Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
30/05/2024, 01:42
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-30_1a876a9779d04aec875633f1f9ae83de_ryuk.exe
Resource
win7-20240215-en
General
-
Target
2024-05-30_1a876a9779d04aec875633f1f9ae83de_ryuk.exe
-
Size
1.8MB
-
MD5
1a876a9779d04aec875633f1f9ae83de
-
SHA1
7ec628b83786060a5028ff9e8a7163c21993b35e
-
SHA256
64aa2cabdc3ef521e9db3e5db52367a39075b3fd23b6d1b3701daee1eb38d622
-
SHA512
5335149b341e70ec744c3b452a1f9cb03bc007d19d4946fd373ac0a490294c0eea3d5cd2a36c64d848453df5dda55835d19f0a284d1f79c2c45c4b9a800f6db0
-
SSDEEP
49152:dKfuPS3ELNjV7IZxEfOflgwf09/snji6attJM:Gm9sZxjgtEnW6at
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 3484 alg.exe 916 DiagnosticsHub.StandardCollector.Service.exe 4512 fxssvc.exe 4876 elevation_service.exe 4864 elevation_service.exe 4668 maintenanceservice.exe 2240 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 11 IoCs
description ioc Process File opened for modification C:\Windows\system32\dllhost.exe 2024-05-30_1a876a9779d04aec875633f1f9ae83de_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-05-30_1a876a9779d04aec875633f1f9ae83de_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-05-30_1a876a9779d04aec875633f1f9ae83de_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-05-30_1a876a9779d04aec875633f1f9ae83de_ryuk.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-05-30_1a876a9779d04aec875633f1f9ae83de_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\b3d6d45592be0f3e.bin alg.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_91015\javaws.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_91015\java.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe alg.exe File opened for modification C:\Program Files\7-Zip\7z.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe alg.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2024-05-30_1a876a9779d04aec875633f1f9ae83de_ryuk.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 916 DiagnosticsHub.StandardCollector.Service.exe 916 DiagnosticsHub.StandardCollector.Service.exe 916 DiagnosticsHub.StandardCollector.Service.exe 916 DiagnosticsHub.StandardCollector.Service.exe 916 DiagnosticsHub.StandardCollector.Service.exe 916 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 676 Process not Found 676 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 948 2024-05-30_1a876a9779d04aec875633f1f9ae83de_ryuk.exe Token: SeAuditPrivilege 4512 fxssvc.exe Token: SeDebugPrivilege 3484 alg.exe Token: SeDebugPrivilege 3484 alg.exe Token: SeDebugPrivilege 3484 alg.exe Token: SeDebugPrivilege 916 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-30_1a876a9779d04aec875633f1f9ae83de_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-30_1a876a9779d04aec875633f1f9ae83de_ryuk.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:948
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3484
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:916
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:3956
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4512
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4876
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4864
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4668
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2240
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5449ca8399844b375038ef53aa42ae9d5
SHA18c70126f3f86ac2659b76c06b05dab49193d3627
SHA2560a91cb34f0b5f85f4d5f8d32102a9d1fe6a62421202e4a5fa051f90488073af2
SHA512b94e9700dca63222ea5e0e4e1e9dde8552778eea425479b3f87203662b6830858041889569b1e83af0f095837f567687c577136e3e7f759cf382e61fd88253df
-
Filesize
797KB
MD5230d09117440c123533dc28f02777359
SHA18cf229f3a836d09bf9281ceea5db1819790d4900
SHA2568cc5f6ee799f183c70970405f60041e9d263d0555e1ba01fcf69e2642dd5bafe
SHA5125d383b2ed82ecb42e42b1ba5fb9aca67f3c623f737d1c226f6c50dc617f70e807542c9cbf80445bc95c4aca100c944d06c68f151a24842d48402816f63856a8e
-
Filesize
1.1MB
MD51ad17b7254a8fe130b586a1b94b9d421
SHA19c9912bdc2fa310cc4e2d201d21311201add8acb
SHA256ff6c08ee46eff9d764a47134a0ca215b881fc1f5f3226d212d0d3df307d996b1
SHA5120cf863419d4526f45ea90abc39538b11aceca12694801864bcba0a7c20ced103336702e5a5ab0d5754e3de146e040600ebd0dfe95cdcdb8f89ae5440e4aad93d
-
Filesize
1.5MB
MD5e4a4fe3f01c2aba8092d8300ac7e614e
SHA109deb569fbee261409f8be16612527a750883f0d
SHA2569c8b38c590bf4a5cb3d61273cc0e74da20921362424ac6f7438befa77fb0ed11
SHA5123c6efcde8f4e741b1cf631f0b5196912b5e9b9333ed1a3534349abbfb998b23a30c93d3377c742d7b7f8ced543aa57dc17cf0dd12cdead1ecec36baabef22f9d
-
Filesize
1.2MB
MD5983166b3cc818880cec48af166143875
SHA1d192579f97f53471808938e7986fdfce76ed2962
SHA2562650f0831e1e647f1f588175ec0b70ca77de997c31d3a0af13d3a4fec4445897
SHA512674c8977a2b09e295c8dc9deb8b5de40a39cb75617feca415e3d99ed87155343e8ea6db2b26c02f898fbc2bcfcdf56d17ccaced861203b7f1cc59f0dd25179f7
-
Filesize
582KB
MD5bf368cfb13594f10c2b61f4f13f906d6
SHA17aa9cb9f185c7853afa1e7beee1da982a745bd72
SHA25648f53c0e9cf23af7e7fe007dc3cc6f6b4b6c9c7fda049304a49954a7b557f287
SHA512d8d6b1bda74cad627af1c3ec6ed6352d9ab5f0356b079ab81c32a89a6d1249d29b57e0e3a35b1bfd253a8d7de55deba25dbe57dd0aa110c7f0bbde034e358ffc
-
Filesize
840KB
MD5765b9f05d13c7e2715b248ccbdc1ae35
SHA192ba670bc731fa204f00f1f0f98c6b3a2e56af28
SHA256ec59ae778c8785297841d32759e79417daaf55eae03998441c4332b36a46b003
SHA512cdc8191a66e02c577c6f6fa0779d0bdfaaa69be387222d200eb53a174c69e95e93a3c2fc037b00a90bd8a303b26db847890109d9daa1581dda2b3427b2e5f309
-
Filesize
4.6MB
MD5df5ded73a75df8df779102950c5b797c
SHA194e9c359ec4d05fba9f90ef94a9e1458957969e7
SHA2567f86325c6008aff03fae275fe09f9af0ecf8eb28627c0b547c36a63b8c41880d
SHA5127cd641a18def911d021d39245b389c0ee2c533c0ebf80643a246b4e70cd6b1166b142658d36437e5ee2708e5bdd6a8e8fad788012094a0662190f0994a619e75
-
Filesize
910KB
MD5f5e4e05309b4312bc3d24b0315bf8176
SHA170e5b391a3fe55fe150d70f7b24cff5f3b19452b
SHA2566a8a670293d996a895be977b2a84484c5cc49249f7fdc69ee4bbb67b853fd108
SHA512e16ff7378f0569ebb456b6983a4e3109dc141aa4f9d9f91232dfc0ae12a8a924b620659f08ed7403ab8e4cb683ac70bc43870a3d5d68802fcde1e33f95b53745
-
Filesize
24.0MB
MD5afdb6678cba56360d8508933d6831c28
SHA1b3a59018fe5192d1e905d3c60fe7addb853a2f6b
SHA256a01727abddfb8dbaf5a3233a91d0148b4e95f3edf8f83ede172c6db20dab7e14
SHA5124650e3b00eae12e3ca244dca944a8c4b9c5a05e5a570b834684efab6c723e60c1db6ffa3cff803c8afb4508a3b5cfb6df032941e0d50ee88cf694a569bde616b
-
Filesize
2.7MB
MD598552cdb152ca6c93c259af46deae949
SHA18f9eff446b5f2968bca9fef298f9285ee0c4c6ae
SHA2563af90461ff7371582319909445ce5197383cd774a0b610b1794f47e1eb7e3c60
SHA51279fef92949a2f568b15d7360f96eacae0a1c65c404168f31f7e0ba9f6371bdb5c942c75a2d7aa92783ade3d33d9cf7c0316479b1dd571ea157b8ac2b61724395
-
Filesize
1.1MB
MD59419de7bbb3c80b0872e62c948a78311
SHA1de8181308d4febc24e047fd60b673b69f6d6c7dc
SHA2564045d20135e5d59ae7b0809ad0261597cae5943aeb0d9d896589ee154aaee67e
SHA51222b0fb883fa07241de3d0f3eae7599487b8a28bb3eaba323c09c85bfc06884024ed7ae84a6f8dd0e7c084f24017ee23a049556f9be0ed7e2b763db570ab02801
-
Filesize
805KB
MD57e6744768677e042459bc4b12e7e0e00
SHA130ac92bdbc251294e6b126c3a3cc1ba4fbe57d61
SHA2567e3c6ae607b78b428b25a1ddfc38fd5467f390696bd908efa86e848559c14cc2
SHA5120cae110c8551ab531b2287e1ebda3895f1bcc91dbe822b6e56ab0b180359e0825ade2acd80832ba071205e5e8e03c9f596e45b8a1ce55303be74a0a9d47910f8
-
Filesize
656KB
MD54e88489144fe186c0c969ada11ac857f
SHA152ad0e43ee7795eba907326f3e491b02185fa3a5
SHA25677301ae0f71f108138a7d119bd9addd596908fbddb6e9be8f749029949a9efbb
SHA512b6a83780e7d8771b7f9a6c53b5d1e74f410f64654e2452e2c592834045a3bf7ff03bbf633cd300627df9495e39e1041715f5b3556cf002081059eab9588802b8
-
Filesize
5.4MB
MD511e5050824b59391411cd7bed6bf8b9c
SHA16c1921b6ac6e958bfff8d3af84db97ffaac6472c
SHA256e4a208b3800981fbf5ec345651db7c301bea4b60edf75da9c18d3dda3f21dfe6
SHA5126a1770567b1017ca374276f90b9be7d1e0768fb21db697b603d46701bf8f61f1c3b669603a9abd3d0370b5761e8c6c688e534e44127e5447e31d403f3c674dc7
-
Filesize
5.4MB
MD5677f15b3132aab511ad3e24fe2481184
SHA16990452f05d8f5dbfa445838af37ebdeb7c49b3d
SHA256591f5afa351409287a74c674cdc7c7982427bcd65256176d7aa45f588b60c974
SHA5127c6b5d24dcd39dbc319de5816f438ddcf6aff03345afbf92dee4a73fc5b525ba086d679ac03d51b7ef3b45ba67b0d46cde6620c46250cff812f7ef0e8c4d83db
-
Filesize
2.0MB
MD5b3da8af757f26d8c28e2a5c90ec8b8cf
SHA1e4cf523aa902065325c989ff992af36a1c25d5dd
SHA256387f3b40daab5f0a354a6c65921b59a6e55d5f1632aea734f9ad3c4a2017a293
SHA512bcc4c54972005eda6f7d058caf196dca6649bb90d84d923ee41c9168b2bb8ca76c2c19bed9b7c34419500a35fc0a18c6e0991046dd314ebd2f068b902c414371
-
Filesize
2.2MB
MD5b6ad1dc9159a06767067eb7593d99b40
SHA188d713ce18ad2c35da4f5207230a65631e35c12f
SHA25687b26fe03defda0cf87c7031204b1aecc23e5e7f443086131e71a938459d5d7c
SHA5121e68e21676472eae2a51bd5c32d5afae72635b7da0237f36bf697ab0346e98494b7c8b9c2839123d01969865797ed4f9e4c3b965d3b59163184e9fa9302d952f
-
Filesize
1.8MB
MD5d94dc5d3d74322c62291f11154288087
SHA1202631b2a1d3a4d8e68124de4ca1ae345a64a668
SHA2563cd5efc0ec138b7bf248539958d406a771baf88414c5215ad9899c7243397bf9
SHA5127a869e5940a6b09fa4e47f36184cff79906401d6ba485302ca5d77133b3350da1a534f62b835c2fc73f9e52a315300c757f4d5c377c7f873be512dc0174054f3
-
Filesize
1.7MB
MD5c03bb09e7c0273ee29a5ad97dcfcb940
SHA10ba1a5361a2d5a15f77827c51a2c54fabcb3cb35
SHA256d8443d4032e139c1a755707ed1cb133126d55a09e8e313e8364876bf09e78c8a
SHA512b98a4014b12f3932785b3bc6597d952ed7d2b7cc30ea0316390bdb56f899bf7f4739fc3fddc23d70d5147536765d15817e4ba10bfc41843542370026b28b9be6
-
Filesize
581KB
MD5ec899160b2283648e83c3dd550b72372
SHA1709daf444532fcd6ee7177b3a010aae88aa9546c
SHA256b8c96f2fd2174a26995cef6919d134d4c12739c4748835bd70e1e872071ed29c
SHA5129565a5b9a4e7327aaf1f0538c3e2bd20712fd1aaf31d3c19cb0f29f8831fafebe48be6bdceda985bb2c643332af21ce6c4e096e83a04234c37ec6caa74ca9339
-
Filesize
581KB
MD517648755a7a671a18af500ee8e304b72
SHA1486637f77df5ac2615bfe71d21d6dc761f710dc5
SHA25603a5224f3bb946a7bc5636cd5ad0fa00ff58307b29492cc7405811bf79b15360
SHA5121cf89bf72be147ebbd802cbf228eabde3353468af96b0bc93364af1a7914d53c6d8e9759a93b30ef4a5d687d3625fa42fe4741e096a264e8b23b03376af5c91b
-
Filesize
581KB
MD55258ff6b9a6703667a59be43dd019f87
SHA108c78c19e7da237e565d7451fbc4978a1eec9485
SHA25680f31f25bd052da39e49fad932391bdab03458a19174b853b7eb33ce45429b16
SHA512e2e0cf9ea45a067830ebdf10744a961381031da6e949cbec53fd077a7d47d80dc331b41e98ca9c7c36684f1af3ff9baa31fea2d6cdf1d574b74d27f00d94a75e
-
Filesize
601KB
MD5451ade221a2109fc17bfab72feb3db4a
SHA1167f0d70af5995af01195bcd91957cc02e9cc118
SHA256b1c5e5da1da093b497a851ee05fd5983b390f37b96985a5d47f031657ed67dfe
SHA512974a644ef2bac8763a5be741d7d571a89bca3a118167cfc73b8507f2e18fc8535a0abfc8d72f4e0b06751c556ebe9b24833324adbd7a29fed7caef7d090565ef
-
Filesize
581KB
MD58544c752500baa246f9200ee4b54c3d5
SHA13a5c56372f35be7962e91d76d8d090743260535b
SHA2565301c1bd0d223455c9247a891c82172cd3d3b817b4b4c9dee2d68aa81c7f3c43
SHA512a55597f27547fdc26141b9f60641b5e6cce75830f1f7df13b05a69e7b8b63a63b63a59b5c8167954e500d2e5bdb10023025dd95b66e5afab3658c456ccc26e2c
-
Filesize
581KB
MD51af7e293670196580164e17bf89d18dc
SHA1a736ed0866977262a9360f14bb7224347e2ece68
SHA256d488fbb6465c9c2c918ca0616673fdf7164a09959878366c317c8bcc6ab7e17a
SHA51209b4165c424c247a0af19ee4cea0e96d68a82e726b93e37d038faea35eeaf4983f477fc606f0e668ad4696c3a2dc04aba0730c4b6c168534f57ab5ed5141f1f3
-
Filesize
581KB
MD5c355fd01d56a1ae63f44b29dae87f44f
SHA13607edfa65b011fb02b877c7effe78982c18211d
SHA2568b78aa86b0e1b65b14377c6bd7ba33cbb1ca808db2689d2576c5ebf9edec204f
SHA5123f8daee63722cf3b5dee1155365800bb7bf70d04abd2ed4d7a300393c50e04a41b495124e2d469b847020adeb1ae653792a6a9cc0c6f94cae3ad32ff94cca93c
-
Filesize
841KB
MD58037a24d251f8565731cb6a50cac15d9
SHA1be4a3fcbb0ea17bac1f1dc5835523fb6000253b8
SHA256398bcd669a5721732e13bacff8b7d2f400106fbe0d7f831c43ef4c122b6e1980
SHA512aed25969279c2266b3cf139271542ae83ab0c1c43ea5af3025f3d79e531cf9a58a88e66fde398aeed29b0e6c7e4427c095a00a85e8ec4455ff2da78c9f5e8abc
-
Filesize
581KB
MD5e8a20ec6c7e359f2b2c58e44e305f2a0
SHA12274798bebb31b1b4b6817dcd47d80446543b9d6
SHA256c52043589dddaefc84d8202401732c2e619e14bc2304001a8609f8ac4460a380
SHA51287699500d4522a4b06e9ff8c4ffdea1870e7a1f6b4c7cbcd0cab408f17a6e73e5ab86a01ea36feb98d81af9028abf8df96fc2dd5aa79e54a101aac6491200c10
-
Filesize
581KB
MD5423a5a9ce878ed8dde46c5ac9b091e0f
SHA186b8d37ad8dbacafef207c3a3dd6f683cbe53c7a
SHA256b93605595b2d382753ba76d63866f880a0c93d9fe38a9961abaedc59a2e6661a
SHA512fc8421e128119cf9adacc5122bd0de331c85718d604906270009ea53b70143f9ac14a092590811df2ebd4186e5cf93c742ea5fe27032efffe48329ad502e5e7a
-
Filesize
717KB
MD59790403c759b3cf6d088cc8c97c66d05
SHA1b62abab48aa457f0eaf90efd64cb4f34a1bdcda5
SHA2561ee177840dfe2c9adec0fa79d5f45424cc8fd2117093c3e1d4d64a38460af034
SHA512cf32b95d8fa24726996d8e07e2c8179c4afac1643eaec38f968d676b24adb7dcdd5bcd96c045cca94cfbf6df8b8feba13c2606bfffdc762fd6914cea47ab160a
-
Filesize
581KB
MD5a31aac03fd93887b419b66f13e5682e9
SHA1de191a7cc14566ca2b8e96c9ee9c2bad1c8dffdc
SHA256400194b1c6686ac35d98f7914d87a671f1eaf7b2568e75783d8981fc39870337
SHA5127bb833e6c11fc1b00190a7543302349bb9f6c2283f0adf50fabc1893db000b48f32f2afc2ca52ea0e3a794174be3a072d15fd530e789fea22957349f79c536bb
-
Filesize
581KB
MD58dac6bed471b2e669bd0c5dab275fc88
SHA1f90d42fa23b82cf359b428f132bbed748fc6d3cd
SHA25627883c36564e307fa20128c2d4cd6613794ac112caca33aade4d35014396da8d
SHA512cd4eb45866a58e1970168d80f3cb44ff4b7cbebe3546f0f058cc333fe6b8b1ad13c4697da6782f9072ee572d2f033cf83dcdcda42b7a376a71b140b28596ad59
-
Filesize
717KB
MD5d6cb2eabbc4e911e06d48e1987cf93fc
SHA13c9e64268b636849f438d4e9e268d5acd264826a
SHA2569d76cb2f758d4e5369e0a49c4f9d243823e8672bb7dd859c69bd1e0ac0b4de54
SHA512a7d9d0340607902157097c5e32646a56ec1eb71ab50e7c2515060723ea5360e993d3e0a915a0643554742ceea3b4494564ef6faa09c05f54ee5e581046791521
-
Filesize
841KB
MD514aebd3687329ee752e6ead3c8c6a4cd
SHA1e4623fadbdc8cfa73fb08c23864a8c78e82d19ff
SHA2565b1ec7a24efba42087e22de76c0a522316b5c5450abe5992357de5dc11d072b7
SHA512264aeee32df6b8e5a3145b1d42866b786217d8f3fa2812a1f10db8436f3649ef5171f57018b007cbc2ca23b08ee639fc3b84193c527bcbc4f72e8bd231c323a7
-
Filesize
1020KB
MD5a4e34374580f4c9ddd99c055e72afbde
SHA1509e444a8d667e401dacef8fc619ced891b6e7e1
SHA256103ae0a32268eea9459d52dbddc261ce6e46d312318aacf730de4dd83f38bdc0
SHA5125b8ce74ff298066052b111678dcef958deb51661d72fd0b3db328048f8ec80f870a38a4c36eb12edc60a9cf3cc93b4ad738d1a66fe06adbed9ea1013cc3614a9
-
Filesize
581KB
MD5c4f2cba21d67c0356e43b9b04b604a1f
SHA19ec0dec9803b8f7d90a3388ec1d9fa02ebda411b
SHA25672ab8b268844f0d475594b5823271c2a27a6ccd4724b9137502191e6e7a89e1a
SHA512a79ef59bbe91e712c02214200f816fdceda26cbccc3546ee09b6c37a652294190e6feaa9164622ad4a9a056103b41c58b2473fccc4f72e7f943a8a985441c018
-
Filesize
581KB
MD5db0611f298d28f2774da00e6a5e8b5d4
SHA11989511d58a2bb86ac8cecfc5806a57378ebdc5d
SHA256841d5a80fcafda9927a5cf6189274de8a9589dab72e8b83a95c9423ea7dd22e8
SHA512bd85ebaac613d38d0a3992c77182c60b2adc6b0be2f463ad46cd37e25a9c095221704f116b89052dc90ef047d43931b8ea7646cd876f2c8a50bd14f9d9541fcc
-
Filesize
581KB
MD51c9929e11c1b154d15ff3ce1c0b6e116
SHA142612420963ad52bfeffef644d8e719b76072a2f
SHA256195f5e9ca6e38e74495b8f6514a0fa5043a3f41d580fdb47f82e8765bfbd7362
SHA51256408f6fe6f7224f1d4cd236f2aeb94ee7f6055e8dec98876b318e473f27099f3da1b3a21885129e52153ce9cfd384a10367969d0adabbb3d62e24dd6efe94fd
-
Filesize
581KB
MD555e42a0c7b2d3015769deb5f4ae1633b
SHA1575046c8bad99a24aa5131933b57b49f2e0c26ff
SHA256564fa625d3895730d50e95c33b4a1b3bc1a19cd3377e942fe926ace96d63d3d6
SHA5127e2ff7290523cdab013784de53bbe735f831cf28600d390e282231ec86c9627f59ff800d80f5fb120eb379b64227c6bf0a74dbd2feb61c4d8de9d77324f24677
-
Filesize
581KB
MD55fcdbccf306945663605f29b942ba497
SHA18c38797dc85d54e922453a469cd2d7a85eaf6a67
SHA25658ed1729c45ec628a32f3f1b91aefc95d06ab1601bd0ca0e7db58322a86c3fa9
SHA51266ee63326291f6d9ccf5f5cc13e64a5c992dec8e71d0748fbec94af042e7fbd14f8a5b6dd822eb4879ee631ab777221e82b4b804db8a7b16d81daaf8bdc56a32
-
Filesize
581KB
MD51da52af0fd534ec4031b9097d857f704
SHA139cf601ddee8556ec7aec3749397ffe97e7ace92
SHA256729b5cc9c1b22971458e431399166ba4ec8ef09de8b091f70391e8185a3037eb
SHA512cfc5c11e27079a4a72d80f218c1f1094237388f219c5d928c477ae6731acc453a9258a32b12a5dde51c0898d5fe4c9cff418ec1b6daa0a3f50ec835cded51bd9
-
Filesize
581KB
MD5677cbeb56f0d95305a5b53092f29d22d
SHA18a94616da54f06da13c32970453d698306cb8e85
SHA256eb50b67cc1788d40e89993886a6adc92f64c92bf8ca273cfb931f9694d497670
SHA5128b46b958a2810e38215cbc542914d87c5b6402a9fd1f43197051066ed2617ba98f1d1c8d7cdc4666a58b332b12df97ba6a2ed317d724c1d6ead6a4dce77e1a67
-
Filesize
581KB
MD5fb46a861a399b4aa601d6076074fc6fc
SHA1a645da39daa789407e8860cf3367c7c9efb18206
SHA256af8edafade215b236b1607978b656df84580368e065e4888d3148b9d7f0c07fa
SHA512e5a6b08e50e131afbc6c183161735e2143ab4502257ec50deb958b53709f77c4be37c11bb829d10f9a08b7f0b35d29b6f8d709abdee8ee466b90a220148ff586
-
Filesize
581KB
MD579d96b3c1ce258bf6ca9e9b505568edd
SHA1f3e7a678eeecea099329634491ee1b23b8fb8b39
SHA25645b2432e64d3b25a5bd3dcd63c9ccd65aa2e4985cbe293a0c690e951ae3cf2c5
SHA512d39cbadc5c81de7d5da19add7b87767f6457e835d237c8dedf8c2d60d8eab6bf505c5c58ebb584ebcab8796dabe98e85a43c6583988e902ed1d4981b2561a70e
-
Filesize
581KB
MD5997fa1b017db649f24a2614126112096
SHA10bb466f227c380ac76ca214b014f08a07546d6dc
SHA256e9a4396d3b5c23745585d83d5fd8403cc9712358eb58913dcab34df56419ae39
SHA51267e06c5f2a7025558f52780b69da6db872a78b2d2eda95c15f7e45bc555887905035298ea88c585ae2f875dd7c7c1c3e9b779b806c277adec6313bf48c17a770
-
Filesize
581KB
MD5f5de26f22dd23ea3483a00642b04663a
SHA1481c212b243b7b0fac2c4397229490cdbaa96552
SHA256dccff6774ea7ec6a56867c4971760ad13e07335620803cad272ba3271a5ed772
SHA5124b6ba863c9ade5c3787b7de72589e78910d22ed9bc039e028154eb2b8fc380ace74795c1db44626c18e20e2bf6fd1aefa9e235c39247f04e5f990f97b7033ae0
-
Filesize
581KB
MD5cd58633481562413fca1bf6185d3352d
SHA136237d5753ae9abc12b887c2003944319be3617f
SHA256da89f60867ff3b40b5283bf449b04a983f05b3c4134abb4b55d68d0aac03e1be
SHA512a1ca974359899849b554b058ba46c24759d8937feae32a3cd28d2000ff87cc6637e005c0dc4a50cbf4dbfd805ffa3348c26fa8ec9207c2b2259d77ef661b739b
-
Filesize
581KB
MD550895e60435fd149289e2f83222f5996
SHA1f4afc1bfed91d06f993ae331db1d1bca1f4c8b19
SHA25694a304c2429e3f321974aeeb033d98b3963b9f0651ecda25946e9187e3d2c6c9
SHA51275aee9833fbf64c083695160ca648caf0a545aba6bc3db5bc88445be7cfd959b6b0d9d506743497b70a51ac3a40ba49326b0a7c375273e389926e0df723b93be
-
Filesize
581KB
MD5701d3569c0ecaf1ecfd3f0e4e6535795
SHA188634e32a33e9011a7f45e74a2856facb6984a67
SHA256fd9a6375866ddbb3b41524ef2403fdc6668056e6b5f7f9e16ffd1bdbcc0c04dc
SHA512ca4f54c9886b974b1ce5e7f693d703a8093fbd186fa940fc910ade46eb7ece8dec0913b30cc785d472245c4aeee580ad0f13e6797816a4386b44ef987fd329a1
-
Filesize
581KB
MD59e6ab612564d65659f4082d1b212b17a
SHA1644cf3db38593c881877382701f42606dc289450
SHA25606c976627fa2e29a4b6f6ad908cedd0e29eb3469752b570177bb12c1cbe80398
SHA51216a8955826ed5da4745b701c60efa772e7cf8e1b9738d05e026c090c4e32e838cdf259c20dd8df02c8a7a418d0e5c8583bf84ccdf02eb92b195e63a96beb4e54
-
Filesize
581KB
MD584661c61e9158d9e2768bce2b1469829
SHA1e2249bfe20c6303049c5491aef4cd89458d7b717
SHA256269489cfe8db316302348bd2c2fbd0f40aae333cf392d84c435f695a307c63f9
SHA512f18c641d708991df7f7773d4319c356e2b11e16bf9facb4e81a47e9df39f7e379121e97da7d3d991831283bd75ab904b3590e213b2d95037103373268eee1c2f
-
Filesize
581KB
MD552cd394a58b405b3c5b92da0d2cce9de
SHA1d4c51ea0b437fc5567fd0e15e5ace6734733632a
SHA25631436028ed08ef778c248974d7b748ae345bd3d6cfe76e6b0caa730034fb0b15
SHA5122570d24f49b7a6def176f4c63853dbf0a9ef57581593c281db0df23622c42e7f03bbd96952004bc68eb46a38979100ce4984fce23786e6f7c11dd09b1129ea55
-
Filesize
581KB
MD580d65fba2ed54b980ca3efb33e5af096
SHA102d995681f0e9b0bcb7a3b2bb60479e84d88524b
SHA256dc4d9cce2b06397c5c173a6a2f5da469ec382fdb92f4726fc7e08e0605b32a8e
SHA51214d3a3dccb1d6c792a4edd444ea893ed2cb1d8d7f6202e8603ebe7fdbcb0d56b2ef87a444384726fbbf5dde168764b408032b75c5b380fb2657ad3f7c2fe848e
-
Filesize
581KB
MD513cacf94ac6339f026d48492809831ff
SHA12519c8051136b3714502e40041e1ee9d7662d189
SHA256005b8a9bed6d6cd5f2f1560d4fc2ba3235afb1102b0f0db867a9825bbcab1239
SHA51281316154693592b64ca1a84173a1b2f84c60f8e1589f43a799e00577de2dc71313947e32e5471c0a1bdfb5ef18df0942e1facdc2bc254abacae588fbab6c70fc
-
Filesize
581KB
MD569ac13daf1f449595ac9baf8520b171c
SHA16a561a0da546e861304b91c6dd0b7d97c5e4ccbd
SHA256348cd4d9d280859f8057b25da508ff3952c2f7fec8d6cd7953f716076d7ed97d
SHA5126a2feb4c45c015d9f911565f0fbc482eafd8b9875a332a482cffc89e1e5156125b699253b52ff6f0d30a846dc7233635eacd1189860784d61253571ebb8ab9e7
-
Filesize
581KB
MD56908e81b63253a117c700c0975f10bfe
SHA1e9e54d5a8995fd892e03dab7c2902998f216c721
SHA2565bba2484223412f482b8c1fa3845cc162d2e02603d256930dd9808041a8480c9
SHA51276e55aba5b50d81a3f8f631c3b5e5b19043b347609bfce7d230b5de86c5bfcf1ef72a3f2dd4269b0a917435520c10e2c54c999c95d15b57395e2ce7b04b4ea04
-
Filesize
701KB
MD50f40a1315d684956f1c624d7a1753aeb
SHA1fb5c2bd0b8f339d1a78cf4e80a61095a477b1a9c
SHA2565950644ace1fb371cea56efaef923d659b4f4fb24f1b69c5e06d14007b61353d
SHA5121fba902d7fa653faa6f0116dae54589dc6aa9b09b5f3374f4b8e3b36da691f3d50335c3cebc68a3032b3967b8fe5d6a9dd6d55b8377d30ea5f7d48841d9ba5b2
-
Filesize
659KB
MD5faf4d10fd5706e1e5e4727bcc57a46d0
SHA173168609ddc823f5bd339a1320beb22a9cc61990
SHA256480202dc48b7de626b2996826c9cedc2075fad09afc738f2705276711fc59272
SHA512d71b71696a96c648a956387d17e717ab268452c7625082a4d257994fb654c296cd6f1ca20010202fac4c29d2eb8efcc62780ec9d74b6c4bc562881470e335101
-
Filesize
1.2MB
MD579a4c31c42b6d6645778e584c36b31bf
SHA1804dd81c85cfc8791ad7be72f120a8adc680717c
SHA256788faa9eae05f277c5889c29733b59ad6e306e1dce7f39d10f1836552be6dc11
SHA5128224ead0465e4406390695b2dfc358c4b783503141e8e691e915454dbee70dfe81e920a09da9bc3a27bc865df16e506e6086a19466263bce74ad254b513fcadb
-
Filesize
661KB
MD57170a42d817332da6142f8013ef339df
SHA11fc0706429f51b7b2a55f7023d15c0395c6843d4
SHA2560e58cd50a868d493dc6a6d06971d46b277ec705756fcefbb986824c52283750c
SHA512d008299d075521bb4ccb2ce91bdc14930acc8e5a82a208f031feff026c219611094ef410815e746bc38ac8edf30185e5fdb2721dbec3c6002e949e220432857d
-
Filesize
1.3MB
MD55e0cbb5bb00193795f91a9ced9da8a41
SHA1066a0c76f3310f0b979388ab4779307d52fe53ab
SHA256c6bedbcc5d94f5ef9df8b9b3f259460d15a1804f64f8ae93c264c5049e24af1f
SHA5121fe92257bb54e25fe929879b1d5cec531dd7c7cfd50ebd4e0d7361ace73f0d217861baf78dd4c1757bea3c5cdb455c316482a18fbdb9b3e3f7d47ba4ea1a81c3