Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
30/05/2024, 23:23
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-30_e793f5677e3922f04fbef45b3f9c5c04_ryuk.exe
Resource
win7-20240419-en
General
-
Target
2024-05-30_e793f5677e3922f04fbef45b3f9c5c04_ryuk.exe
-
Size
2.2MB
-
MD5
e793f5677e3922f04fbef45b3f9c5c04
-
SHA1
6d5cfed1d16d0b94427a9d2ac938e0637a64cc46
-
SHA256
c70bbf2d4848219ab56d06a030a693a03dfcf155f9866297b8cdbca9b1c73f38
-
SHA512
c96e82b2ed9e33404bc86023d386ecdcaf0b7d5fb7ed650759d23af0df848daba3205abcb190b4ae825ebd9bb40a35fc1316f144db48251c6ff0ea2ce8e59d95
-
SSDEEP
24576:vOObVw4TaN1wdFukCba4oXtgLhU3wEdmh589UOoTqy8QCYrLLeYKUML:vOOh3aN4FuLbegmtGs/ouy8grLLesK
Malware Config
Signatures
-
Executes dropped EXE 6 IoCs
pid Process 2644 alg.exe 2892 DiagnosticsHub.StandardCollector.Service.exe 2420 fxssvc.exe 5064 elevation_service.exe 1840 maintenanceservice.exe 3248 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\System32\alg.exe 2024-05-30_e793f5677e3922f04fbef45b3f9c5c04_ryuk.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-05-30_e793f5677e3922f04fbef45b3f9c5c04_ryuk.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\acaf261cb4b1389a.bin alg.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-05-30_e793f5677e3922f04fbef45b3f9c5c04_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-05-30_e793f5677e3922f04fbef45b3f9c5c04_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-05-30_e793f5677e3922f04fbef45b3f9c5c04_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_99718\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_99718\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\dotnet\dotnet.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe alg.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2024-05-30_e793f5677e3922f04fbef45b3f9c5c04_ryuk.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2892 DiagnosticsHub.StandardCollector.Service.exe 2892 DiagnosticsHub.StandardCollector.Service.exe 2892 DiagnosticsHub.StandardCollector.Service.exe 2892 DiagnosticsHub.StandardCollector.Service.exe 2892 DiagnosticsHub.StandardCollector.Service.exe 2892 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 656 Process not Found 656 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3924 2024-05-30_e793f5677e3922f04fbef45b3f9c5c04_ryuk.exe Token: SeAuditPrivilege 2420 fxssvc.exe Token: SeDebugPrivilege 2644 alg.exe Token: SeDebugPrivilege 2644 alg.exe Token: SeDebugPrivilege 2644 alg.exe Token: SeDebugPrivilege 2892 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-30_e793f5677e3922f04fbef45b3f9c5c04_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-30_e793f5677e3922f04fbef45b3f9c5c04_ryuk.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3924
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2644
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2892
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:60
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2420
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:5064
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:1840
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:3248
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5c0038b4237256f55e574fc9c6cd64c71
SHA1b5c46b6828b0fd9647087afe2a6b39697622ca9c
SHA256b3edb3c61311b57f9e9fc765d18d7f8f8d9cb4499baa6afa4310468bd225858f
SHA512339bbcfdc3ec0ce41713e7e191b236d44810f53915b527764df63d679b5864f5840b2ae308a9fadcba9298d9b100f075ff8a35b4b83ae297989bb33105b1e5cb
-
Filesize
797KB
MD5e626909394227b2531fcb8eef5de8ff5
SHA1339fcc43c063ce577ada30729a659393fea5724f
SHA2561c4372cb8df3876567ec3e705f98fe695ed9c4c7e5d29c5c9899e5a8207cc284
SHA512f22a5022a0c27b6831382c8539e012cdc4f9e517a269edf5cbd0b432a062da04ff872cdca6ae1b8cf36bf1d3cd191af8dc55b69b6f3ab0e50897b25bb8159060
-
Filesize
1.1MB
MD5be0d69a1403e11448f26f4c3b8e7272d
SHA1336d62d341f3bc3de71aabcaf215d3e94ae2f705
SHA2566e754ebb019d8eeff8bf6efeca9edf17175f809375818b67814a3f8ae16c2850
SHA51296566278c3dc108ee59674af2566329282adeb8c011c23fab9fb2538e2f1b43f48f5264d5207283cc60ec31cc5a71f90de41df311e1d1b0038b5163538261478
-
Filesize
1.5MB
MD5f9d61b7f52aed3c8a8cc27f9fae0029b
SHA10f40969d6f2cdf88ec272f3ba425dec4c8a3da2a
SHA256397f7ba324656eafa4a4debc75363497d0266ec9def6f1d78db434f5b0fd57ea
SHA512f61ba65f6377748e85fbefa04d01e8fa6fd3e7c42c3d5b598be959254f4af432d8b0c3200750a029e8bcaedfe1b7b54f74a85fbd8e7bb2b24703c3536797ad8f
-
Filesize
1.2MB
MD5779d5c00165e1b563f0cef0a9542bd46
SHA16cef3ffedb99791714b6b021721f5e7addaeeb37
SHA2560514bf22e71560e121aa839e3c0047bcfdee9ee9e9133b35fa95143b6e6f8613
SHA5124e5bb12c7a316dc370340f0172cd15b97b50167b7178b302fce632e68504d9f5ba518a2955fdd00ef0e399a4fb4ff540076b9e0ff064eadf51d66b3f54413bf1
-
Filesize
582KB
MD59e48a181fb6c95b13dd2e8ecc189a26f
SHA1c897533e60fcda12e2da5cb9ab3a3a788daede2a
SHA256a85fbc7fffd35a941b223f673740961382b89c59453b02386e42b5f3e16d3c45
SHA51265ba39cd4497f9c7557c16c61abeb50d9d0baabc3b380b0c88592fde65a04689c75a0275b7e073f8af97d597539d60e060d914bd5e04b455eceed4afdd1200a9
-
Filesize
840KB
MD517c2183041844754b5a79c7b4cd717b9
SHA1714de2c9b312d9e2ae7601a4996ff408cc0c860c
SHA25647df9e0419b83e6b526086e364ad4a9ca41f5d19a3e7c57ec79ee334997f1f5c
SHA512a853ed7b0ad9a19fea89f78d6a8a74c97a06327e5915430c46f401310d789ebaf71e3fd4d55d0eb2e991d01f2002e64cc35a8a3cccc687f7c4f94553732b4c0d
-
Filesize
4.6MB
MD5b10622494c72c0d267abb45953e49cde
SHA170acee4235b960ed8ee5f56ed779ee0e5c45b1ce
SHA25651a2d579190712281acefb73a8cf9667703aaeda9851ca7ea98f603b7b534e71
SHA5126cf652ff56f5330410bddb7d86442654879dd28f81fee218617cdae0915fb93572c0c98b598d39a68d2173fd8b5242286f2ba3123b60281fffd77b54548a91bc
-
Filesize
910KB
MD5a65572084457cedebbd301963091ee5b
SHA1727b809187c2f5ba53f6015fca4b639cedfed7db
SHA25681367db06ceb51d5f98e5741a7cb7bea1a85804a6b9b2ef49c0325f89946970a
SHA512772cd90c225d47c98555a6ce4cea48752f8af979c1301c71eaa39091a78355e21a81066530fc5bd1d5b34f922aa21a94449dfa9f3ee536db7ed62ee091171790
-
Filesize
24.0MB
MD5399b40fe0aacf1a730fe79c21362aefe
SHA1a31d505d413049a0d48c9ddef154ab447a0ceef0
SHA2569b4a8b39d4594119fabef1b752534df57f7bf894576389e39a685c74ed658810
SHA51218d804832515ca0f74f5468a98c9fc0dd16ea557f7b3cbe9bc9df7f1ec5886c9cfe320b80c66e2bda889df17c665f4007ef3ba7f708d6a2a23276468dab10884
-
Filesize
2.7MB
MD59400660ab1a6396f6f0576d8fc8b5953
SHA1f7a96dffe34208dc693ce20e942f2917d9b3d906
SHA2560acab6b95622ee60b4bca376203febdf0eecfd63aa5ff798403cdcd0a01e885f
SHA51243144e3cb864ac332462beaf5b748e8d1ce5ebd79caafa38e9fd69cd71be5e6b0e12d48ccfd43b950b9eb4f2428aaf64ec8cb32d3fe6fe95a485be56ee2d9914
-
Filesize
1.1MB
MD5d2a0c858d1852da8eb334fa49ed918ba
SHA11948ff744306d197fca6878b69aa00b229e09017
SHA256e73116f53c34d03521fd3c8cb5b5a73f1bcc52854719e41bd0a4b890b30fe5f8
SHA512fa325efe6385a588e62155a10e99f4b9a0fdab41656eeed4ffd67aae1c071dc16d7c1ad1880a33284eddd5a3a7fbb1973c64a2e101ddd5be221674e5f2b87b92
-
Filesize
805KB
MD5e5468e77dd557c7aff4f759d8f103802
SHA1146a3b25f4fc5137343331789e10c2cb8744d45e
SHA25610da339a0026828f5e61e7a46ca636e61cc5133d4dc3d388cbb7068d4e83ab69
SHA51206b706ad41bda090b422914c323ca0562643a74d8736c3a6ace3fd71484b1317f669858679babf77e99e0bdef1349e809f2693a9f5d4d32ddad59a8976d04c49
-
Filesize
656KB
MD53d41c857414000d132d0cd64595c5850
SHA17641ba5367461a4c5727f1cfc8161d1302834fcd
SHA256a7c2066c8203e5488f9cd57f58b6c88b23c9821a42076de2361b7fd98ac87ad6
SHA512a3f9304b79733df21b99595769c12cb5e16dcbeb4bbc5b5dde3588f5c6e8024d19f2b15c17a6a7e981657a33ad7d86b1af0b780d9c15b420a0cf28253df6b9c3
-
Filesize
5.4MB
MD55e79377fb68485a568330617d0f4ee8b
SHA13f2923c1060d93c5404387f2b8993e779fab59a8
SHA2569ae961ef82cc8883b7b65bababbf0dd3f14970fad6d7edede928dd819a0dddfe
SHA51256b71492c93f8ef0115bd612f1fbf6614cd2bbd1bf9995a7ac836a999d648eac333225fa3a3627a73685a7d9c0d72dd22028d0932f83b9d2d761402ebe78b926
-
Filesize
5.4MB
MD56b84dfc7c3b769d710f559627ff08285
SHA1082aca14988ebc84f90dbb25b8c1fe6a0a7837c0
SHA2566455fd84b1ff6aa2021d51910135aa88af707cbd062c79667a653f5109d6f4bf
SHA512370157cadddbfdb49c56a93fce46f290373c1520b65cf672a9adbea9daf90be050d8a34c40b9c1ef5b84d16642fbb170643996a6d80bc491e666f5fc862022d8
-
Filesize
2.0MB
MD5441b543ed135520393c051cfe572914d
SHA1eddeafef380d3dd7ee620c3c486312d349a5d264
SHA256ee88a467c10a3113b5d3b3cb23c86962ec32c700f624d2916cc970584fdd9070
SHA5128b995f41294ff529c50cdd72bc48889e6761ddb5199efb10a50d1945a4736002f6978a40219682ff05e357bf96fec9667681a6e642b710a97778e480cf706853
-
Filesize
2.2MB
MD584dfcc2d447d0d6011515791e0a91e23
SHA1bc6c19c009fd4205a45d626881a9754aa480bfeb
SHA2561501728273b1184009458925efd99a7367d52c151c859931c00ba0959c851a3e
SHA512e5f3aadd1e04fd4b851218787c948ffea26f75e3fbce69c3dfce1d220b70dcf97e71bb9a0d90d52473de5f08dd6a505f7c06f6b4d4ab49ba92a08d6627c9ec30
-
Filesize
1.8MB
MD590f232dc33cb1965f4ab08f6519257a3
SHA1617f3cfafc9f259bc5b1e98ba677b675acca48ac
SHA256da5a47b4f4574fd9e3eeb8a46027c228c42b170b5b4a8bc43bedd508cb7d07bf
SHA51278528deef52405e6892da240159fa721cc30897d9c5c1592e1007459a8060380399388325912df597b6126d7f36b3df0f97709d73043f80b4b057f1f1f177602
-
Filesize
1.7MB
MD5f33799c6a9fab9939800d41adbbda8e0
SHA1c705ed4200caaebe3bc01e69788c6a72acd05cb7
SHA256feaf619eb6ec7a8b6f1050257456558b576aaa4fbe65c04101d1cf5a38d44f8b
SHA512d9561f94d21f5fa509f3fb080cc6485ecf9cc3daf9ba5e746ff9cf2ae1ba8979643c01532a88eb17fb72d21dfd7fa39e15ff36ecb1a09b34a5e0423d8f80787f
-
Filesize
581KB
MD5defcd168ad2c5acbfbb343c23a53f434
SHA1e1a14faac016e64e7b23667a2d57fc2ca84a2b9f
SHA2569f0372e96d02296ae2bb541667d6069c02cba9d6af3c34d1b05a6d116d5f4ce7
SHA5127bc2309507afd3ae056929fa3e210216bf36dbf7e62b6ab73cd8101f712ccfcd67aaea2f07e4ac4e875f97b39f6e0b77a31d4b94e0a67b3514744428d5d37e8a
-
Filesize
581KB
MD5159f0c1b43133a763a1fc4cf85d4603d
SHA1f77ced36233d85d04bca6310e3ec816c1c09dd33
SHA256eff0ab302b54c4453b953c2db7ae0967fed7e28b2390d1f46073bbe0578a8c71
SHA5120a70fd06f4727e3177c74020e3e7fc2188d6a89daad1b3ec27e437f9fba9855e9104ed4fe783c7ee303cd8f948687dd0cd9625451480f76341a97f01cc39eee6
-
Filesize
581KB
MD55750f3829a1c6ab225e31f038ff07b5e
SHA1297aed7f560aa8ae9aa38ad878f881e47cb43b95
SHA256755f3338c8754a8116bc60b19739f06c5be84c4d08fd98721c3b5e71b3e259c6
SHA5128c1957775d9eceae48a4f3046b5e70309340787accdfb84cd0e278e74fe4039c1e6adcfd025cbdcb11643bd8a300b558a1a0e46825f587dc4fb52b208e48e4f1
-
Filesize
601KB
MD5c3c11e9c0e0ea8ff3c07f5c0b0f60fa7
SHA17b43b15d7d0ef4db6f8b0044aaedf7bd481642fc
SHA25605c4d50e66b164ec39aa4b2e9e50f91d2d4a576d500d740df39a04d33b7ee4ab
SHA5128cd64834e77946e6ca7ea041c42ab4f1de1a955777675a9c6be0617e4023fdd25b5c63610961be9f447553268da71d1991767ba9d3a1cbef88997fb7ebf1ccb3
-
Filesize
581KB
MD5f7d018dc3cd9d879cdd626404a0890d2
SHA1fe6677b2baa2b076fec3a6de11d8b7ede36806c3
SHA2564464a157c3f2e5c36590c1a59833bf5b97b88b88f4f0f42a32958bf890ebfd4a
SHA512194f331eb94b7a724a08bde020a8fddde3f68abc68cf0fefc0bfe0271563722a22245f098a0b9a6a021525e3a2cd45daf04c21745d380fe9cd222cef5084eabd
-
Filesize
581KB
MD5e47ea953d6ba4344f279095003aeae30
SHA1e17fa8ab303ba96609468e7cf9cda37f94488b55
SHA2569498ec2ef978c5a23616224be863bf72a167ac30f5a495f03d7265cf6588d831
SHA51292b2197997f33d4aaadd59d874fa4cae6ec736c89b2f752c214bbf344fb3569695062c44cd8b96872685f5b07306547de350eca42e862b5674986c2cdcea6581
-
Filesize
581KB
MD5670f78a776452a34022e9e75cc3110fc
SHA11235a4d1bcf0871db085d9cc44cc2a752b589347
SHA25613cc2a02e28732d3d895287db55cb47a5dd21bf5dec96e5bb348aafed3510c62
SHA512138f3d9b033a3addee6e7c5f5c4a10756133ad586c35433db6731650c00da61500fc9932a55b300d6ff63ce3181ad92bf816f07ad68588873277088fcc78d845
-
Filesize
841KB
MD533b882c9ee31ad4b44d221781671c73c
SHA1a18c15a0b805ea61914ff3116c712aadd05a9c44
SHA2566b840f36de34887c42b400fa0a8c8bba61e1cc522a7a278407de4b1daed87321
SHA5121678229316c6e55e9319f7f1faa278229045e21e557348c384356d5170b57267b571aab80bb78392eeb255f35b7ace6b8d28c95d17b9cffa930203fe53c24420
-
Filesize
581KB
MD5d396b56770df5b1a7dbfffa81929f4a6
SHA1f3d22901db50bd45aac751ec2fbdf2627d3e91bc
SHA256201e7d0c40e184b827b893fe9d22325cc5284b5b0a624a8fcec53b40b4b4e4f4
SHA5124b30509ed78a3170727a44882cc976b3c25b341d7c6bdf254c3bf0812c53712dae81f8ac892141d9dfc234844ce1ef7171f0d3c5865aadab420930bfe0a4900a
-
Filesize
581KB
MD5ea1e512ff9b5b9b2effd846250306f9e
SHA172cda7aa07efd3e82a7507a882348bf40150bbd8
SHA2560755ddc3c7b1c9e63d5cf03d95c4be0610e936dc836dc48ffb8adca00bed2b37
SHA512d0dd2e3f5a4b42c93c0a439a9b7504db82944e6ce12a9e5a194f64c810dfc29e122f474151a30d2fc77970f97cb86dc5671f86e5a60b8c049d31d0ede574c50f
-
Filesize
717KB
MD595f153d0ee4d407f8fb11e8ceb7cdad6
SHA16855bd4792d822c387ed5799c18681c4921c1f59
SHA256c2866b9f4db6e4cf62f5e3a93ff2ccac6702ee6425db7850be7b45be9b6794b4
SHA51239dc69a37f8b8915c23a3bc710700abbe7074a3f2f6634bdab5e45a283a71f20e93806aeff8f735f8ebe9885e44b7f2f293d8344b04245367e4038c1d9a8e2cf
-
Filesize
581KB
MD524ab5ce42614cf0067830126ce09fc83
SHA1dc354df1a8a1506bcf230e1530599dca6bcfd9bf
SHA256aaaf933cf537e097f8cc16e75fc1a5a94b3cceff0c297b68e60935a76dd550dc
SHA512f31cf69535a4856a14822e32a9bb40f6a2349287b5351f93029a8dd72611223f84d62b52008ba0a0bdb9b9671f72ae871aac9b74dc70b651055af75c41399c5d
-
Filesize
581KB
MD58736f0071e5315414e00c1b981d1d456
SHA1d27d28574c4fe4b800afa940481b8fe3937871fe
SHA256091098d1bcc34047657022f0b5e3cbf31a5bc525675c0c546ba6169aa688d068
SHA512fe0fa42740a4aa785f95ceba0231ed3abe16fdd77aa0bfe347efb7a1dfb9423f97d30d59dc51c49f92d02a57f952ceef9d1520a4d1d38d4639450b18d96e8ee4
-
Filesize
717KB
MD53c8ce244f255094945d130c558f0cb02
SHA14ae903aefb254624dae9c7db614ab92087f5d0fd
SHA256a95bb8902dc9ca0039468d664fc81922ca7a7cc97e7bae261b4ef41eb2c83acc
SHA512a452f9f08735058f7d6af4d8d6440e109f3feb687ac7d33171c8c0be1fc1cf377d0b9ba469163855ad5ef10f27c049999ab7d7d17c94466ecc07e3e836f5e7f2
-
Filesize
841KB
MD59e64beecb089011d5f921a23b0455bbe
SHA1e04270cedc2a67ea1016c76c93def3aec914d964
SHA2561ebff1f3d127499ec6622c05f35d3aafa94f9280bfa321d366f54b3295477468
SHA512f9f43916073f471fc1470a4f80f8806b3f4357e6e3f438ccfa8795c24a72dde0aba18e3f27f960ad27af93192a4a4bf114a5becdc9af3a41d6019e8e52b52cb7
-
Filesize
1020KB
MD53d84825da00c8f47cbb6e2df53fd225a
SHA14ce08d6ed75ca8f4d277b0a5ac667166a2234eed
SHA2568a58d2bbeadb11f50898cf8818195aef54a00e6124c96755e0a945ac81e35c23
SHA51289d0a37937fadb406ac96b3947a45f8002ef2bfd5059a7e23f291b83d9381887a66485bd6a9597daf6438e269e14f3ee3a7c7509316598e59f36feab5d820311
-
Filesize
581KB
MD5004cb477e368c0735279f7bb3b63ff4e
SHA1fadb26e5dbe16c4575f6cb24bc9c5f583e91f78a
SHA256c3b3c7ffdae1ee96edaa5c854c2c4254973548f64715e949cf53dfb7e1ca5093
SHA51265d7d766536e4c221bb700abe39424ee07d24f27f9f10f419b0448e73c9d5fafd93df919f3f43538feedb6d965dbb448f3b375110b0d9f1664658cb275bb2336
-
Filesize
581KB
MD50024ff8a6fbc3a34cff7b2c7e4dcc4ec
SHA1237c7d505433ae108ff7c2c18ac0dc53d9711074
SHA25663240d20a397b3e7e7b1732e0214434db9f9ce6fc7091afbff84a206844e67b9
SHA51254ea98f78538140a0a363d54604488b670f360ef2e8a2b6fb51596a9fde5299e349ababf1e1430738d42ab88bfb97a2ac5d13a7bc19f50589a33863b954fc4d3
-
Filesize
581KB
MD5b8b3cbad96a5843aa892fc664d7340bf
SHA195fb631fa138548a662b6f4b265199a4c1ee0f06
SHA2568e0fba31f2bfd928698a875ae9204ac9252ca4bb0c2503facd5eafde974383e5
SHA512adb8c85809fabe97ca4ec8645f5879c7def64f89f64ec7bc12a99825811ed5d22338a05e0e3664c9e0f05a17c8fa5f5bb6a7fa71a9d5975083076a76cbf77123
-
Filesize
581KB
MD50fb8bd6b611ba23193939365d3ab09b4
SHA18550ec810ce7b6de342e94c460f81d2b9242a180
SHA25611b65bfe48762d670e9c45e16aca96506ebf5f198d93fbea0f41901d32d8fdd4
SHA5120e2c1318d253e0d11085568e219b9b05eaf3f57a6cf460ba2d5bb8891d0dfc21506392491719cd1eca64338263abf845b9808c3ae0de56f97c9d88cb2dae065e
-
Filesize
581KB
MD5576932ce28dfc3b57f783a750ada4afb
SHA1b3484167c29f4fb17d3024e2802be33869f0bd80
SHA2568ecbb0dbda18106a2a1d8246099a1eecb2981817afb823f7f54a339074e26b0a
SHA51262740d9e0992dc472f9770c37278188f710434282593a8622740d1cd14ac7f6bddf44570f43d6859ff32497dd76ed52ecbe44567c5a5b076804302020426fb4a
-
Filesize
581KB
MD573f96bf06220ef82467316ff1e3c195b
SHA18029f4cf35090b7a589cda1609d63ffb8eff23b3
SHA25661f65676aae45291de484a0847fb35910d59aef867909edeea9fdf54fc70e8a5
SHA512f2fe57a2c1cc0656f0ef0628be90f6b2ea31bb392cdce1bc8f0c538a7a6430a6b97cba8439c833d248e3762ded91c308a66ceb7a485927685a2c663267cca188
-
Filesize
581KB
MD58a0a523ad532a1acea3e1225778c024a
SHA1801fd3571a8766ebeb4f67f920643ca0123d0789
SHA2568375b07356e99a85a25744fece73080d418b477596bd1e519b4c254fd0b6b296
SHA512dd9a28eff52ad368eefc1b62308f800f53f7873e6153066468f8c30e2a3f3767155982848d9a65ce29163baf8dd0a1578daf86e2e97ca1f8afe90cc65a7b2e75
-
Filesize
581KB
MD5806c5b0e6dc3af9b8e7104b234257c82
SHA16c8900647e7c1ca91ec2f47d4b5fb9acb58ec944
SHA25647a676d9289bcde81d2a2ec4eb83a5796175fae826115b9b0204665e047d275e
SHA5124628f00929302f69c36813668844a65ebe12c5942149121fcc664515bb396ab48b3d08782fe45cd6a14a5d7e6915a968a5262002ec5ef9aeb098324a3805f7e4
-
Filesize
581KB
MD58030287aad2e39c92d3aff7d8a18edac
SHA1049af3c5b0b02b5ecb15b9cecdc7d72e8a7c5de8
SHA2569f4316a50cb025cda74cc216c2e66bb345ad8e23e461ecd7d98c5766e4d18a3a
SHA512d65ef20e324fada9151c66291bb125e176a18d8e2199051ba8e03e95f78e664512d4d5049574a710c872740c3efa760f40ebe8e3c34a4e259d70da395918cc7e
-
Filesize
581KB
MD5cc4fc41c27aa5a24d29cf638d72a28c0
SHA150cfa6b04408cc07b8f73a6c70822ee46ec93f50
SHA256887a9b0f70709dbc8fefd515ae091c7697e415e8458f13572bec3e2b097fb668
SHA512e59aa0056b674cbcd2fd3228c9679fa43cebb206df33bc5e4983ef548fc97e01108b7ac1e08da0b4526be8264e4a042732754edf5faf612d35a0cab7587fec5c
-
Filesize
581KB
MD5d6fde33396d95ea335b1c6a857e1e4c6
SHA1d5d23174d547c11602ee9006f3bef1b05a6aec78
SHA2564df692e5f7143f5eddadafae492515c18a5a0ff01ef7b492cf7957cd67a7f8e3
SHA512db2fde8ef17876379fcfdf19701147f2dc0c98c08041c84029a17fe4cf6f43c0744b3928de6f3abf5ca514276eeb38c8f0c88a0f696649ee23a2dd81dd7d56f1
-
Filesize
581KB
MD553857812a2fe1460a4330c17a735a787
SHA174a6913461431b3e53287a2e8a8239e1de457cf7
SHA256a9462b87b0d86b2c8cc4b612a50e5cd878532dd2f48a59c0dc7a073935e8893f
SHA5122439178c54d3a0e9c4d58afeb159b6462cdb7b7d636c34b3c94068f652b498d1ad05ea9cead83948553561edbed9e31b6d473d6ba46366b7087713b2a2beb051
-
Filesize
581KB
MD5c2b2bf8e699cc7971dc4d994e3eb4973
SHA129616870db1741d47f9e911793baaeb4e5aa9d20
SHA25621b93e6c155503bfcf924547fb968014cde9feae91fdab961371b991307c02a3
SHA512af104ec135609da73b3f42ae2ae032874ec98721dee4cca7b87ad9cf983eac9b41ababbf8e0d5e3e5281cf36cfe0aa8943a9f17e87f01c01216ec2ca281dcf3d
-
Filesize
581KB
MD538aef605ad29f4bd691690b48cd182e5
SHA16b0d672d5eac35dccd0f74ef10a3c45660bcd65c
SHA2562d75acc2c850cad73351dbd6cde6207b01f37c3c6362af23913dbbcb3a8ac9b4
SHA512dbda723e646f3940fcfefd33d99ebf4c0466576aa4aa2bdcf89e9e690cb3a3d7d033b54920e9781fa1f3cdd63de827c11573c2a9927be946283c39c6854ec29f
-
Filesize
581KB
MD5e43083626db5eaaa37d4c7b5903af775
SHA13b8811671fddb0e3631df59dc92b2041308765ef
SHA256f40579dd6b5956e5a27e0f816f4d2b7fd7883d438eb4925e06d50e9681108376
SHA512487afcbaeb99eb486b981cc96f95883d745e9689e2acaa08eed228463951c60230bc1c855941dd5c4e5b68a2608cf2e275e92563c1e5614cc4ff42f325b672b7
-
Filesize
581KB
MD5b38f4b4cbd730333349f68f7eaad000f
SHA1d7d8061d8f8f38921c4731348e1bb8976446f5ac
SHA2564a58160c061b913d3dcf4e983614b8d0da5aad070e36506d0bab2dce92902b58
SHA5124e68dfdb5b943ad35d2bb03a0eec9274e799872d1b2428a3d3174da71cfdce269d9db77ecd29732464c1f7943c3c2092660d676c477503ddfaa94e6e64ebbf86
-
Filesize
581KB
MD5ebea02255cf3f0c3d705aa7dad58ca15
SHA1fa7b2cb2e9bf546fffdb4069d6400333b187f510
SHA25640a7d16509819061ad7e151c0b5c600cecf45376f50f84bde526a40f1a2869fa
SHA51221aa45eb9df4d2d05c0974369b0aa58d3bc7e08836dd10cd7cf61b52557d2b4d0ec7184fd896ff806db8b82c41e3216ce9ac841d772207efe5337f5affef3386
-
Filesize
581KB
MD560b1e0d67b6811465264485650705a10
SHA153a265cbd4f579854cb0c776888e5b03f2eed005
SHA25611b1208609d87132f25095eb53d936ac02b897dfd6de291b3d5f93cb6418f679
SHA51214d74b9a20989af1c006fe4aab3956c3522e4282d18a0de9f5918748142e6ec8ae114b1f242b9e90b1ee62960fa408ded96a4c9b2d115891b2c2071d27519b92
-
Filesize
581KB
MD51535bbb7e89d6ce1fb1463f66e30c519
SHA18d8ce9ee061f661cdb3483d79139b4af96c0b27c
SHA256a692cfe11e5cfc915f109f2695afaea53d107e8eb07d0e893f7a20212c294a23
SHA5127b6879e7d51617c3cb92317d0e795cb80725dc97bf5ac2d4def16fe0b273a5d1d8f268eb3bdb074bcd40a5a8a04f8f219d3e02c3926ef9b9a55e1320c5c6f603
-
Filesize
581KB
MD5f7dd963c752befc31e5b8a5f79fa32ff
SHA15feceb4c411705bf63d2daa04957f5e4ef5729fa
SHA2562df38506046814c13834126361c68ac81422eb9f86f80cde1d3c6fb25d141cfb
SHA512e1912807458d6b00fbdb234ee9dc6d513d16060aa4caa459533d930c991c449ffe17d7c75fadc196c59fbaa1ab038f21add61e14c947959ee66774bd02c9172b
-
Filesize
581KB
MD566a524c0c33299fff13fe9551daf0df9
SHA161f787c5fd499674a6255ca800ab0bd4237bda96
SHA2562b86f2793fadfd620aa457006c1ef231181910f32fde01287ee3685084318b8a
SHA512135dc6d694fa7439207fbbcf1b44f09ef85bf775f46ff792b557e7a4f65862d462422c6841d7d591b25dbb31d3f70b6e0bd0fd1c93ec51fda3f7240f29b61efd
-
Filesize
701KB
MD535f5b8057e9be70dfeed17ce4386fad6
SHA131f0f3e63facc2333aaae682b5633e23f0d1619c
SHA2561ddf515002d7eb7008b473f18fcfc3a1c84cd5c522f436e72c6697160db8a420
SHA512c86831f0c1cc5ce079d2faecf9d5e35c9b6f31d2e5616b5bae4de26aed6afeb6f6de4a2fd3b474d6b2478ad8645652568e106f63f8f1e4cc89ace1579b5a6475
-
Filesize
659KB
MD59ce8ba964c04a0f4d84ad9de0d95737d
SHA1f59bb765c2964e84b6d0e6bd8b618dd71b50922c
SHA25617dd9711717675af2531db3012be61badec916ab5515c8be5b530264751eedb7
SHA512c9e6ca3ebe405d2cd6ae3a93ae480b4fdb9bcdd6525d56fd6c5c13c8f0a53193a644ca0e9bb3c8753adcfc0dd611fa9e37c3841fce0afc147568b5cc70cd4a1e
-
Filesize
1.2MB
MD5ff4cc37ac3e003911b766fbd5659b79f
SHA118d80832b37a38ce03c996cbeb962862737d5704
SHA256ad37158bb85d8ad9ef9c4b15ac51f3f3a0795fe377e8c427f7421e4ea8c71989
SHA5122fbc89e08eef5954491a1425744ee3b05fbc092c5c30547aa494a7edce40e1260eb745477006f91ad955af7bdee177bc0461f7da558ef599574fe0ba02effc6b
-
Filesize
661KB
MD520783bef54664e1586e2db174c7246ad
SHA1595eade712537d296ac1c9b78d6254463ade993a
SHA25634d841fd3f6a6cd1c5beaffc01223214d426052e8c345ee4970859a03d336e5b
SHA51292adb536e369414aa175cc1aadb10342fd51d55bd377e69a110fb49bb0d41221894e6ebda85a59ba5b4e080acd2cea9b67d12f05be1585dc1cf9af1ddc7896c9
-
Filesize
1.3MB
MD576a11d8e1357d62da1306c72f58ac40b
SHA15658d48eedffd4abad984716637b994e5fb20f6f
SHA2564d5803fff0bb78ab00c3ac4f4da680c4f67eda877a4395fc0a2d121bd0fcc179
SHA512e4aa18db54a7b767ab63cc715a0cdd9a2f00c5e9b5370f4db60fe063ccdd1544a3641a3328377cc22d82f2c20e00f730312ff1753a34334ad60ec72f03c66812