Analysis
-
max time kernel
134s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28/05/2024, 11:45
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-28_f146198bdbe498a0ca8d7b01f228a31f_ryuk.exe
Resource
win7-20240419-en
General
-
Target
2024-05-28_f146198bdbe498a0ca8d7b01f228a31f_ryuk.exe
-
Size
2.2MB
-
MD5
f146198bdbe498a0ca8d7b01f228a31f
-
SHA1
05cdb1fc39bb2af8fd433071ac611e3ffb3c5abb
-
SHA256
dbb9c24c0e5f449803b72ee5c9b03ad0abc926174720d08ab41640c5eb07cfe7
-
SHA512
09156eaf830491533d9644ff9b1e4e6ed00679b4ed03e467874aad460312225e9e8a2d06a9f67f607238295a425e89c4e2d51856d92a841aaff5f5f469343e27
-
SSDEEP
49152:EOOh3aN4kuLbegmtGCUyuFlIAFQmd8WU:OU4ku/ctLUyuFC4Qmd1
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 3960 alg.exe 4472 DiagnosticsHub.StandardCollector.Service.exe 1544 fxssvc.exe 316 elevation_service.exe 2376 elevation_service.exe 1300 maintenanceservice.exe 3116 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-05-28_f146198bdbe498a0ca8d7b01f228a31f_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-05-28_f146198bdbe498a0ca8d7b01f228a31f_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-05-28_f146198bdbe498a0ca8d7b01f228a31f_ryuk.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\f133399ab4b1389a.bin alg.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-05-28_f146198bdbe498a0ca8d7b01f228a31f_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-05-28_f146198bdbe498a0ca8d7b01f228a31f_ryuk.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe 2024-05-28_f146198bdbe498a0ca8d7b01f228a31f_ryuk.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_99718\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe alg.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2024-05-28_f146198bdbe498a0ca8d7b01f228a31f_ryuk.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4472 DiagnosticsHub.StandardCollector.Service.exe 4472 DiagnosticsHub.StandardCollector.Service.exe 4472 DiagnosticsHub.StandardCollector.Service.exe 4472 DiagnosticsHub.StandardCollector.Service.exe 4472 DiagnosticsHub.StandardCollector.Service.exe 4472 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 660 Process not Found 660 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3952 2024-05-28_f146198bdbe498a0ca8d7b01f228a31f_ryuk.exe Token: SeAuditPrivilege 1544 fxssvc.exe Token: SeDebugPrivilege 3960 alg.exe Token: SeDebugPrivilege 3960 alg.exe Token: SeDebugPrivilege 3960 alg.exe Token: SeDebugPrivilege 4472 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-28_f146198bdbe498a0ca8d7b01f228a31f_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-28_f146198bdbe498a0ca8d7b01f228a31f_ryuk.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3952
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3960
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4472
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:4876
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1544
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:316
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2376
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:1300
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:3116
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5e4436dc147a87c5b5ab6b1b5bd035036
SHA1d8237d5b818b10d69a913fcb2746c28be92efa57
SHA256df3587eee05004e874a2b8595bb1b717ca5ffa06bdfcd2576252b5360d8be809
SHA5126f5441b15929f3407620bde2a3406ade25e49c5aad301ed33aae4e867338eab062b331c1d588886e9dd504f0291fcc057ceedce6699605879fed12ed278590ac
-
Filesize
797KB
MD5ace99164b9be3455e14391a4601380b8
SHA15855e2ce893c2f6cd612e402eb79f015777dc53e
SHA2564c799fa33bdb6202786f91c550f901232f261498b7830109211000afd759335e
SHA512a433ba840352fa8124468dbf5a97f8a748e9d55a3715a82ff59b639381ecff2e9fbad84b9f5ef5fb2160d6e37604ef32d2d552f5130c07e74a8db8fd00015989
-
Filesize
1.1MB
MD56c08b3e80c7cdbbfc4fae7a67adb5791
SHA1d53d1cb2d42d436e58c88f24fe6ae1d4b64d9f18
SHA2563aded88df1142b77c7b796bddc9e0fc04bdb603481b07c3e6a56c45737720ffc
SHA512b11677a7a79dc17d1d7d59d93b98a00aa821bb5c139b11737f74ff8eae5336ebc92aee7aa6dbcfba64a5885127c5caa86d8e34ce1100c6e2687717d7e0f54b1b
-
Filesize
1.5MB
MD5dfd90cc6f85f57db2b9a87345a8a25f9
SHA1be7b5f41fd378d5b9bc23429fe5971fd8ea3f2c1
SHA256272f6113faa7926eb38e40195bbe2be11527ac6a5e4e055649b0b0e220813faa
SHA51236d822c9589af4ac85587c83911a0d8482c89830bfc773598563e64ae1dc1de21409222cbd56d1601d781f3a645a6675096471b6bb6bed8a26e52ae8ff9bcf77
-
Filesize
1.2MB
MD56a583ea4b5eecca3e4137fe4aafc60c2
SHA18760262178e4932b37fd26ddc6047e73f2ab02e4
SHA256da36dcd8c2077442443473989475c730aaabcddac89841bbdd73746e5923b3f6
SHA5125ba236538df7571c8518a588288b0307566d188fe02af3b90daae8cf70080b4e0e47213560813dcc703eec169e5681c24991a3e58ac64f63290216e56c3b6a25
-
Filesize
582KB
MD519216c80dff300c1e3099293d9f7f7f3
SHA150214816ab57f1cea30ef54f3091010f7dac553b
SHA256cd6d8bdeada64befe641d2574c2086f8580cb3f44a813a66bac49a6981e636e2
SHA512c0569f173b771abc3d8ebed4748d88056e88f2ff3f429cb85da62e54cf759b9cc7ec6a57951db724d081f510dd60445d785edeaa27f5bc6fbfb16fb700626d07
-
Filesize
840KB
MD5a4509f7c94e9609bd0a1bf9e9cc3025c
SHA11bf48e328634fc635b66b31101388659306b3e43
SHA25632425badfca6e277cc16e60e84afc4da9e8104a3469c3187b81a2ce1dfcfbbcf
SHA51215b899ce5acdd406f0fec356bb0ecc14c4282790cc4af6cdb63c2d8966d4226e33949f2352877794afa96ca5bea754224394bf1f9e6c68b4214f7136d43112e3
-
Filesize
4.6MB
MD5bc2cd695a0a15ed24ae22e356f7d482c
SHA16e2b6856856e95ca4f2bd5ae2f7b7c006d0b01ef
SHA2564913145624f40e56b0061af1b778d54ccf3a43fc167d1bbf38fd1539bcdc6e6f
SHA51208feaa42e2598d74828d108544a7d4009fb2238f8de03cb1e2fede9c5f6855e7288bcf5d766c2a5e2a780d5b6d224019a144656afabd534ebeaab698341a7334
-
Filesize
910KB
MD54d202283088ce3c3114acc6c2380b945
SHA1d81e1a6c09f96e524c3e9a8fc293652039b77015
SHA25627b22d94adc2ea581e30c3e59f7c036b9cafa535f5ac5ee46acbc52aebf05e31
SHA512c4836eb6ea1a9a4f3be55a1ecfce100e43f84d6994391045a292bcd84d92955a02fe3cd56d7093d5e0ba510abfa58c981da510d54799716890ddfb9e214eed6d
-
Filesize
24.0MB
MD538a687643831276a69c317f02ed99ca8
SHA13fbfbb2c3992efdf4015f3dc77791ee327103df1
SHA256ebd06d810d1f34dddde263b06958e35768dd48edaeff2c46d38a730a5299c1d5
SHA5127a981dadf47a2e46c881f91cd60da739bb30f04a2c96fef869d963d16aec617d74d8f6c0cdd095ad44a0c63a9d5a17436ad22ede4a9b1ef855da0a338574bdd6
-
Filesize
2.7MB
MD5e1570167cccc5710c20e023a22e1ef01
SHA166ee838cf0d7498c28aee179faf5b04fd32d047c
SHA256de5680b0a3a74b2bcd90ff0a1b85cd2947e521222bedfba9b2cccd10001d59e3
SHA5129614590a2f925fa86c152eb7fa36d184ef87ea090ab345f3e229e440e72de34fd3bcfb3d6d3483e805575b7e0be9e86543c310c06fd880f96c3407a415192b24
-
Filesize
1.1MB
MD54e0bd9f2e3d124458d849f6cb19a4c2e
SHA1bf44d9109c8b34ddc96c726a66c76a53150d51f4
SHA256027a32edd1b147f13f65662914ccc0e4d0a222304a8dc1b72170f57e2b68c73d
SHA5127114b0596e1a83158c5b8ecdd5e177ea3b5d0912599f5b6b3a0999a13415c571a61e4dba205dbf71fb0f52bf5ccf90c81e6e1827375766c73b1e1769ed282b20
-
Filesize
805KB
MD5a5c3d639d49b1cbe39d0281056406345
SHA18c30c128f59f6fce37fb0a3864b7cef379771137
SHA2566995c200711adc7108a9a817ad58dcc6e1a3d487065282a52c7bc4139b834532
SHA512b69b1d419bfc629a10bee383a75c28adb1053bc85055101be7a67043ea0b1fee8bc59f2e6ce636a14e0ac247eb7dc65b7b8b42430e9f85360c54af3066d2642f
-
Filesize
656KB
MD52d693715546a2f919e351008e3a9e860
SHA1cc410739222ede37b9a3306c858f929f69f7d693
SHA2568d2a0f09eb92427bbda60445a617527d1919ae8b2d3f8c0393d52e1772856e41
SHA512455d748f76684c5b8a077637e368408548508902317c904b483887e563a498bad7433c1756fa7f0301d92f6242b209115d6bfc9553de17427bdd08501a4d4fc3
-
Filesize
5.4MB
MD58a9e0254413bd3224264b981e18bb1b8
SHA19cf600f71997f743c6ade647a7c85970900c10bd
SHA25610e7de972fa7b7674064b79b6f156b29c58f650fada05e1b4427e5c9af9c19f2
SHA5128f1e24245ae910a85d927751a8d85458b63cae6094e61d522940b2f0425ab5c6f7b493008116f6cbe9aa30b9017966bdd67120f1a046c7d8fb6b34cc7672a706
-
Filesize
5.4MB
MD5b3a80c91d0722871aefd4d73ac45926b
SHA18ef9002a02f95ef7324dd9624979e3cb0aa3bd27
SHA256f9f8a72800f169b74bcc210a8d279be04042b67265dbe5667a236c3addb9cc75
SHA5128b64e1f54e162640bb9fcc177140e83b91f1e4058ab6869d2236077557ce9443baa55e902a8c4783831d588734421a023d0a9b2e600cc2d9a1cfc661978a9c40
-
Filesize
2.0MB
MD5ac0082c94750c9ce727373b9950d3a85
SHA1a3001794fe7df177efb4b041ec060099a614084c
SHA256deb4b7d562f787e55a817434105218ce368a2b0213d27f56c512e01a8f72c13d
SHA51268ae6ad59f5adc86c1df83677a9a1ac191a9c737355356c44312b85e46a271e4562c7c9cc70439471789686bb223bfdc450dcde3ff575e2406db0ef06f9ff92f
-
Filesize
2.2MB
MD545e0c646a79df60455f52ffb442f6aea
SHA15e7d8ca1dba8906ec50bbb9b0c73a77cb0945cae
SHA256dc9aa93f4db327ef36f1721a9b7d8e95d29204728fadaeb11a845c2727fe644d
SHA5125b07abd1b54197a078ef74fc7c799dadab4c91f71bd88e45acd50f64a785b49d7d39329e6fcc81aa7ce6afe64943dcd0d4156ec5c2bd9aeddc07534dbdc79d1d
-
Filesize
1.8MB
MD594f1b72d6ad32d364141ab05e37f3590
SHA1545298641957c078bf0dccd1a15f44c2a6d1a48d
SHA256c550ea43f9a5dc01f6fa3ad62deffbaaf2e144528e9cc449cefb0fc8c932cee4
SHA5123832d9301e1de6084dfe75fed5f1d1318496e67ad3f14e329f20afa00d69b23ca94981e944f7edc748f78ba03eb3b194797e20495e5591aca6024bf42f2b6d77
-
Filesize
1.7MB
MD5b10be89c8ba6d00cdd868e93ea578867
SHA11d4fa244293410a2059ef39b8d1ddf043d918bda
SHA256843ff0b35e0e8f1dd70283997b28aad6fb59dd24edf190fdef47a193d3d1ad9c
SHA51253aef64fad258dd90afe060eb31c7e4c257ded698e514d8bf53a165a9562c2951785ac6e6d9d74d32890f0d68bdc61c4741332215e5eae6ec0dddd2da7efc522
-
Filesize
581KB
MD5d8104b9ceda91b8773beebc5240d3768
SHA13a1cb2db780b43dfd4095f4fe65eca69e2cae019
SHA2561d085b8e440698f44a0f9787cc94dede3f5b3e054877c88e79f61231006c6652
SHA512ea58162ad67adde9678c04ea070584325ee0bc536077a9e51b3b2f4807891cb5a032a899405a116c54d037143f7ca54ffc35349a69e4892f80970bb600d3269e
-
Filesize
581KB
MD5885e7d399089b51ea67b07d0cdaec26d
SHA11d8245ebe14f50056bdadf5b3fc9e77b14e30d31
SHA256f0bb83d3cce7c10b1a9ca5dd38d910b64c4af9da2b05714c33af1987e03e7a49
SHA5128e988756ceb41f9cf75c47b77629af311b6a9541350bcaf936e8290e367dc9a59d502241b5094ce806cb00c15b581a01b5eb9f44712cd8f0b47fe83c8b7c49d5
-
Filesize
581KB
MD5b240ec762e92b600a72ae41f1622bb62
SHA13fc7223dee9e8d3f6ee02c43db431e6b3b415318
SHA25613598230d39a13b43b00dbd5af362bc9cb8879f77636014a0f380fea7aa354ed
SHA512ea5465b9f85a2ab725a21980113b0847159766a0179328e3ae9818f57c28e0bdfff0d2a66da4b4b843d61162d43c4d440dcccf27e845789b64c0505f544f7847
-
Filesize
601KB
MD59d2e26775947a46bf64c788c8083d067
SHA1bbe63fde5c58973e5a70027a9265e56f4f0365e7
SHA2568f7e5e826144974cacfe60bf292f29b9646192062fc233fd7367178a9b2bd828
SHA5129376123810193a85bd367788ba8633d1d8255c2ca2f0363921fa331f0e1d56494ab71df549b38fa375adf7cf4b07128d7d420fbf23fc3e6dec521d3fba49a148
-
Filesize
581KB
MD531d19a3b82f94c2db62228de81e405eb
SHA13bd4a50a4a262cca6838fcc5549a747a596373b0
SHA256e8e1f11051224dc5933cc154a82a54ac82a04cf261c316948fa77c200c8de3dd
SHA5127bd1b014e30c346421911982fb0d914060fc317e9bc6bbe71eda9ebec56f59997bb9bd9229e6012b7318d400e691ccdbdfe9df0a1021dbe537227d2337759c54
-
Filesize
581KB
MD5f537a0f9760b9518aefe898067c9249e
SHA16e6acc92e886226da4c78a0e867eff7f5476de51
SHA25699ea98ae9afc608f80a492ccf4ffb20ca5eee8eb9f440d43a52786badb5be072
SHA512ce1bd176587b56798b1599a2d94238617c9e158b23f6660f3a7e3ba700ebb2ba07e86481b0bf013423a9f67132276199179e812685618724c3ff2525e7153aff
-
Filesize
581KB
MD5a2bfef0269b5069dd2a9de3bdc25f9b7
SHA19a330a560ca3033b1040b7ddc0f69b99d61ac355
SHA256c8bc95ab0686f100a1b7a30a2a303df2a42a7c2318d469171350142d3883fd13
SHA51206e71e6c315ba73bf02198cc6084f64971436ac6e08932da5fe938429c0a9229339b55033f095e7417d9b850d2198c7dea33df1c7a45f0d5bd2bae5cdf49eff5
-
Filesize
841KB
MD570161cacef12d069c39df8f44bf45d5a
SHA1a0227248a876f7026aa3ef77e1b42599846f511d
SHA256459c2056e4ad6da92162af54ef991a34d4ad99e4c983f8c5e053a10c9a7b2e80
SHA512100e806e3d49c53fac55cffc7ec2d42555962ff86afb33d30c0586e187f55a1ea36a637d5538b84ef988b151c260216e76fb4bd3b40a015b9431108de9730efc
-
Filesize
581KB
MD569c442c2474fe5c52671b270a03c7bf0
SHA14b6282f058c2bbc0f7bb8631a2e122527f9639e4
SHA256736bfc1ca4d9ef90658190c0787872e057ad756cda664909ee7c7f7939f8c209
SHA5121b9e32eb975d45a1b8de89782b1b72591f72d4f449cb0a42a3ec806196099f26f17b5c3d8868d91fcda6fed1882184774fef14c3edf584d7f76b2cd12257bd5a
-
Filesize
581KB
MD517ef3217556d391cded60373b64e45ba
SHA10c76470d2e35302756fa642888a03669d680824b
SHA2569e3a0d785a9f33f2e9dcfdccd019db1d12f3ecd90710f97850de4ad6aabce37a
SHA51201f5dada5f418153a22a61cd30976669d95c14ebc7d03476ee1ac056be4b86b38da9ce0235e10131bc82464462a7ce25a37692125215ce358db8ae5fdb396a5a
-
Filesize
717KB
MD5d8eed5987a0c8e7e36866b0daeff0f1a
SHA1fa4914c69dc28a8a22b30fce36a1b766d2fc79f8
SHA256ba8346c5cfd3cc59cfe3dfbfdfbce809c06389360fb7cd8536c925aeea40fc9f
SHA512ed40ade53f5213eeb84c2fcb8c431fbe0d993db52578a4c94ef4ba917bf73af58a993a9d482ef656bfa5b10b5dfd188db437bf660a10d33bbe9bcc023a3f9c52
-
Filesize
581KB
MD5dfe836b700e70356db732dfbb19afcc3
SHA1686b2a9da37a5fecd910873c250c829523b3e1cc
SHA2565b936ebd5a7a6fbc3562e4f596e8150c162f89891084a11c9ef950aa56611cb1
SHA51254f30154ed7894e55559cb1c584e794160a4251b5660be8d2a31ff8c45ff872a2fa071ec938baedcdd9eb61ec089117b29edc5b57eebfa8889b77528523a283e
-
Filesize
581KB
MD5218f55559782ed9e1edd2e1275e583ee
SHA1cf5200a70d6a13811f1349f5ca188b9f856b1bdb
SHA25610c0496e06df9b50e5bfd78ff3d7573c2700c0cb359da97eed300d2b85f6c259
SHA512d86c6a72ef92997d0190c0be9528dd1855fa558cf8ec7e228aa144f1ce8e7c1150ce9e607183d54665383801502a31f34bf295d211a844ebcf48030bae124d22
-
Filesize
717KB
MD5ef14da0e7f69dd730d68bcf7bc192ac8
SHA1a1afcd49a3de1948c4b76922b116d738378b942c
SHA256acab9848d3935b88b059f256c9a965af9f84d12ebd17f512610c6c19f0a587e8
SHA512dd6f049ed94081c004f170689aac34b6413faf587abce69e4150352e6d4be9e0e74265f0ceb9cc486ea5b90e242eeef96bbffca05c5c2fa67fa9aecd34386756
-
Filesize
841KB
MD57c962a1242e83c9c0d99c3966ffd645c
SHA1eb117c2692ead0f8fbbf7ec3f0a50a9300f8f39a
SHA2564b6930893ec8fd166eceb6e32cfc2bedb1eb2f2fe1ad10adff15ed748a954ce0
SHA512aef568bbf35f4812a87579c8297b10aa58c9c2e2ba08a4dd47949cb0bb46ed3c30ea1a62d0a39e5ba67437faa8c716371d20265fa9827eb2049d0161314ee308
-
Filesize
1020KB
MD573ecee2481e5f48c327ef5d69601e12f
SHA18e55fb4446a7d57a91a8579a5632553e940816ad
SHA256d97a5ec016f164a822edd2ca07e773f1fc2e9c8b6ff347ec2c26f21c6c308d4a
SHA51267e86f07e15f8dcf6d4d7c70b756029a2b676e9fc49ef904be362e7a58e4e2db5274cbf9b0272abb3bdeeee5e726d4d350c0505a50a8fbf9104e388b98a36242
-
Filesize
581KB
MD504620b2d885c3ba9b3d0293300b6de23
SHA1d596457bd393079b423f1f8e4c3428dd3edce243
SHA256f9f27be5eb164fe9bca0d7f2658deb6d38a241ba8ca31b7e0ad26cbc7db49778
SHA512e842ddd59b9a9733a6688993419568e5889cc32d7b2c4d485514831cf4e2b274601b9043d6281b0533b094e7183fc2a3e5f1598c1f44b0372d7a809fd96e307d
-
Filesize
581KB
MD59d6d3a8d4ab6718512d90bcc902a6662
SHA10d41c439adcf67b511c75051411d02deb1038212
SHA2566512fc288ff757acd5e7c28393cc960a7e58e4be7e7a332907f3ca85e638633f
SHA51260240f60e05b72b8679d3d7d3f997117cd487f99415f4509d50f2689bdf9c60959cda211c77fcc0bdf8b084e6172217b95580b107ee41e4fe5d4f6d627f9eb27
-
Filesize
581KB
MD5c36e8e317e827ec2ec6fd4a911e2e252
SHA1ce932c1a51ad8abebedb12101d02e60ac28343df
SHA256f93e31f089a7b520bdf84bba9761f6485149472ceeed0ca05ec641e0c04b29b4
SHA512a1f342e08bb36a923c2538e916d9bc014b070afa77fc2dcdab7ac16d20b1a154e62e802acf4f89cd49cb2b9fedb2494d2ae97390422254e6b0140b4582c8e456
-
Filesize
581KB
MD58c83d99c059ff6afdb9f24160d2dc76b
SHA1183d6fa4538cdfb2058ce9ca9bcde442a3ed16c3
SHA25680d778ab53e01957e63756debef9598dcd2ba4e7d6141732229455a35166c79f
SHA5126221d53edba6c0654e24fd3fedc2d7bfc9606935f7d98a61643499923cecfa1056c4f3d8b091eb5bf04850a1719486c2e3ab1fe9bcef86fccedb2d3c05357be4
-
Filesize
581KB
MD5fae5df9d2b02ea90dd94b51c9434c08a
SHA1562fc3ff55812f077041d1836b3df117dfc3e9b0
SHA2568f14944e679512f2605f2cf54b7703feabdf5c1ba1dbe6c8411c07875bc2ba1c
SHA51297e7080273048886230a2be146eb3979a3b6b66b7832cd363ec9d5a3220b8d36a0dab3fea3d8b5311f7c3e88ac048468ec6b9338cc1ec2cf6bd1d63498f2f64f
-
Filesize
581KB
MD597cd4d525393babf771745516984f46c
SHA1430f1fc156f12fddc9d0351d93f25e22b50cdc19
SHA256558f6dde351c76cd7b20eeda1f410d84dc64d5f3e06b48fe1e66dd66eaaceeac
SHA512c50fd7184fa86195c4a82e8315cfcfca7a33ac6f695701dae269c352ad9fed15d3e19ae1c82e6c4a83ad2195e351078d2987d14262d7d931336ba0c5438ddb72
-
Filesize
581KB
MD59d3369f56e6598fd063611eedbbe1190
SHA19774d61ad1906546f492894575b2e77f805ff147
SHA256a98b62e1d9b780e3d99be44f4295f114c68edec747b35b5bb49d9ea9f62eb63b
SHA51213a9575836d35b2e9e25ec521c6f595ff581164d82ae153882b652eefe6fafd5e74ca5930e2e1a79298f345be22c7b3b55d95239ffa5f3ae6fbe05e2871e5908
-
Filesize
581KB
MD5586a663203f85d5d1608c25a64e0b108
SHA145e96da9f5fef57b4b5d046d850f6da234c9df14
SHA2565046aefc53fd9fdebde8e41b404d6ebc5737a6af4e7340f7fd22e34546ec3f97
SHA5127115d23586115bde3a38d855b370dd461d6f4d56a427ac7396d44eddaa2e1b4fb95640147b7e143845abda0d5df438e417d73a7264a5866910f3a2f28d281004
-
Filesize
581KB
MD5ac9247e65f85df66b0f5ad3386f95648
SHA1e883c45990d26269fd09c5cf339ed7239ba142c2
SHA256ee9f445afea9886ffa03bb492a900ededc238f37ccca7da07cd260eb48d846a7
SHA512e7ddb811dd622d6b614b7f8071a8fbae07127c5f5b9a5c50ebdce4b2b6eb0e4a81c98296afcf7c04bcc9e74763f82ffbe3ae4dfea2d40ffa9f2d0431a8934497
-
Filesize
581KB
MD5cd5341606f4fbba53b73512e186077c1
SHA170d7991ac6a6e535da9b3c6c143e93ff7d74f45a
SHA256cb89ab80e2de8b53cea7b00b75dba168ffe0c1cc034db96e45ecc8d9e3afcb43
SHA5125bd7a1f0e9aa3cfe5be9300c3674845416cb2da82d2607a4ec57e623958de0a719f63e4d5128502b8696c3b785bed5091dc76dcf18bc97c4460a4c407d7a64aa
-
Filesize
581KB
MD58b12c512b4d5488dc99cb2fdb0fd05da
SHA1ab28761ba23422b9c9acc581a0f8064630650f71
SHA25689d13ee7f89f22175996d159c606cfbe8850d5ea2e1eed13744738ff94ccdcc2
SHA5125b07ed677c80a02661088e41247472f8e1f5de83cd3ba3aa2dba65c36ea67766077ce61fee6079f781fb56c79453cbd6cc90266256316632c5e30bd6d8ec5bef
-
Filesize
581KB
MD5874425aae6bab42f1a9f9ee2a4893292
SHA19c52948acd332e5965dbe1e3e3f9e52f2e73208f
SHA2563c47b6024b84282a9e574a0a78ec3d748d891285ee54a3131ed4b21b7669e996
SHA5125cbc3c1791235d2080ac3fbbf4cfd6e5efb711160142c40b14130238702f1fe3029af35ed34ad18fdfbe7545ff2cec4c1bc1a744723b4dd0745d5cd2ec5aa59a
-
Filesize
581KB
MD5963d24ce2218bc2920357bbbb318dd8a
SHA11212ab598d3298c0ec2c638e9aaddeed0025db7b
SHA256551a7d95baefdd7ff667f452cb1e8044d7cbc81a2f3c25597ba7eaff33a23ba6
SHA51299827e7284f143bb8bec2c1045f7c3a92eda0f43206fa9fbd7488682e5bd285c53a02c41a4fa18fb9d189bf5dffd5405d6256a1d2228eb3b26cdf383cd5041c5
-
Filesize
581KB
MD56609d87f5c4545a8c0d6aa4b272c396d
SHA10d35b4241bbe5df149e3d7ead7c3b9dc2a6f9c93
SHA2565b46290982f4c2167d05203e95f7eca9dc16edb5a9a6b0190f26fa53757ec92c
SHA512ea2419a269e3f241c6c8c014f186bddc2aa7b4130349166107a041b901d6a26b6b60975f1cc615a9d165fd612a0b9d2333070e273006a9edd9316fa1e4736b12
-
Filesize
581KB
MD535a2a1030773eaa7da89519d92b295e6
SHA144b1982b2681ef06a8aa7729191a5811767b512a
SHA256f84552385d4dff5bfec0e3cf72e3af8c36b97810bc2f8d4df526d1e1d12e9790
SHA51296cf6dd74e5abea558c607c8efcd358dd1e7d876675deeceb41eb8befab44c6bfd6e547e717d9331b3987c6c0530f0fe0928b0e763f7e5fa87e55f0e31445108
-
Filesize
581KB
MD59448ca59ec23a014ea57781583689177
SHA1adcd9bd42e4d27270a4abd433770b1997c1216eb
SHA256d1585fc0747cc8f722e74bbcd6ec43451a94ee1fbc4885f184b4a90e645cbe13
SHA512f1740403ffe2adf3507a72d3ee01647a746f5f3052126cbe6935c2edf51d2dc7b371d26e9c588ea865cdf5e55c1ca1dc6ca71cce0025e65dce56e313dc316793
-
Filesize
581KB
MD53b139eeaf0512fbf5db0ff1fc5a8ac43
SHA136ac321f5d66c1c6df25f5bdd8e50aecbed54cec
SHA256143aed3ac91dd470fba7f99c007ac51176978259cbc06282a030a76eaf229ec3
SHA5123650a766cd85b31a2fba186e7c729b49fd9738284ae5f6f50baf0d630a791d19324adecf3a5c79cb083f420fd0b890e9ad5b9f1b35f4abedac285e8fd8f5c68e
-
Filesize
581KB
MD50a3eb2fb383400591e5937f464db35bb
SHA16d4bcd1f6227d3b3f8272c6c2ce4271ff3212af2
SHA2564c2b7c4e81711b274b2523214fe1cf9a3603dd6dde2ae12d3fec9813e4722413
SHA5120987a3ddf3dc7fbf2a4390bf121f3dcca09d526c301c53b3f5c027a575a6720f8eaebfcdfd9c7c92ec1944ae43b94e52b01782d5a9e019f79faef655aeee6928
-
Filesize
581KB
MD5ffba04cd674ac94c73fc738aa62bfe5e
SHA1a0259179a03a00db4969c1c05c79b68eabd18d38
SHA256ef23ed09cdb9c95244f4c93aafbf1cd9a47cec0e249765ece9a4d01b7b71302b
SHA512c3f873a8b66a51162070a75f31e96d4781e5ffaab52e057b5cc080172419cd5c7946d8bad9ae3b478b92cc586eacc8dc3569dbee80427b81ccf8e5093efc035a
-
Filesize
581KB
MD560427572a779676f3ba78f85ba4e1a77
SHA1417bc40af5b06f50f2a72c645f90a8ee67f5e250
SHA256727875cb256a8a1719c8bd83fd66dcedd1b2081d13933548e8749ed6a0346a9c
SHA5120a681764e80da9a3a225224ba41e79d8aac1abb892551048326918d25d905b22e7435498b9b3ea654e6d608167a7e334676d08150ac020a2e1302792fa067be3
-
Filesize
581KB
MD5954704f181de13f35e28f1cd3a7db843
SHA1be8fdf5a6fadbcec4e55b33f260fad17a82876fa
SHA256ba5a048c408e54e33945ac726481be9b8f5220f5e5fd24dcf4af7a9694201ee1
SHA5128f264cce66f3c573b0625a0421651acaa50aaaedf6a0d853f92d0da91d04e13def7e15f31eebffb53eb8a7f417025b6ef6aa201317aeba4d4f18da77539b637e
-
Filesize
701KB
MD5fe584dcdad9a35f8636c99e64577820e
SHA19fe605785ef10282048f004d74cf5c75b437c116
SHA256567db9942b82bcc68377330b274f1bf7b9a6384aace40ed227f96676a713b151
SHA512f3d77258b29694081ff105cb181ebd538c8f84217dc937a7a96e0192fbad7f9f10b9666b17d036840f9bd1f3f626f9d5b262b1dc427eef2ee1a1fa20bcc3afc4
-
Filesize
659KB
MD5c96cca02225dd83895fd3100cac11560
SHA11e803080b455d52b2acafee24cc1e905a3f63037
SHA256c273056f1447c2e18b10ab04833ac6234dc29f4f5c0cecb6b23b09b7379cbc96
SHA51291bcbd5a97d6161de2bd66068628005090a0baf8666e213a8ebff6df839ce0510663ec1bde7675f71b889abe5c7688ec1c5b9d47843a1cf52465a99fed678c3c
-
Filesize
1.2MB
MD523f76f559f36594c5d6df6585eb02a97
SHA1da57fef9c2a656e4165c721632184b6d88bf0c1c
SHA2565ac6fbdbb89dd6773a6d3c46f150c4c571cfcf9bdd26a72bfabd927d94236ea1
SHA51229f6b377e897080999ba032cb7bba0f5251a92b60d16c43f4db53587ee940e27be5b4624a5c048178fb8a796883e9fb4ff5176ec813bf0c7b016f91719852fa0
-
Filesize
661KB
MD5992116637f68384cf628cd7ad2c08c53
SHA100d1ce9e097366aeaabf2b781f40e4e20c27bf4d
SHA256dceefda97759dc2c381e6d37307fb6d3d6f6a81d611d3c39470972be475f4dd0
SHA5127dc3df828565792472902f272d81ad30d78d1f54f32ccf2205d9d33d82e088da7bbed2258f72860fccda439618b9b8ea3de52a7fdbe4af042739be8e9bcf3670
-
Filesize
1.3MB
MD5e88038b0b957f156de00cdbd1e7e9ad8
SHA1f1feda27b9edd8185691eaf8bfac036e23a8dd6a
SHA2564d0604f55303167b325f6f06cdd6c322423f5afb8bbc081a0dd81728911a16fd
SHA512952585f2ad765553870c6785e85cca7f0bcaac4ecbb0bbddb36c898c3d4777a0a0634cef99517fa3438f71f6eaebb9296cec520be9a7ca1c065c7c2c61b07389