879c1c5f76b0df670670a80329e4204917e7410e
SHA2569d921404e5f6e89eb8b8173176da92a5ce34ca6faa79224cd3f87f6ec38913c2
SHA5129d796375c8f43c0736b5f42c5ed8fe415e6caa7502af861304689fe87d839d904bd1e3c0a4a37804b9dd0823582dec560f66a0bd81db325a4deb66d978a5331b
-
Filesize
4.6MB
MD5c6d0ddfc6eebc3f9f50e405b090c3b1b
SHA1d5d2dfc6b356087f635e7ce88a4e3bb3f76f7589
SHA25616c14d7eb15e3800141e822cc22bbc5fd65371f5702d0f7c5b25b7b544dc7716
SHA5126f42a4b676bb3e8e0b7f74baa4a6a1015d8de6dceb9d22fc2f7f2abef8ce63063e6f8af1c205392931b4373cfaebebff63d78ffd9c2d41c51552584edfaedf81
-
Filesize
910KB
MD57536b66d1303aa083d46fe9b873dab60
SHA1f7a5239cae4d3a7bb6eadc8e9ab3e5563162c791
SHA256b35bf9d56eddccb55e09f0dec71b81d8c54238cbc9fc3d9ab80d3b5b19015970
SHA51278baee9c61e39db6cacb0d220dbb1a67405051f59f06f48ad1bc4dc49b3ad3d17e6e0d17dd4584b5753db80242d115d907039e46e08f3cce2c35517551ee13bc
-
Filesize
24.0MB
MD5b0a106a92ddfbd7ed86b32ecc8454f03
SHA1ac53930190a75b02d6d5e35955e0622b5cc8d10c
SHA25658d3e28ad3cd6db6bfde48a64753be8019fc01864efe62ac93b548b6e91a50d9
SHA512f08b2455104c295dceccbf30a796f8a7328a38898dc800bb464f00b967d4c9c76ed0886a37a5b241680c8676cb6841304b10442af29dd080b8fe5d8d4e52911d
-
Filesize
2.7MB
MD55eee6f0405f026de9c4e6560c05e10f5
SHA1f112ae016b71d957f6ba71baf1eac4eb8c181397
SHA256ffc529cafeb9c9dcab8ed8b405579ee00ddd85753af6e21c57962c2aaa8597cc
SHA512dba255ea1443e46f1797b7e3a0bd7c01ec6990ea85065e3a2e833076e782c5514e5500cc04692af2d50dfd8bbfeb55f891d6c8fdc376841d7c83f1227a8d47ff
-
Filesize
1.1MB
MD5ab4eca97642fac207cf91c9e810cf26c
SHA123596611e9116ff6c4d24e0de0f763adab07467e
SHA2560dfd039c307e86225e705cd393442d726f2dd45dcaacb5f21d6839beb29710b6
SHA51256e5dc230c2998153a4d302ccbf9787cc607da4d5103afe83bb35427e4f6faec9c0886d6da42c05d7d656ec5d4d4e7acd1f6a65dfcada8e7f715a005693e8986
-
Filesize
805KB
MD53f694073e17e2ee9ad44e1484a677dcd
SHA16c974bf539ce1bd7378777b6261d67db3b4fe6d7
SHA256a1dae52b758906ebd8996fc7cb92cf80988a4d07b8f8f4587f7bb61b9a40d52b
SHA51268e0bc72366886762a194d2653a8d3539a7b1cfd5a51401c238312a3e47a60177f6438ab989cdb86941777e94e338067dd7a67d09973e33fe9a21d8639b9ebc4
-
Filesize
656KB
MD5f12b1f6aeb3d1ad54fd5c8784410622f
SHA1f19f4f02f9c566070a0229c47b527b33d5e421eb
SHA2567067888dce08c9a3eb870e980b54312fd41cee8749978a18d905f2d5dc1fb75c
SHA51201e3579d27800c96ed73c97c070ea6d07f0701b9e62d6d0bad4e43bcf521a79de2c2c42f739ee7115ada8376d8ea39cd622c3b3b48dea95112bcbc8d9c16c480
-
Filesize
5.4MB
MD5ade0c83f215453a4615c97584317e180
SHA1914e97871ff2b44a16374698360362dbc5651076
SHA2560cedb63f6b2deb2cb06a3656bff67c7f9ab2a79c3a21f5bb4690d29de7efc1cc
SHA5124aa95b3228910bfd08a88cdfda4f17fb64da7ea62c48403707b39b1baaa8e6fcae26cadcfbb7d842404048eced6798053dcac3673c22ef906eb73d037d4b1d06
-
Filesize
5.4MB
MD57a56bda4388c60a3e16663a59b752a53
SHA105fa27f2b284a91a03f3ddd16c5c7c51ef1bbf44
SHA256257195106f19a49cb1043398de789dd5d261aaaa381ce9a020741e90edb3b89d
SHA51277e4e3a8be6db6e75dc825014011fe0235133ffc7d365ce1b1d259afb4359b736cebd2dbcacfd3b5c6bfc4745d75baa5b5d33a7b0e85f136ca6812436f7f9d45
-
Filesize
2.0MB
MD50b07542a45b3455b7d7f68650092e16b
SHA1374ac877639e2da05d46d37d5e6563afc6adeec5
SHA2561fdd01338d5de4c99f45fd18c8618ff9e184da9312b12ec5c06bd1c9ca484e74
SHA512d94269fdf9f03ab1a75318265543f17666210102fa9307ae23b3fc6a676b2b02e046f35ba3470e69b6d6a03663fe514a9b8be9e14815569a576e2bd79aa8a5e3
-
Filesize
2.2MB
MD56fd17f60fa5d7c8a32f1148f4ca8e2b5
SHA1e97ebeef7c3c1b18d1d8be10b7c61aa23c2902a1
SHA256ccd556e04efd74e705dedb66eec99b19b67f2218aa29fada8bd20e736c9dead5
SHA512fb912d7c0de469858cb1a6a456a864bc2e5a9886b37fb02fdc996e55701fd5147b1e471ec703406a06ae02c3e9dfe57f2a6c29ddd7ddf7829287226bdfefb62a
-
Filesize
1.8MB
MD539b755b8c2d1095c329e570220705bba
SHA1d6dfd58d9a43f2c67f2e7a38afa9fda23c6cb8fd
SHA256976c6d79717aaf553726419274decca80d7d5418547faec0c49efea5d63f8c59
SHA5128e0eda683ed6a9e2132888db5d3df03c6fbe9eac44faf3e19ce239a063cb8b783f323eadd219ececc9f202d468cc41eb0a0345ff63b4155e2d9ff4e5064396a5
-
Filesize
1.7MB
MD5a23d5155138a8e82a095616b844e9490
SHA10bbd420a9724a3edb8f412d715af80e357d45528
SHA25655b04aea211fe1347d44dc387a3113ae2240a305ee9ba9300e0d07c0f1d074e0
SHA51226d565124d6380a7dc18b76db7923c6e213cf7d3887dbcbe65000b1d42d609e97f1564530bc99d2b92577b19a06ac415b04671eb84689284bda8fcaaf233a035
-
Filesize
581KB
MD501a4e79a65b585e6a6130d52f99f66b4
SHA161738cc4e1fa20c9287d6dea34a8bd770e37883f
SHA2569dc6ae8ef7556be0ab3f25a40a7ccfb42bdaa7998af0a2f8ea2725a9b509b990
SHA512c9fb8a7e99128e11ef63cae8901d346bbebd73eeb265107a74627a02505b14f7e9fa39aefcda35a449468a7629c741285474a020f51cf4eaf47288bb058530ca
-
Filesize
581KB
MD5c484a32eb55efe1d405f3ca18920c8da
SHA1ef9653719ae32e7a4dfb52f1f38f1eb4d004fae9
SHA2564a10541c68bf5db8b687f00f2efada2267a9b13e987696b4eda5f6599eb5d14a
SHA5123bddb6069ddcaacc32bcf33f76265cb4e931ff95305f32f337775a0d2fe9e26f1ae54ab0e36a60395075b4d3782a52d03c4d6d698bae8205a34c103064e00560
-
Filesize
581KB
MD5f7032c2f82cc51d622fc8118ed1b1a2e
SHA109dd437e3b7944509237636175b0057c2370be21
SHA2565f6547d1d773b9c6d79d21e07a0b4a5c77d0ad570797e29715e173b1494ffc7e
SHA5121a85c2b060961c481a0c3eb3f2fbe4135422094e73d5904db249588da394dcc808e179205279b3e2ec01563fefb66caa186c40ded42781c018925a7467d647a5
-
Filesize
601KB
MD5f941a28af57d6d2774e6d60e1ad2b2a2
SHA1afc6ab56cf7c1cc4feb0a37e98dc5c0173553143
SHA256bf542908a9373343892e25a990e719093c1c528210269d75ff47ad257d2e1184
SHA512540aa14be990c3d5d872b4f1dab2bc24c03f01dd5f72b537bb71f125d6de6f86010a501a4d6bbefb73776c9b5ca9327797286685924d2384ecacfb4acb40d42d
-
Filesize
581KB
MD5c4fe0e4e721695466d430da0e8207887
SHA116f5699a2217d3fbeb0bde278185cafaffe459a5
SHA25649509b04b017d730206ecfb68dc19981ce6bd7a4897749db4a6f15626dd011cc
SHA51275c4566f40d4597a30a4984a8a2eb92182a602ff8a346c92fbc564e028c7a489091a633b02d1e8e0b78a9fd8605be24e3e6f76aac081b903beb86a92051e6432
-
Filesize
581KB
MD5814c03bb809d0fb7767ae4ea88ba9ab8
SHA1540b88f05391d447f34bdc17c84ce49f3268540b
SHA2563d3b42903ac35a8f0e156406e5f042d46ac31e6f72b35083d82b4d688ef4e96e
SHA5126aa2a1a7535c7e5e64b4912af7e4bcc0dd829f6107197716b5807f9dca06d714225614821e70486bd4c71e897de5b4647c02f96dbafc9e524435be70ef8f1fa3
-
Filesize
581KB
MD55f2c068bbf2318fe77e69210b3ad8854
SHA16e4656d198e4a667de442af5d5f4dda4338db1c1
SHA2567a7255d0d823f9cf4fd4a0e73e41e91a15e68651c513cc82e07bb4a9e4fe40a4
SHA512db2a4e046ea9f26ba2372916d048dee4bab65316a622f80b14baf1d0989ea00fd38c2d039bfb982930d12c62165d061d5d3d400a76a644023b0cbd4204d67f66
-
Filesize
841KB
MD544217fd7e3c38abb3331663b49d60715
SHA1f214fee42d44bddf2ed9734c742d09a310a1bf36
SHA25665df7402353f7bdf40ecc6f096d3d9201b7408a8ca8d5ec3c947b8a1b384b818
SHA5121c02017b046bd521b79154bf32bc370809a8078d48573669bbfd8e0a7d99097556752016e78f9f18537eacbad8c7f0b28d353d84a055ce04c3e1d1d0ee2aa475
-
Filesize
581KB
MD5a7e12ff64fe5573ac40a288fbaea15c3
SHA11b304e2b371309295047096b09cf74de38f7bfcb
SHA2568004b507b7adeefefc6c4dba5e7c46b7e22f0920551ef9b916053f77362eea90
SHA512a8c10707902969b19c7eb980e03bbf65c4d1b0ff996c99464574a7195dae3a36cd9ef7e32a413bd51372180459ca9c922b723bcc760aaa7aa6447ba3afebb492
-
Filesize
581KB
MD55f1bcd65c536e44af51cad605f783ef2
SHA11fb7043cf31b8b9a037dad43490a03913090e679
SHA25626fe2610ff8a03193741f06f36a112550e6744d42efaaf2ba53002bd6d80430d
SHA5129ee7eda8ebe3ab29485c28689645fb8757dcc30b42bc2cbd78007ae5ef75623955c2173212546f7cbc3a6035d5e25221fbf322f860914180811ac563991c873f
-
Filesize
717KB
MD539d451f7360fd942e126ffbe88443582
SHA10a84edc3ded9bd0b12e27c89467f8426f3b0f5c0
SHA256c40a4add5bef13b53cf867d3b97e9870a9a8f4af52cb580e1630201330caadc3
SHA5122f22c78b425c0f2128bc5628fe66671e43f92e644935e9b37843f316fa847dbab5e74aa7e1e957edcad949e75e1d7e26122610371cd2515a2aa08b5d94cd2280
-
Filesize
581KB
MD5d387047dedcc0c4e9a19bb2e9fa87b49
SHA1e41aeff3f85093f1bd64277f70f5163e2cf78d4a
SHA2565b7c91c06994380501b2896f41dffc77faca25bc95a85c3fcae88a88dc8ac010
SHA51267df9fb35fa8996735a46eeb965b87dd3b4038359050141472a361ac04e90031c52a346c8b4293a876d8f37715a7574184b863dcb18deb65f228d697c9c18b40
-
Filesize
581KB
MD5befbcedf85752462fdc2276b35c90d27
SHA15930a3abb1a3427120b8b5a0d8a807a12af20f81
SHA256bed2c37b3ff62ce18b4b6e7124187cec7d7a489f741c127f6b65d88f3ce2ce4d
SHA5126d5b1c04aa4883ee0da308133a61451f9de938c256a21440a5876554a157236274ef078a850e84afa09c7fe00b4b8ad7f37f3953b685112bcaa451bac284e8a9
-
Filesize
717KB
MD5cb0196c3acf216845bdb46f2ada19031
SHA13b3de292f10e3adb63e23960e9c96fc78ac7ffb3
SHA256df920aafab8b5b6edba77b80c53170074a8d8da242ffd4e8f64848a4e3e76984
SHA512eb371f580af8acc4abec2ffbca9777772b3d582dbf1da043ccf23efbd4c6252218ba3659e0b71fde4fea0c6dfa33972efbd5317fe92082a9a2208f5dd411e574
-
Filesize
841KB
MD5472595d6dc854dd9766cac1ac13b0a61
SHA1f89930277ab65f018899d3a37e975bb4132acc3b
SHA25625763df95909250588fd6724d7a0731c383868cdbd3b1a2e0d9d1098b7035c4a
SHA512dfa3b7a6233aa039fb2aa56291380c8a0de599f1f3423bcf5b614ffc60700cd95b535dabf8c479f9005de0e4083081f6102ff34e1010b329b9969eb0602515dd
-
Filesize
1020KB
MD5b5718a98e66b144a4a7ea50ef393c502
SHA169dc9108e8f201ab1777173004f4e436a9dbd732
SHA256138d82ad9d3951ddc006619f3c15b564cf1519130b097934bbd4822122d4b97a
SHA512d3a9d28a2e2c85cb9bef351a5b1a151dafa7aa48c13b382233acc0d4c4a7dc1e80a5c6b3348437e5b3586ec6ea698f1a50dcefc871f5668a80c6f15f79b47f7e
-
Filesize
581KB
MD58b3d9fedf83439a5d5d10377bb51f7c2
SHA1bdd3a098e46c02e5b14a2e5deccda5ed8acdc8e2
SHA25611906702cbb968e2af38d923277ec8fba1c178a3387baa3a69c5c15ef40b5ae0
SHA51286489a49b8c46e0a75a76b2189a9db108243593e3ebe94c7e16ce46c16357d6f5e271e772a3580594f52cdbd26083f60a677b61a4d8b98fa94ff2f4e47d87d8a
-
Filesize
581KB
MD5486fcf667c40e5cf3bc0b58323147061
SHA1fc6d7ccc0bf259df226f312780fe7d5eaa4aa0d8
SHA256d742b247d74454bba5062222008f87c9faa93e472c489558b611ff73a80de034
SHA512770dfc4db56fa5603abca0a1a6b3992711cf8dc895455eccdd71e85519c75ac69d3c5fdca53ba0d5a5faace8edd9bf3d7fd2e9d15b314879119c23466dd5a82e
-
Filesize
581KB
MD53be8c3dce8f66f23f409f9c6cd965cd0
SHA1fbcf4f66395a9af624fc284432c7703e751b6d8a
SHA256471bf2410e0265938b0840af9646a7b030bd655ed3ea1b17580c9f478053d8da
SHA51252d3e001d0fde259242dca493b70ef2a2517747d689c61038c278c534171308c00605e993893bf3c567c555be16317c8fadd9c859744cecd5f1db04487936cf2
-
Filesize
581KB
MD512de38353a249f0fa257451cc3c7aec5
SHA161bb8c40153d385e88063ac36a17ffadbf8cf56c
SHA256269c62b8be1d74737b2d5d010b4b2756d9392c1a5ba0f217280cb3ea3bbc5e87
SHA512f395409e51159b379da6df17c0425658edff530e2b4496463ea49989e12034d6a400fcbd8069098419d813fc1781f6d74b6c1ab0cc0a91db45f5dff78c8d735c
-
Filesize
581KB
MD5704d4ca72071cee0959cdc8c673c0696
SHA1c19583d8b1a8fea7e31c495d48fb82c9a530fba7
SHA25688d0b572c8090671f9d61d3bda5774d2e4159a612163db54151594ab49bab24b
SHA5120df638a61d3524500d4cfb9a0f4a82650300a3f362c1780a46be0294612fa53ab83c8df2bf84e6cfb3afbb72808dcb655277d91b723f475025601a14bb55ea3c
-
Filesize
581KB
MD51966667df97cac7e62d3c992c4bd0f9f
SHA1119b378237734b9fb26a233fc0503a7bf7940ece
SHA256de42e75b6e63d838226d04d8d915d7bebcf57d5515e7f4855c836b9b1c577122
SHA5129e0e7509eff4ba50797c052a00c021d8b6b80395c34155b7a6ac57299e7781145979f51f8fa9421ed6b8ef522e8866a205b0a3973ba61d927f87c9d1fade8091
-
Filesize
581KB
MD5f3f228e6dcd218be7e67591f48039a58
SHA120eae4f5946556c20b4e28ef2e034a8be8fc3ca1
SHA2567026e9c528c36c997636659f2ace1ac66960c6bbfe78d95a88b9c17459340f1d
SHA5120f356a32b0b517681aae934ab3a25d873475dfeb7d7b215e8060c66777746e9a8357f177e468f93de3401e28645ce0878505a94021bc0a4498ac2f5b234a4a0d
-
Filesize
581KB
MD5f9c78bce3f0cfc12a575eef814e1bd6c
SHA18fbab39b58c24f7325326188c1ed28941f404557
SHA2561a1dc9b7d82c5d36c331d5ae937603a930774322cc7c0b5b9915d2955e8df7a1
SHA512845ab1d9146f4a7c9f79d9c021f185516e23537f4a2c3addc29f00ce5b9603afc5d919103e3d3cae2f662b393ea926fd335fa28fa8f967b67a5f88ab615406f5
-
Filesize
581KB
MD5805a55f99c4976ffc75ccf84d316f668
SHA1e5f93f3107f89155294e4a19c6520ca787ea951f
SHA256388cf35074de450bad24b27e8c72cb11797fb02e9adc366f27e13bd117559ad8
SHA512913151c11dd5ea4a717bb64af9edc86d555b90338319c29064b5e251cd88c2c8653aba3a84f3b36813abf2e56105175d63dd23d94aafd5fce71ecfa4c17548cb
-
Filesize
581KB
MD56d12a7e0a8058dc5614c1751b36e8829
SHA1c580fdf84f64c19920249a880460b2e9d54b63a4
SHA2565aae9e3ca9783a686ade9fba9e9c312ff7422efbaa6ce2720024db76f3575454
SHA512aee2d69923323ed5277c06442f0114f5629c5a18077a39786350e86986c6479d7b95680af1b1ccc43b7670675f42b9c0d28f68984e2e0060466ebb40183143f7
-
Filesize
581KB
MD51c017cb8b36b8689d313e4217b8ea380
SHA1fa8f20edcf2ca389557c89da3be58bb2df74a2bd
SHA256e08eb357bd3612fae4be91db176ce5264a94c6ed3ed5c4cd36cc04877e741b62
SHA512d21a8a94c7d2218de9fdb0d101b8108645a61cb1e5fdf58e4d2c175f8df980ef72689fd043ada022cbfd0821d5605c2c64203d83116df9d8118e5663a5c580d6
-
Filesize
581KB
MD56f3f926015cf35f7352ace68e52e447d
SHA153c4f3924b958b7bd6cf6aeabef991cf38578604
SHA2566deaf9ea2a9ac578cd931063bdfdc506eb0e7466806b5078915d2f18e6b65b1b
SHA512f7f011e75aa9833f6c9ce2c449937ba48ea5f52c7cbaaaae2bf0c9fe31f4019a608bccdfe8a960ce0374af3ad0af5c68be4154320a774c982cec98cd3a40d4bc
-
Filesize
581KB
MD5b1972c1895fa079c4e7ec2b8907602a4
SHA1753a1a1ad8ad8c199422d2b1b25ffbd314a2339b
SHA256b3f099c4cc347704fe03236f7d8b55a9ee2e4a60511a326bb76ebdce08676272
SHA5128ed73de7188cd98959722a34ddaca29736d31c96ef57fd07d8ae7aa3671bd26a9a8f47dc784738eea35b12e48360468bf8e7f651bf10e748ca0764d36c0d41fc
-
Filesize
581KB
MD5e09198c31ce215368609538a58e9c51a
SHA111c149018d18e5ca4faec7efe2f23cfb681d5f28
SHA25649ae0b7a75860648485185ee745d98cc399302c340f0fff5bd606d09f553b12a
SHA512143362f8d682090261ffef7999b2ab6ccee1abec7a64f50566474986c981c50098ee60523aa0f9d283a3f7a26ff1ea460cd0777079eff9995215918e27b93f3d
-
Filesize
581KB
MD54438178e4acd3e415ac4bd3d50f4f097
SHA1fb79408ff6c2f8a957559811a58c765ea497865c
SHA2566ae6746a4ba272c3a196eb5ecdb1060db139922851bf3d785a47391429b384fd
SHA51224dbfbc80ebbec100c4908224c003fd428637bc769ab387abc19d584861a92367c24090f7ffc4c5502e629e2e741443703c96c92c4686d5513a4cfb474820543
-
Filesize
581KB
MD50a229f567b375eb3995ddd4f6c8aa637
SHA179dd365a5194c08ead24a71653772ba02074a1cc
SHA256b55b068cdc53ca4fd41fd419b9b2f644f9cfa3e91d060682d502c9c436f13655
SHA5121d31e9afc67177dacd73b0c4e138eceff54bf739105398c98fec09886a6ae54300204e085f838a05a0136aa53c7b542e399a6090de74c4be542ef10bfd294125
-
Filesize
581KB
MD5cbf6740024985382b6cff64eeafd19bd
SHA164439265bc73239be484e9e32d8cfcdfaaff74e9
SHA2561f274ef0c54ff53e9bf238240b43e32c2aaed7cd61364d1192c205e39bbb60de
SHA5126d0cb59ed405011f7c737e56b90435802e00df45ec8bbeec738bafea007a06e4aec40c2670cac96dc0a2e3f765877546d506bb9d7669d3d08e8d0813b6a1c51c
-
Filesize
581KB
MD57627d17ec55c935f144f091fe7c30c2d
SHA1a6f603fa5d254fbb0bc171f5bfc836b2f8c42dd5
SHA256516ce52e5cf9eb21ff05f2f2580d022e2a1125cfa9fe860f529dcdd2c76d6580
SHA51230fc11da3dc234c7cb37b6aa5d8e0ff2a89afefe2370a03e66e5e08e0cd9ffacd0546e7780ec321a422a4cc7ecf163b6a80df3f676f5d242b88990270d1a0386
-
Filesize
581KB
MD56e3f34af108f8eef971926397f82a1ed
SHA16c8669626770cf5c40b19bfb3dd60b15e9784d88
SHA256d5f55c8662aca892aaa71f83c73a2cf06253ce6f144c5495eb8d7dcc742c1118
SHA5124292ba8e4cda0e06ebdba31203d250af1aac1f774cbc5314f69af127ccd7fe03bc3e03371886e312d4b407d978eaf85cc7b2321fd32625e43ffb87d2e6d41300
-
Filesize
581KB
MD5e5bdf3a963e5242583bbf908b6740ccd
SHA151ab65b54ee215805a3067740cf9978541e535bc
SHA256723c9fd143fca34031b055d8f74951639644b373dc73d2f6bc6737022940bd03
SHA512bc60dbf96c5d164786db7f183e1796d1496290a33e585d640696dea8c23ebc5f153a152404030851642138e24c3c4b0f3c98f451081ae44672bd231f2a6659c7
-
Filesize
581KB
MD5e2c911b7245d825648f687ed051f9373
SHA1c76b23caf13387e5f9ea351a42e1144f0a2f3c83
SHA256fecddc104aedf92e71ae2bdb802079e436f24998a9fc91284ef2b862c30e06f2
SHA512847d84f25c66a49dbfe0d88e18fe17cf18452a00db1162b53c46d739c9bef11a4a44d26d76bef0d5023c8b27df53428149029cb4fd7e34c7184bbd351a60a4a0
-
Filesize
701KB
MD5210503819a0c71e650813fcaa82578f9
SHA1b1da305c105d4776e772865c2692d7bbf4a96944
SHA25690ff8d3f3217308610019c9f3442ccac223632da1844755871d0dc7dc6380ea9
SHA512e05af64266d35b5a625624d02ac74d4cfc3969f22bddda2e2941e48f88afb9ed44d0fecdc5976685a783350fb04265b3555cf8e29eedcee141338d2d9fb222d6
-
Filesize
659KB
MD5276ccc2d8445345ff45f16e7d3c15b62
SHA10752e183d7be3db3bb26aeb9ec6937592cf2e223
SHA2562ee18776f25035c3296c38d6145738f2fb414c9292e0455de33affb498c74883
SHA512aad21ce13d3fb5eb4a8146718a17bdded0bd3ee7b8af5976408d8a4cf42142ab4685a2826ca8a78277dbc1bb94cbf726c0cb8d94febcaaac89a79c7267d5a783
-
Filesize
661KB
MD570b2058efbf4ae4af891e91cdaa2de74
SHA14c9f2ce7c86ef7fdbf1ed84cf8e7563c567ee3f9
SHA2565dae2a7807e763c6197cc6e01acb8fa7d675d4c38c4d26243d26f316bd15db2f
SHA5120110733fe1d093f9cad201134f4509abb162e9d86cad49e60a05a564050cf86684bba5c90f5d819da02a334e1d254982ab33b9dc94771c5f48c406a72c277b25
-
Filesize
1.3MB
MD5389b75f4df418c3c0084355fd9143a87
SHA1635bca9f174272294ed39f391e9a85bda24fd226
SHA2563dce0a3781d15e21f8ffd9d122c4bef7d64b86534b37c6cc72bf96e0e7512f7d
SHA512ec0885ae4b66d83960ee50aaa7a0a2c1d5c94469af64b73fc1221603f4549563f216f3040f223ed90dc3d9ba6a1f0fee4d734f1ea929c3c8ddd53caadbd1079e
-
Filesize
1.2MB
MD5d86ff613c8e530a965fbda8057f30f53
SHA11ce0af55bed2180e530a2de8a6c32edaa8150192
SHA256d571f74efe19d5d37e7434effe580d7fd7075c0d479d132d1d8fced7dda5c5df
SHA5128550955653f1b5eddec9e51cdfdb3472160f366eba7a1bb30cebcab18db5c8699bcf0c8b1e58a74755fcfbad738ec40c3cd5b6944cb196c675d8a56cc252a214