Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
01/06/2024, 09:30
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-01_51dfd055841a7a6cf065830a3ca82000_ryuk.exe
Resource
win7-20240221-en
General
-
Target
2024-06-01_51dfd055841a7a6cf065830a3ca82000_ryuk.exe
-
Size
1.8MB
-
MD5
51dfd055841a7a6cf065830a3ca82000
-
SHA1
6568aa93ca16d8cd5d2d8583acda8035d7f725ff
-
SHA256
380e4a11896e21bd760cc7655004d929ce51988e93785f659439e050430866a0
-
SHA512
a15a6ec29059db8404388bf4cd6084eb6711c1bc68f2731ea993eca19c162b50ca4b441086d99e82b2822203e8a662c5ac66d032520812c4d4eddf9a64520803
-
SSDEEP
49152:wKfuPS3ELNjV7SZxEfOfOgwf01Cks7R9L58UqFJjskU:Hm9OZxwgFC17DVqFJU
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 2152 alg.exe 3632 DiagnosticsHub.StandardCollector.Service.exe 384 elevation_service.exe 2452 fxssvc.exe 4792 elevation_service.exe 4884 maintenanceservice.exe 4760 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 11 IoCs
description ioc Process File opened for modification C:\Windows\System32\alg.exe 2024-06-01_51dfd055841a7a6cf065830a3ca82000_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-06-01_51dfd055841a7a6cf065830a3ca82000_ryuk.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-06-01_51dfd055841a7a6cf065830a3ca82000_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-06-01_51dfd055841a7a6cf065830a3ca82000_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\e15e60fc92be0f3e.bin alg.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-06-01_51dfd055841a7a6cf065830a3ca82000_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe alg.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7z.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe alg.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3632 DiagnosticsHub.StandardCollector.Service.exe 3632 DiagnosticsHub.StandardCollector.Service.exe 3632 DiagnosticsHub.StandardCollector.Service.exe 3632 DiagnosticsHub.StandardCollector.Service.exe 3632 DiagnosticsHub.StandardCollector.Service.exe 3632 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 660 Process not Found 660 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4568 2024-06-01_51dfd055841a7a6cf065830a3ca82000_ryuk.exe Token: SeAuditPrivilege 2452 fxssvc.exe Token: SeDebugPrivilege 2152 alg.exe Token: SeDebugPrivilege 2152 alg.exe Token: SeDebugPrivilege 2152 alg.exe Token: SeDebugPrivilege 3632 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-01_51dfd055841a7a6cf065830a3ca82000_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-01_51dfd055841a7a6cf065830a3ca82000_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4568
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2152
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3632
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:2324
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:384
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2452
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4792
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4884
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4760
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5d123799c33c1b05f7e8aa4fec83d7ac6
SHA1878fcc34ce75ecd30a6211c480eaf063a7649de5
SHA2562847ae6042ed9e4158294a3eb6cb1beeac23b9d726021dfe78c7a4622153dfca
SHA512124147ccbcd44eb1f99a1004255eed3ecf267a188f05ca24a201c4f9f1150fbca2713f99c2c68be6e6d222c1579fd711af454ec42023d80e666dadee0f123861
-
Filesize
797KB
MD5739e6722f2d1c1acedc138cd29b80235
SHA1cea1697784dd5e56eac982c1441bf71d76724b5e
SHA25640cf2cb9247d3b8f23898064966937fb47736e62029847a7503e88c84127eadd
SHA5124c64cad06f77ba3ba9f6656d2e69ca2bf33e4a1219838696aeb3751111c306d729012da6fb4f22d801c8d37fdcaca2894b79daf7e3ef87ff7a65ba0f9843ef94
-
Filesize
1.1MB
MD52d274d0d451d0b0f3258c9f190a7d27d
SHA156001d7d4106d5fbcada00d126f544af1dc6d1a5
SHA25628816388d6aba4b131fbfa0b687014a6278dc31dab6f4f728ce27535ba6443d3
SHA5127010d8756525c41cedc228e98ec15c5fd353db200ec251c39a281e046697bf1fcf883ea8aa5cb325f429ccb0b8a5707e228d8b14985e7f6abaefc2dcbf873ffb
-
Filesize
1.5MB
MD5066ec185ff1fc082d1049afd4c0c681b
SHA1b900af266c8738a7e155aaa94207212b77ecdede
SHA256e94af430faf466fb44d84532a0863c5820edc16dcdc49534fc783342c5781744
SHA51262a9bdfe6b9be079e0ee9a6168baaf96def0f115fa0b519c16cb37abff25a12fc7592bf346f920583ca6ebc11b0a57c72372110802f715ab60042690541d8859
-
Filesize
1.2MB
MD5990c38eaa81d5af3752c243fe0ef2ddd
SHA1b32a6ca9594e736e049885b4215aa916b2811cec
SHA256608a532d7dec388ecda52a3dd79b1b0ed54b164497771b6b9f2d8f850ffa74b1
SHA51246847d72322b54516e3b689eb0b6e3b7d42d5c28b91a2485ff6b682e29b50a62f5a67a12514c1a5bf632bce2f9433e4df71f33ecb5001ada1d1b47a766647f13
-
Filesize
582KB
MD58b64f5d74c491c8d6a0001ebe096fdf8
SHA124ff47b1629d648b50aae7d365aa9124f807a571
SHA256491d7df89c9484fad0c54d23233ccfe9d15da7a1337c4edce75ce09da03d2fd7
SHA512011f441ce03b479958165d71ed9395cef25c8586ffe1ce037d188f6fc9ccf8a6dc431d198fd68cdaee4227528ab2b1fbef511921a15359c4bed4a4c6de836e84
-
Filesize
840KB
MD52758429de3d0eec4a9b597fea5cd2ac3
SHA1888308da9a824b5a9ff8ee74f997bcedc12f3511
SHA2560b5cf37669d7a80d83340605c1751d9d3e0bd4c4e6ffec7833732a3de8d5f94b
SHA5127da7449812dd133de1c0992f68070fe434c4cf55f86075b79aa4255c0847b820883b3e08409661d541bc9f1357bb2dbf254d73a40eab3b8cef1714dbe5fe3782
-
Filesize
4.6MB
MD50199efda34865ab4463c4f30d66d0ccb
SHA199cbd9fd3061fc61464c96bfefa7101acbe081d2
SHA2566b79aed43da54fbaf76e545a1b9f9ba7deb17e779e2136a4de881e47ab221d9b
SHA512bc4eea910b7e7afb34e6b811ad74447602c07c1bf7b32d694c21507cabfc0d4cad341caeea6995d609d7125725ab51b5d44192482411db53f689288009c751d0
-
Filesize
910KB
MD5240311f38a1da3bdf28b6efc0b84f696
SHA1e40d95123c0f8f1aabc70e2f8a0759c36674219e
SHA2561b6732fba3779ef19ddf50bb687e3d2f3858b358dda583ce1e38aee684fd0935
SHA512ce6ccc61a3728f970bba6f55b79b7ea2fb95744097d4c01681bf2a5c5c6f248b2766d7f17c8a8e906e1a0b832decd249b49a65f360e367919c82818bb60a4650
-
Filesize
24.0MB
MD5d9e327685b4a175d811fc3590ffb72e0
SHA1b0b3b3627952a5673f54b579a566515335bc2fa7
SHA256819b2eaacdb806640fb823cc9dc69a28092b6d73e47cd51f4fcbbc857d2e11f4
SHA51264836a559d5ea43b127ae2709f1510d3118b49b9c732ae11807fd7bac3ae998169cff36fb87534f5cae9a69a88d82c3751e4a4b9c9f4bb60cdc14cd7e0fb029f
-
Filesize
2.7MB
MD5748524adfbaae8056ca7e3a9abfad003
SHA1b735123d2df0dc6156c024d91968273a1a0f443d
SHA256b6c99b866cb5d19abd574df012899e18286e59e4e6cc31a712aa3b25f3626466
SHA512db1cd2c928614d970fe00782149230f7913dfcae3a29a5e3457aed6d5e18fa1cda19b1b044e81d8e480195bbb6d026cbeff43be82bd1bfcb44e2b1901091871e
-
Filesize
1.1MB
MD5b62500e5a49cc741ab824f946e247783
SHA16ce2b778bbd5b86de6b913c1f5e94f6ea4565e37
SHA2564650285de26ead6a661d2db725cf08ec2a38d139e3e87d0e5c40e7d5146a5a42
SHA512b82062df2aefb40074f139e477c2b2216d475f181d23e266e6fa05f9b320f25d36846813c9b7cb19de57b7cf2e0700250dbc05043c8793c0a1d0d8b1bb518df2
-
Filesize
805KB
MD5044d8ecc3a4137ac7ea7ccbb38471549
SHA15c1f7958c36e6269841cd0e58b38a3cbf5e7130d
SHA256fbafbba203c7da2626a17246c3d4c098c61a646fa268593995bc68a9b05e120f
SHA512b03d5ae1f69eba2beddf1ea956dab2278efbe581f818f6eab46e0d14239eb572175176f6f072baf29a257299aaa787e928ce133b2e95fc2702e261c9a0c700fb
-
Filesize
656KB
MD53ff7fb0e2b7a19c3cd82dc801936a38b
SHA1b29dd46388041f67fbaf5e34a4b77684c655ed0c
SHA2566a5b13b3f5b8a9e3ab034dcfc3768c239405f104822e0743edfa4d0ca78393a1
SHA5124167c26dee5d170a173ab46fc863c53af47f6c4fa2c51ac9d13c4d60a7b1ae0a78eb35170acafa4d6b17b9ac88847cb8f389715a80d22be9d86ec2347a49acf7
-
Filesize
5.4MB
MD55d5fc8a1c2d9007fab06291077332fa5
SHA14668b8d74e68f002d02302151eb795d3934b6159
SHA2568df981441bf9b92d2644db63d0d102d5d3edf6516cff96fe8088439e6a1c8ca5
SHA5120034c1ea2d27b5bbfeac15b7a50700e4746aa3c275dbf98f7a643ec8bd27b12068b148226b81e39c98bbb86bb4a6399f4af1c99cc8a207e225b1dcf88a804930
-
Filesize
5.4MB
MD5ebf263e1e5f223b587d4914f721c3aae
SHA1edd70a732b353526eb3121f6c1093259188d7ddc
SHA25618006ba90ec2a9429020db41bc2be9fe2626d9873e99b35600f91011262531e6
SHA512f54595d1176e0fc7fb50ee310f9d3b0eb192daac846286fbf2a666707242af33b726c6cc95cebeb5fb9777232cb727ed3200c4045a42b7a8bc725a0388e82f8d
-
Filesize
2.0MB
MD5b5b1b2dde1eb725a0f482e87fbbe451a
SHA1c091c5756b6d05be135289a76488cd2e24340bf2
SHA2565c15053f232afe6d2467e7ca0f49a76e824076bb2815df1dc88c3cb0faa0aa75
SHA5124fc7838aa6fef576271eb3c4b917220ad2a8a11e61a320c37e8e9baeffad918a6bb6220cfe74a343631a1c70a18d443fa0352fb26c9dcfe5c3740eb5e6434b32
-
Filesize
2.2MB
MD5282bd4e6c09f7c99dcee6b255995de48
SHA14cb310e614f5026c9fcb0bddf7e98a2cb9c32657
SHA2569ce899a502a6a8d608e99e8e6954b5391e3c53a064d3ddd8d81c2aece9e3ffc7
SHA512ec57b2d35e7342573a7ab1cd924c297cb4535df5a5773807414b363c2d53111ecb6048cc1eeaecd01e73f7078e6d01bc54e165523eb4ef0cb9e522e414f9afd4
-
Filesize
1.8MB
MD5fdc3b350cc73707df5869ea3d49d76fd
SHA1dd2d769e24b401fd33b39a6d4d8a6b06bb16a9cb
SHA2560122136d087ec44ef70c5f3af9328cc6acb6bf8e39726d321dd11a62e33106a0
SHA512354113b403a4d5b760407b886bc00c02f60b8bcf4025820a9463771f8978e087fb8545fbfe9d9ba114b76576ef6a593d21428edc1090e5cfb521c93b38e216d8
-
Filesize
1.7MB
MD56347172481fe7063c2a6da61d3b5fa5d
SHA1cebab46e8fd0ea23f873dbf762b6ffb8202a7d42
SHA2560c9e0de7fd3cceb26ee202ab6a9267d891f3be1c8b9ab98de7c593645a02a526
SHA512e400d5eb0cb163d3e9eac5bc8ba183151f6c736f6cd3a9a3a25f81389a933bc2eaa6b56128b247b526c04e86d98be8f6cdb7642e944f77345a242112f96b08f7
-
Filesize
581KB
MD5e6a4f58cc7ed48c66ec3a3934f0d9a9e
SHA197041ff823077d61e92ae2c4d4f229be81450c37
SHA256d8121b1167d13d0ef69dcb487d18be6caff1886ab865a636fda4cdfa7417b56b
SHA51298b2c42e14ccc4c6878e9765789531e5100fef8ea524e28f8eff0b892ded13d5511724abf936a121dd49f587d7cbc28a976a53e01a9459129f004305c8850a82
-
Filesize
581KB
MD5a09a605f042b846bc2bf72356a70150c
SHA1cfe5ecb7275b9b573932c82fa9b17909c5927c2f
SHA256366d2bff99ddbed80a84b242f076e8d426572b0b55a07b42a471983860d5edce
SHA51217f0fc3fe16b3a3c30828ebf80ea660075ddda02389c42e23dc27949000303c6628fcea9dd2c385b232d0841c79e2c5b4435216701030cbc7df4db72ff4187ff
-
Filesize
581KB
MD5c3bd1c1daeebc9f282d2ca35d5922521
SHA1f5169c5f59c42dd5f21be281e3d21c1b8758c384
SHA2565a45b8b7084fd703147154ad79921d99ca7ccba4ff3f662aa21bb8633e6f99a1
SHA51264eb43757c032bddc5678cf6ba6ee921259253bb5299772732894b44394fae54b22a55ad7bbf04b93263d9c4196d0940299c0d4ab50ca6c2cfa0b97e75099114
-
Filesize
601KB
MD5ab356b5c00aa36440f1fb590e5a3f895
SHA1b694c76bf14fa2f20259e631b17d9ed3daf77a87
SHA256fb9f8f56151013958cded79db8cf04b505935f0d99fa0ad2c5383ee1bb4e84cf
SHA512b9bdd07dcf1872943da4418b127dce387ea8e24dda467552f0104d0c560367cb29b3a0989ce79eaf51ac1e884a6957fbcb6b409345431d65add4a4a0f97373b4
-
Filesize
581KB
MD58cb482e2a3fd09d84f9efcb95f117d91
SHA17ca0247d733b66a5c72f48fba41ccf09eedb7aaf
SHA256ee6535fc032787e7d4ec48ee8de0dbce27210b3fe5f252b4c7d4d551870e18ed
SHA512a634a98a4cada1eb2fedb52ae5b34243848439fd556531ba9137ef781c875fce48b1c0123a73556e93298a57890f4d614c8d2924f53b043e946757f1aaa74d52
-
Filesize
581KB
MD5b89a68fa9ae1eab289b825694de6b2cb
SHA1f63e83481948106200405fea8a815a0775069fe1
SHA256cd4bb838a219efd259476625421f4961612bcb297fc7428ce527a54a94689920
SHA51244cb17b029e858d27f4d80be2489c223ba6e1233f8569065253d590243fb728254afc77407423b8937df9fdc9ce27dd415a21d2ee7a1ce92e7712821e7ea54b9
-
Filesize
581KB
MD5554576db745342860951f29ca30660c6
SHA1ca6ab4f3aae4a96439101c9d314ad5c053a307f0
SHA2566a60eae3e38e4dac0a494164c6a9e64e29b086036fcde4ec94fa62e560c81242
SHA5125fce279bc734830a53ea940ba1d075fbd7d8011725cdec3801f39bc36af7cda35895074fcbb952c66bca4adf0773d4271aaf11ca89e89f445c1c59952da05d24
-
Filesize
841KB
MD56323041326a31431886d443018643c51
SHA1855b97638910a941fe847fa957e5107ece1de5d1
SHA2569aa519ee275d254636ee406aa4fe92a51a60abd41422275d291223fbe5ad1bce
SHA5129e68dba043f7123bd8eaf7cde8d44750986a9e01aa2de553965371f9dae59722a6b7941a473577935eed64bc484a816f6e23a804e4e5e33206b942eb55420444
-
Filesize
581KB
MD5ee2abc6f4942eab1e2724b67d3ff7257
SHA1a97a28e643cafbb50a709f9a4959ce5d7971e1de
SHA256f7c69dc51f0da16eef86bf8361ed0df22fc2a7a53ed414f86ff8f5203a6931f2
SHA512d85beb180bdb6771e345f3a5af08e6ad05cf1a3b74fe73cc9d80e1cb0b199e4dca3fc7d80dc9552a5563fd1da5874ff79d15483cd13daec170b4703edbc9f73f
-
Filesize
581KB
MD5e48b4ffbd9ee2589db54fe8379b9bff4
SHA1c93eda7657acac3e27e99b3c5e738787ed1b0384
SHA2565a5cc9ab06bc181649df27fb3fbdbd2be753e3866e4b9056176b85176f356ea2
SHA512de3be253c975ecca4f14079d8581b4ef6fb50164f155d7c8ad4326ac5f25a19cdea291ad5d7465fde799aebea4e0f3f120feddef4a7874aca825665306e1c235
-
Filesize
717KB
MD5b5ce345e3d8a20d3409ca697a8148309
SHA15317a951a645ce4d7e47dd88eede70ca3903f81c
SHA2561f4dbc2af1d18ba8cff1a79e86f897544686086757f5bfb0ece649c56d1799ba
SHA512cb48ec20c27d084f22c3ce3d2bbbd211cd16d105c905b20d473ae4dde6b5fc0900c1b66ba89973917ff3dde0a304b8d98a04c2db6806ac61aeebb374ce23c754
-
Filesize
581KB
MD5ce4882dc03b13ce28027ebad0378e430
SHA14cb887dbdfd945a151b76c05417b04b47ebd6b25
SHA256be00e9a6d686ec43070701433557bfe337d9ddbe494197c13f10df78df8d72e0
SHA512d1fd438862af0e7ae14c31973b5cef5bc61cfc99e08a40bbe25f93d736258dc1719e39027c2291fd61304a85bc94952acb292931988930359b6b736e25f0a628
-
Filesize
581KB
MD513e0b480b4cd29c3d8cd46c2b07c0b78
SHA15976dff59f81887bbdd54e47930a256425e37fc0
SHA256a1ae8acac2e6c5a5e40a08a7a854376a5d3cb108218ff6863ff3a49ecca116c8
SHA5120f8083108aa5e56f56ac2b83d0e7836b323b217a85cb9be5ccb5d034593513ead5f031d298c3f338ffd59e64aed0121827e7a1a10bb179b9a585be48af33a0d3
-
Filesize
717KB
MD55adf10ccb30ccc8c0594a16662415624
SHA1ec76d2452769d8576a4f5da0152bd06d48b6d797
SHA25672d0191dff17134920c44ffa80ed3a418e87d4ab1352ef6e28f21b2df18ddca5
SHA512cc24d0176009bc41db4cfc75602fea910535f152f6024dc3dde40dc8d8ac7ab2e8bc962d826accd7df6798304a86c7eff6afb1ddb6d4960a7d4f017313cc8791
-
Filesize
841KB
MD5ea7776f94cacc24ab987850a62e3baef
SHA157f5da2975ba0410d5611b5383681cd75cff8a33
SHA256e14fda0c0ba1cb1fb2c9f2120dcffc00b19ac8dde2b629791d4cbf8266af7e82
SHA512e9f38b7751ed94707bbb603243c03c78b7a139d4f8a30d3b5d1d8e216880d41602218a3fb196be9ca44dec71c68bedbb7a24404c84549693fc103eab7094a457
-
Filesize
1020KB
MD518916d5cb7ead3cc728c00b110837eab
SHA15f1b2d3ef2b2b79cae820006a7e348957ad760dc
SHA256eb15efd64a93587e8d1b3fd3f9c0c84528323d97ac1720ce2f8d94b6169b9c90
SHA512b3991437336070cecc940d648a75b670dd1b8a492e7791093fd5a0e3c01f255705c104da10551dc3d3367b0833807d3dfc21518da20a505b6032bd2d19e398ac
-
Filesize
581KB
MD5cb4fb974c85acba2b36414b30754d4af
SHA1a15edd6a4ab0917fc84cae71714cf156774a918b
SHA256d2a4fe56715a72f737aacf1ed16ae0543f8b3d39ca379d87f497d4e4bf573eff
SHA5120b09c48f98898a9a1c72f6889b2a55a964915c325671920be6253eaeb57756960b2d8f01e7b17c7243fe79480cd3e7845126fb4ca753264d78bdf06eff15d299
-
Filesize
581KB
MD5f757e7c00d7c1f411d2020b91c1a856d
SHA15fc13499512031857c5d7b4dd15ad14675f4058d
SHA2568831de6752c2778dbe7851387b86e3408daaf86fbd7b0f3589ef53d2002f6fbb
SHA512d331d564ae5888de7a56a5c664b561987d931fcd03b460be5ccf2dabd7774ffa07793b068cc8a131a0ebe3bef33544530f2784d5924587245ece1f68db8ab922
-
Filesize
581KB
MD582927ebe399f3b2e4f5d7529063ded04
SHA1fcb3afe41a9d4f979992852f4f1dc7bae89a14fa
SHA2561d5173de1b630c577e1e51afe28136cbe6231b45ed950dbebfb3dbbcdab7613a
SHA512d6c2138b332f02c5da004c8bb61d453801dcf168a865bc1a3327f37f26b75c7523db78209beaf27fe5add00eb8a68d7ae2f935f88a9364b44b284f97d49c8789
-
Filesize
581KB
MD5ed2abab662e05d02d74e424a9e152a5b
SHA1467e80f96464f8c5029871722312d9c35cd84c5a
SHA25633afe39f2e11f1f4982ec6b7f2583b6dfafdad7a9ef96ca8cd5d6b1d338c6267
SHA512204ce4971fb1a7fbfdb880b2f27b9a214b6db940e19c55b22ee78f0b2147edac244ec54d7d0572dffbee23cb946642e5d36814c58eef22908fa972e5e01144ff
-
Filesize
581KB
MD5376b8e3cf4e39b8c7aab1b4d63c04234
SHA1dad497ab2c2cca507f7a02b08df855defbbb7d21
SHA25675786115d9599aa5cae3c9d4ca212ae08587d9c6ef8cc5d16d5ca67198f37ed5
SHA51262712178e0386c5cb1ae21e54e67d0b55d8b33554133bc704b25142c2bf9f3dafedab963bdd79fad22cda9ee3df106a7266dbbabf15cec208b23cd946a58be37
-
Filesize
581KB
MD507de300f6fc4bf8ca4c01f57ab48bea4
SHA133e99c4b4ad318bddf5ef340faf33a6e659ec907
SHA256c5752282aef353e580e1d8419db9ea83e681d7bb971e0f5eca5557b1a67df080
SHA512a468e6e00ab96397a0c9d60f93f0ec6881791ae6f6b2ed27390205b7daad3471465404372ad912cb03226ad3c5185600373bd784a9e97c8872ea3267d95e59df
-
Filesize
581KB
MD5a6459118c17e4e925b84c03e0524ec9c
SHA13b59d29434b68ae3675f5036181f5e74a7ee913f
SHA25696eee465b3f730fa372f848d9b6dfc2d86320079983709a1fb51a6562ce7603a
SHA5122807a938c571ae3a192d92a6d44e6e032b4709a5eefe106a19bc4d9b6a22f1417395a09eeb8e60500875cc9c0d640112c71096e3a18de9f0973423edf0602f48
-
Filesize
581KB
MD5a2193300c6d4c8312236b829d15e55c4
SHA17cbaedbc8385cf0a5064e01ac7eec5f550e31e45
SHA2564edc00ca8baf98e4a7ddb7bd6f6845cc57fc6445696e0ea855645d718b084ed1
SHA512f4dd2f70347ac6c684566718ccb1e7c7699b74f5effd8c3eed2324cc5b234829efe4f2f0620e8fe8aca1a143621e2a7586473bd1a6cf98d7f91b5f640f6345fd
-
Filesize
581KB
MD5a8079e9cbcebc291e17eac55af7c5a5e
SHA1c89d4dd5999b8c9e4f81901045231fed79144e5f
SHA25609f48cdae1f756bbb8513e42a47ca873d948b36303394327cd7c36939af5b337
SHA512e569de09f2001d3f3200684280f620c2b9933fdfdcdfbb79540d74c9393b71277c320da821e27c99dbb8fbb58c5b96a5e8252cd14a7b9f6fcb7f19b491afe10c
-
Filesize
581KB
MD51e5d014fcc942986f9d47113b995f8a3
SHA1dc010eac2bc8d3281d30f83441fee249ef9dbb27
SHA2565dd76395fd56b6b5e4534b2ecebd4ed19c20a8cb6177bae1919c632202fe23cf
SHA512d2d591a1dcf34f37e01fc0c3d937660365e1ee6963d9a0372415335d7040f4dd35875feb6f241d10590f9cb0260e8a2e2305167407e03d87c867705c4827c177
-
Filesize
581KB
MD54082f870dc5e05e12bfc30b70a3a6cd5
SHA14c9e45d55420fb18e58c3ad23d427f611688df66
SHA25696d09ff2d8faaffc3e44819cbb5b64edd6b804ac84ed0637df4943f18b05caeb
SHA5126674c718e989b18f8651c51c497b32ca631aa9581d9e516a68b5c188ad1fcca51fd5bd9d07cb268da6afb6491b1fe439a47fa0a1f45f81ea4d004a28186b0887
-
Filesize
581KB
MD5ba09260f0e1d45ef84a9eda16f72bbf4
SHA14d28e4c277b1c2028d737248ac1b5e4aeb444afd
SHA25628e9be055eb751dd11bf9766b881a5dee8342fc2085ea51cb1f40b7f6618bdc1
SHA512ec6b00cc2623b4c98def6fe89adefd758db4af2e31def6401504937240c9f75ff2caf9f3b7815222f7cc4f150b96c5d938fcd9b8ab66cba8d806c876dd05220f
-
Filesize
581KB
MD571a4f58e7b5aaea101de343676ccefa9
SHA1e4a0c79934e0ce4b40b19da507d9e09cafd10dc7
SHA25629cb3985826fcb9bad04525432bca965da8f1bad7ef8f586b2d18b17d6def47e
SHA512cbb88a9eb465067c09a31aae12e7035bfe6c356ab3b7d175a2ad98ecee6922d5f985e9ed31de37d936e95ca38766248ea18ec99a9db6ae1fbd51455edbe30005
-
Filesize
581KB
MD5628f0475a37e5dd504e0024cbd60b611
SHA1eff3e9f9884a56085d599ebc3ee8bbd55ec346c1
SHA2568a99f830aafdae51f1970f097103d2019fa14e31afe620b1a14847a7a69da8cf
SHA512ea5b7da416a2920f73de5cc8fdefba6283c7e8057051cc2e1ebb119b1533f5355fea3c4f323a9f65dd4f56b4b3d08ddb70c583a368b1c99d1818d9246566498b
-
Filesize
581KB
MD57d91042e21875000ebbf6a8d3ffcc33d
SHA1c2aca5dd07c5f05c3ff343d125c8cca5cf0948b9
SHA2565ca4b6c2e5eaac124e3b9d901c6c50386527454fb30b37d3055d944ee25241f7
SHA512076692c67da02f47e219a4efb118a7075fb75696215495b606c9529289856cf9c3a97943888547ca6735df2d55d6d939c9445ebd14f8f64cb95a225152aa5816
-
Filesize
581KB
MD5d7832b79785c7e67da0a9a7ab6394d20
SHA144de20da62a43cc3ab03c33bd2563e2404d974fa
SHA25625c5a8ff991a0decb60fc80ec8d80dd119234ec1d6c620f2f766b4154cbe9c74
SHA512f331cb9114e2746b23dc40bb9737fa81754c6fbe47ce3ffc32b95dfdff719462d2ba5af1d56fc8aadac4f801c82d8e9baf1f1836aa04c9ec155aae6cc10c841d
-
Filesize
581KB
MD5409752e5e994b5a175311a6ed41e75f1
SHA11819b9d5ff66cff11651769c2f422eab77a4cc2c
SHA2569b898218ae84a12f8c471630c6008baea3adc04fc9329ce66328a5b3f5108531
SHA5129359930350f5df151dfa3b37d2464b8a03dbf5f3f20a3b1e4b0ca7d8224315324489c61899a45a4ef7764204756de2d06ff9925fc70dd2320673fe3ba3c78301
-
Filesize
581KB
MD54764411a81e04097359a9fcfa6214a42
SHA103ae3375d6497399e61ff2bbcaaf2c0a5f2c54d8
SHA2569460f51988b06a44e4217f5683bc5f701a05f999ab026319f3dea2c7f0fee471
SHA512b32823264b966e20b1eae8f858097f78e096a4d8e975dbfa422ef4b9e91348f19d188434e1c33fb1b37161299daec7271aa27907a3394bfa9388983e4d0f9f36
-
Filesize
581KB
MD5d1019f0633d59a2ac50a5fae3d6358e9
SHA1320f35f2111baddf19c76e9c025d2119121f514f
SHA256a575ff70e90433dc560e1136fae80d2c15aa7ccb8cea2c3895ba90de3a68b181
SHA5122d1bee65777937a81e88f42f19961806f35693607bddbf7f2e5aa7b4d9f9bca9c3677d7fabd3f03ceec7b9ffacc258ff3fe7ac00244a3271f8f36cdd9bb1cda3
-
Filesize
581KB
MD50c97dc07fc4fbb9820e5c5b93199240a
SHA13a19c07fcadaa18e9528ab018b4c521921da06f7
SHA25673a3b01476b4712f35c4ce0efb06bc53d4284b47ed679dd5e6bbd4644568f4e2
SHA512efdabd9c328dde8749964e9b1a414cb189bf32834df537dedd040a19a47cd459fd85c1c75e43e4ee1627cde22adc597a6fc24ef42c0f3a0ea56aaae94c46ae2f
-
Filesize
581KB
MD5e8269f63403d1bbd00254c4f555c0b4f
SHA100ff6465a8bd4e6253c6a839d995a759ec3d8663
SHA2564c6c06fc93325163e4fb9f317d2f75dea51f0c81bbc3f83e4e7ccc8088c95f7d
SHA512bb841a86801a4e0b411e418a7b589d3c49ef0ec6b301b7e1aa2bca3561b37eb7e68c3a518e6f74a9463a304f6ceea509bc6c3e994dfb5813222400d5ef2d9e66
-
Filesize
701KB
MD55cb30eeda95b0a193c9f41d026b54e8f
SHA12cb419b7ace2d4bc424dd03b6b27625a28aaa6cd
SHA256ea4686b3a6ab90f49dc64175c900e9b41fb66e6b84a370aaac76d62c64fde7e4
SHA512610801f1caa0b100ea552edf400e6ff8434d1b895bb31eb58601d17a0966d7577f419435f1470f72b85937f9fcfaae22d84d5d8684a18cd7be1f082845a30f08
-
Filesize
659KB
MD54c56706d34ce1001235a82b39e04fa3a
SHA124a44871d24858c268c9093fda8cb48f0fd7b9be
SHA2566f14a983c49b7c57bac6f5878a8d4b03ea143444c36a44d88f9f8eac7761e05f
SHA512cf4b51ac5128b881454ec532e078af8d78779c5b992f67dfb71953fa5acd54f1d408ea585e5a7370b91a558634b3cac7a6649ea4a863efc9ab33c157dd93cf84
-
Filesize
1.2MB
MD567c94432382df328e0ad9275156d3d17
SHA1c73046e36c5cfbcb6b01d57d759a7d38ce3c5586
SHA256a9a630d283b636da8cb3234a6aa943595be9f66c0910682835cbf8d2670d5ee7
SHA512dd207dbf6e6b9b0c10e0330d26ce32bf3826813ecb39f498ae747fd9db92676bb457c51d4004ce7c8774e21fac35403883791f5458d3cbe830654e5eb059d995
-
Filesize
661KB
MD58e398d57ecb4f2e619c5c1bb238413c3
SHA135223000de9081feaeae4e17fabc36d71893de9d
SHA2561c849b7c6d6e353c08dfb6d4020b8c9f26a469c4151c022b1901da69ec1e2f98
SHA512a96d441270cf3aebfaf06bf1df21f54498ff994765e01ff8277090e274ee7db4eb8bd97e98b5481ee2e30597d2863f47b16cd81f6080d1c4f72881b864c089ee
-
Filesize
1.3MB
MD57d2ec4be9c2b31116eef9c99f2e35904
SHA18b92c83503d3a49ddf6f194f6ba852d2782b1de1
SHA2564785b731b543cd9c87f37adaae36c5300980545cb3172d0ba88ed710032b3c11
SHA512bee9d3a7f9f896239277a5e03c716f9ec0d2e3646eba54ba961c279f4bb861fa5108a3ab958c39a2d0c8d76990ae4ed63b01b1278c161392f6c7e43026ded273