Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01-06-2024 20:52
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-01_bbdfff8d36f4b0ffa393861c1f0d5819_ryuk.exe
Resource
win7-20240419-en
General
-
Target
2024-06-01_bbdfff8d36f4b0ffa393861c1f0d5819_ryuk.exe
-
Size
2.2MB
-
MD5
bbdfff8d36f4b0ffa393861c1f0d5819
-
SHA1
8be12b7b1bcb4abb5fa45b7a83178c21e95a49f7
-
SHA256
782a85e1460522b96429789655ab44a131a076c99015b78e4c5d2fe77284c005
-
SHA512
e4b2c407b9600b2d2cf637fea7cfa2bdf2d41df7dc8cbf90e32affea9a144870641c7715db08e69d599f0a0e7a0765de81d028fc5c42199a7213bb1534e518f5
-
SSDEEP
24576:wOObVw4TaN1wdkukCba4oXtgLhU3wEdmh58qSkQ/7Gb8NLEbeZ:wOOh3aN4kuLbegmtG2kQ/qoLEw
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 3536 alg.exe 2964 DiagnosticsHub.StandardCollector.Service.exe 1060 fxssvc.exe 2340 elevation_service.exe 2284 elevation_service.exe 5052 maintenanceservice.exe 1004 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 11 IoCs
description ioc Process File opened for modification C:\Windows\System32\alg.exe 2024-06-01_bbdfff8d36f4b0ffa393861c1f0d5819_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-06-01_bbdfff8d36f4b0ffa393861c1f0d5819_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-06-01_bbdfff8d36f4b0ffa393861c1f0d5819_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-06-01_bbdfff8d36f4b0ffa393861c1f0d5819_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-06-01_bbdfff8d36f4b0ffa393861c1f0d5819_ryuk.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\3afe88cfb4b1389a.bin alg.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_99718\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{28C8484C-303E-4CB2-A704-E3FF47E10F7C}\chrome_installer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_99718\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe alg.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2964 DiagnosticsHub.StandardCollector.Service.exe 2964 DiagnosticsHub.StandardCollector.Service.exe 2964 DiagnosticsHub.StandardCollector.Service.exe 2964 DiagnosticsHub.StandardCollector.Service.exe 2964 DiagnosticsHub.StandardCollector.Service.exe 2964 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 668 Process not Found 668 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1868 2024-06-01_bbdfff8d36f4b0ffa393861c1f0d5819_ryuk.exe Token: SeAuditPrivilege 1060 fxssvc.exe Token: SeDebugPrivilege 3536 alg.exe Token: SeDebugPrivilege 3536 alg.exe Token: SeDebugPrivilege 3536 alg.exe Token: SeDebugPrivilege 2964 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-01_bbdfff8d36f4b0ffa393861c1f0d5819_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-01_bbdfff8d36f4b0ffa393861c1f0d5819_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1868
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3536
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2964
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:5080
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1060
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2340
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2284
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:5052
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:1004
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5fae9a7ebbefd73c336e1678d72dc9473
SHA1e49ce319e2dd5a0d5d32304fb490925728f7a2ea
SHA256e91cac3de9c54c9c34a2596718444df2d8e722125d90b30d1f72791dfbf83874
SHA5124a5d573adcd186e9ffcc3c75ea36bc972393c7ee70f265ae879602871875b7c712f2d2a9275e54297455dbef7b70f758c4aa65cf07693f837bd121ff1116f639
-
Filesize
797KB
MD504f3d955c0b1391bc6740d71ee33f433
SHA10ddfd6324fd49ff27cca755632d345845d454588
SHA256c5c21cb5b5a5c35802eda1ee2379e14946f83fb817067c99f44c68cdbe22844b
SHA51216c36f6efa511af26f02ec76662b7bc3dce420d744e524ff69d62bd6628ae638dc6f77a923070063631daeec41b3b58881ab76f0a66f8930e7073564f4dfef41
-
Filesize
1.1MB
MD5841d30b817d9843aa0ea8ce2bf33a3d8
SHA182dd84f83baacc77ac2ab3175a7f0984c9e1afdb
SHA2567dfdcf76bab96ebba07cd2aa76db425862403f1561644163882fd36d606c3cff
SHA512c75c4ad80c214f3378c6cd2897643485e4ca650908f8ba4fefdaf9f80c8550c7718194c1143c21c2ebc943183ca5f1d54fe70eb9ec12cd6b36e2c3a78657a160
-
Filesize
1.5MB
MD5d175fa658eea785fd7e4e710418777a4
SHA11a29c00da0a7f59802c32bb691172e0a1a5dc839
SHA2563f6b8a17dd8ca3fcd6cc3b8909b7ca5813aa498c9ecf04c2951a382f902541a9
SHA51291c361d9e084721eed1e134f2dcd66dc65f88a9acbb576c9003d537ed23338c5e9fb24778c63f0251c609ed840e1862d54bac99d01fe477bb13f5b655e8470d3
-
Filesize
1.2MB
MD5c4b5bb247215caff0989d17cba6f9f73
SHA1737ea619ce469bcc750269023bf9cb0324436931
SHA2567833dc4ccdfd6210756e684aedcce7b3feb83e17207e3abe0e2eee0c581b1364
SHA512431f3b1230eaf1d3afa6c0188bf5b1b4afa0bbc1e662ce95c873372a46fc51dea2ca9b0751ee459617e708c84e09db78de5fc579c0360de3850f76cb37bb5f40
-
Filesize
582KB
MD5984d3acb4df42b9097a658d0ea34180f
SHA10cb695c2f9cf8b71721400defc72d99fe24823f3
SHA25620fadcf5792fa7753e9da10228bdfc094c947a5f42f1de103e732cc7b118c2cd
SHA51272ab24284d6909ec9b30744c5382fd3694b829e609b057ac4f372c9b08c27f8f1b043304f76d0c3caaffc5049e2f483663590a00f139886310eafe3a754f785b
-
Filesize
840KB
MD5b0caa9f26c94ec0a8389fac2875e1109
SHA147562e1c012560a8973d73c6dbfc3d9d476e6225
SHA2563963fd5600c7eef50092ae77f7ac55dc013a75445e7708481e89a5962ebe499f
SHA512bb1f844a9b4c50ca62de4fa937240d497aeede23b4184e5c866d6ee00b4e4aff20dee957f5c387643aa3064a9c705a9a8002eb850da876dbd0ab4f4b84ff9558
-
Filesize
4.6MB
MD5d58c44af6df0f83ebe98488b869f6c5c
SHA1eb9d2b613b34269ed6dedcadeef1ac3ab27a0511
SHA256c489673d03195894c24d0e9f513d564fcee5dbf6c36de52e991fdaa3c1e201a1
SHA512c9c158dc68764b42fb6382f76ff64582e19752455163315a032da55eb5c99f0e5244e892cad77742fcc7070d6a21be51acc88f9a5d07b25f9b4bad945547ba3e
-
Filesize
910KB
MD51fc7a87c4318e652cacfe7c30d469cde
SHA1af1eac91c84e287b8bf09a2787d6723b59415f3d
SHA2567fd2525b36fd48e0279d1da7c90b8f661e51036430143d87b4d3051890a4a6ca
SHA51231ef9f194480ba93072f9a8002ffb6f19aad1c2b2c53510983dda74a576a5aa7a00514f3b8de01fee0be97b9a1c83865b9c4e853a9865492d4207d3a8a9aa91c
-
Filesize
24.0MB
MD59b67ed5af14d989c828559523e436be4
SHA1f7eed941afb3bca65e266093ea21e4cf00e0853c
SHA2565d9478fb140a46706a226c09423b5ff3fff45fd5e033b7534482c5d971c806a1
SHA5124b869edb06f8c8fe3cd3455bb3ed21c52d94af36546bcda559ab4e0a4c46e60d2b7107eeaf04df5102d8c25036e857ab7066d379d4345935979e85a2e376f381
-
Filesize
2.7MB
MD5266c8768a86c16aa6e3cef261b430468
SHA1a6d617f61776431c8b2016aaf2fdb19949bc30c6
SHA25631b735c69e859761345936644158c2531793a2b9e4deb0b92446db1ae152854b
SHA5124ef15fdc848d39a938c52c90af34f025e362db29c7c162d10273c8039529bf9626b8a88ba5d2498464564a37cbb233de6501b61f5fa119eeed9f7788d03d41f4
-
Filesize
1.1MB
MD5ce61b922616e5818d64b717337dd8e5e
SHA1355affb6c68283cb8f3c7add2af5c7ceb9b9f17b
SHA256d7c117c64f29e997d3b2df97fa90cd3221c60dec70a7a4f34a4da3c6fd9904e6
SHA512c4db371f5e201968ed12e6179ede11f852a9995284867a0f37cea9fb6d876f41c6990be3466756fba2dd1955268390ebad71ef77926550aae8600ac60ff0067e
-
Filesize
805KB
MD5e6b5a4f17ae460891af7200542054b52
SHA1768216a4dabf7cd413b32a3adab745eb40318b6f
SHA256a387bd3edf61eb58a09417a37f4fb6f9d6e51fd825a4a5b2d042a53e0f1412ef
SHA5125d13dc1adec8e57f4afb14712da08c4ed71fa2c90fee472ff8e6d968972141732c6b3f2ec8a20400ac22ff31314c6da1ff98a4c45f68816ec2f1aa4731afdb2e
-
Filesize
656KB
MD5e38b6b3590a989167768868d1b83c5d0
SHA1f8a71d405a5ad486f0eee6abc705e9b40d39c3f7
SHA256cd8d668778b510752081b58353069b9338333deea34d494e47e6facb938b98b4
SHA51212e619c9409918946179192d7837d2037107efefb3ceaa26f2ebe8b2b7e21e32fffe59d0bf14ce3138aaadac84b9621f3088243cc60e4b875dde91c4e5925f3b
-
Filesize
5.4MB
MD5d314cf762fc0461eb8f05163868fa7b6
SHA173636c3ebec77ec0b761c3053be44926676fefbc
SHA2567fb9d5843ee429d8c04f6ad9650fa3ff733de16e4fdef21a6c611d6df2d83807
SHA512b9c58588a48253dbd12f0465ca4985ca1c4638144dee02f0c9c7ac307a21f652614b01dceb0cd72c920bb4b0459cd179d5fce9e1c3329e6d670a876cd41ff213
-
Filesize
5.4MB
MD5bc6936fe02e24cd0eacfd41402c2544e
SHA111a34d10aa442841fcd596bef2fcb256b3ce8428
SHA256c4e7c7105f661ae200aefd7f25a474bacecfb6d2357ca0a0de6f3f68168ac590
SHA512a068baee484e5e849d924ceeb02171f104e8e82cd0608f79d7c20f3a9d2103ca4e93c860eec9f345040953bc277b750166247fec379c597389f71760416c1c83
-
Filesize
2.0MB
MD53a6a0cfb36c8fa448b4ebfb39377a303
SHA124edb73cc17759abfc5d39497a919bb2678915ee
SHA2566f279df06b1cf37e97a7cad227f98050eae7a11a07f336373426e94a70292b6b
SHA5124e01a7352d51188475368d9c7dcd67f757c5fba2a478dba4acde5a200790316fbfb0c93fa64e5b914a2d0f5d063c75335bcd5aa014b51283f5b82c02baefc835
-
Filesize
2.2MB
MD581e57c32bedc6226b1eb6a3d9a1d2906
SHA172ba1afc2ebb121198e4297d8a70a2fb07cebe18
SHA256cbd83fadd0122d23daabe27520caba70a448e24cd4a680fdb3c50705c37fc723
SHA512c5586b551b502d5b57671fc0eaa9dd209ae975e032034e64348578e316f8447469cc91f0e1b97c06f39a13ebb49494512663d48808821b026e27370ca3632c10
-
Filesize
1.8MB
MD5c3d293898d586979901d45b33dbec43b
SHA13ece3ff4fb1d9881c72101d200a3a120533a8bb5
SHA2565d0230b31fb1217316d0007a218ddcf9a152698265249899a27b2098b4935b69
SHA512a2a84c0374c554dd8375b1da4e1761c043f38be9bdaa2f8a6da72bcc06579c0963bb1303a0fb3145a3a62909eb47e93fa9bd4ff30fe9b8ac03984abfc5101f69
-
Filesize
1.7MB
MD52073630a2997e7a722fa5453452000d9
SHA115d8d4a85599eb43da7eb1ea717a241de9f877e7
SHA256f06d9e437db8bc9031eed068e41ef7aaca237b6057620fb139a2075645721a14
SHA51287eac2df37708cb306b40d9bef2430dda08216f28d81803a0b7fd99bbb3bcf49a59bf850514c9878897ea1d50f56d70b0d418651753ee307f53845d11bd6ed03
-
Filesize
581KB
MD55be6fc4aa2f621c4e1c078974b01a0ef
SHA1a0138a980aff0cd0fc46b3cf10946c8038270229
SHA25663d791883fe058076daee0924166e9b4c36cadfb349f4f81c2b8a34562dc84f1
SHA5125019bebfbfe82f5a27460d55f76cb4fa85731466b1ec93beeb4df91a9075764170d4c0e7d1eb11c2e06df98b48647575f27ef2aaa1187ebf858305b560254ba3
-
Filesize
581KB
MD50b5b70b4ebd0fed5dfa6ec8dc4d7b19e
SHA1a145845f1a6dc6c476b1b9dc9846f33ab127df14
SHA256330e18f61539758c4c357d5c8a94dba049b3bed892722f246699bea90a9ed2a9
SHA51254dac4a209b3be9a87b431005c338b2b45fea73159d78a8367320576e8f930deaa25795c06bc235b4e37b6a7ca9d17a7cd75f8f0375879d235f6db11968ec09b
-
Filesize
581KB
MD5e05c39f998e3335ef2dd8a5b2fda2a42
SHA19a1748b419f71579e740792524db9db5314f89d5
SHA25601aa3f6d165f8b1b5c75bd537f28a309076f8cd17f507b0a19fd569c4a3e9a42
SHA5122c3484cccf03c04d744f7ebcdf5c929f14f7991b0575893db07cf6bab1d4cdaecdb10482516e21343ee2d77c9da27c337074ff2a63ed038aa10abd24478c6435
-
Filesize
601KB
MD5ef3bb30798d283ccdcb24f300e6e3fc9
SHA14acad50752721a0dead8ac11955653a8a95c254c
SHA256ba3b8d9ac09c3a43ecf555fb3ea9bb0989ee1c50dbaafc05fc246dfda90e4a90
SHA51255b41209e054473c6c0086a0604ab94d7c054b199db4cd716fe6eccc7f80afa09f761405a8ce843164d1a214795a58baa80c1b86bd72a3a34472d12f130f8f2b
-
Filesize
581KB
MD52bbeb551ef2416bfa2c0fae368069426
SHA19bfcdcb32c1d95c129183e8795fee37d9136fd53
SHA256bd6082e51cc9d2f8ae377e85861649f39241a017b5db6a012e43bdaf3c77bd1d
SHA5120adf1c70c7e0f2e80c85509393ba50dda8a8abedea49e7f59da86a441f836b3ae755b478a55405c3d94bd737e7d9d36a864eceea36dd83b249930b4737a0b6c5
-
Filesize
581KB
MD5672c460853d7f9e4b67b6bd262eb9a3d
SHA1b9439b14035674a6d2ce21acad8422c3e469b3aa
SHA2569b32ea54a9f3076b5961a00b5d5d5bffc9b8d97e43f4b5cde967feac9d6e15f5
SHA5121d7af928eecd3d3835792eac7b8a9a7d977de14c5ae97b88e64fd3065737db439f1de02cf4f6a0ec65bb5eb09bbb81a32d7806dfcf037392a66161a99a246b70
-
Filesize
581KB
MD5902b3688aeeebda80aa8ff11990ea391
SHA1c3c185e8d035c2cf80c480e65fdb31e5cab783a4
SHA256656c5dff33a7e98a00b61f9a96e601f7f4a8dc0cf32621cec2d8bf0d1048d3f6
SHA5122879e1f363b8c1d3bc143758b33afceb14f086099ec4fd873e38ac0c4cadc1705cb7b0996eaf2c6bf5c2aa463234dea558ec308e681ceacbdfa7434248cdd135
-
Filesize
841KB
MD51a0ce96cf7fdd2e958b250ca33721d7e
SHA1be7e6bd8fd4c587bb5413f4fc715768260d69e9f
SHA256e2d79e9198b97b9a79198cac923aa8196d331ddc9a94a7ae7c6d5124def528c9
SHA512515b9e1966c2d972f8e81d4bb4aa2b895a5d0c16a31fbad522400c1abd940cb372a8d91b5a3fce64af6352742d0fba15077ae37041f8c5d280618ba852c3d97c
-
Filesize
581KB
MD5b097db197741d098725640d9db9a32f6
SHA1040e59a49cec15a32221897f6dce9fd5cf14ac92
SHA25676b927554dae97ca8515d76a0712b41f6a5bf050e7064969dfc31391af393fcb
SHA512deb7ed818fdc84e18c0ba4ee8b63f4f2d38ebd5fb9bc360883708a97500bf3d7bbc27d7d2d91e727c4a5fef617fdb8f701c4803f91f9a42d1818f9e2de60017d
-
Filesize
581KB
MD587104e8106a367f963488146efc8ae94
SHA1e4f165ca5b959dc336d8b2e0ba466c74b38799c7
SHA256f171c0e2627f68f2f5069a385b3c789dd0b6227cbef886df00f4caa6b820a829
SHA5122e3446f317d1bb29d39a3dbaa611b98f35c15b84256c3d30703851b7f51ac08ca73a78f9783f3f6227d8ec13377339e83783632b3b0f43287603a57fa8280aef
-
Filesize
717KB
MD531178d9bcee2b1f526f974ded04617a6
SHA19c867eac1d26e93397d5ac9e9b85adbb3f4bb9ef
SHA25673459d47b25fb49e2ecd917f1a01307a827eec5387c52cb78aa3fade33138a12
SHA512013b37ceb36243ddddb07e31eb6953e8e9d776f66d5b7670046fd570e9fc569ed54dd57e67b2e9b1302a7f6344cb68b1ebc6f002ca664674a762d868c62361af
-
Filesize
581KB
MD5ae463d7e59c79d6c3bab78454450b6f5
SHA1391c7142de0221e348958d3d5a5fffaa0a93dc1e
SHA2563626d70dcff4bdf874512c49a7d86fc679ec9aeb1a11bf54e562e52d4264b7b0
SHA512620e355f3569f4acab8641ebf58639fa2c8769fe0964450ad9a89817aecb94bd9fb916fa19073eca9c454b57c84a0607602ff5cbaf96d250cd89663204992d50
-
Filesize
581KB
MD522389b2d476a18f0c2468c7740083ac1
SHA1c5c8e800113a72a5bc08261c814f59b755e16df4
SHA2566cd28c7c436f372b77d18ca9af2df0a31ae989ce660a130e2825ea01bd38b506
SHA51276db4d0928052789d626c1d68455ed3031829e87fbf1dab209bd5c187a5e49d80025c9ddcbc44ebcc63d181bae3a27e907ee4257bf667a423c3f0b8be0ad1786
-
Filesize
717KB
MD5da92bcd926bbf136a3738613fad08bd9
SHA1c78669ce89a1c65a97f6b755215c8b457d290365
SHA2566cdd67a21ab05d484ee20437558027fa15ac4074ec4abf049441900b61fa01d2
SHA5121c391cbeffc732f4e2ccfc72948abb15d02232e87158158acd3ccc16ddebcc91f6205525bc6eb6615b624d48a691881eef5ef6ab8ba49bac0a1cd80ca6496b89
-
Filesize
841KB
MD5c794580918aef36d387095dae421bce6
SHA1e61ebcd03bc4c6231515986f14bf35f7eebef6c5
SHA256c2d5348efcdb776478ca940135064c32dbdd66fa4d7c672827c3937431821bdf
SHA5125e2cdf5a0dedc7163bfe62d5edb4d92a60fa88a49be1258c047357ec3253cece7b8313da87f98959a4870d80d197dbb07e1cfedbbb909d9b9fd3eca6c5330075
-
Filesize
1020KB
MD5fe3f2319df66be2f3ac5c5ab6826eece
SHA11489bbe3f8415351e24ee231a6eeb1a5a2fef2ef
SHA256a2dfc792b479c2308ac2c53cbfb6275807fa806d8c6c324f58e6cfef75837f53
SHA5125e3abfedbdc33b9f230865df3b98db0406bfab46a8ecd387ae86343ab695d52553c70c61d4b8af7e64230df5e4d2ea2b821d659f746334decc0eb1bb108659e2
-
Filesize
581KB
MD5330bf119b8b965f7fc482dc8e0f566fc
SHA1cf031ada29ce8cff1b6ce8b9c96ab76c4fee1a64
SHA2561661a0dff51f65b707f3b046ef0290575758852e9ec7c382c5c7cb15e1402a85
SHA5124ccd33409f87665c17ea11db8fa1ce634015d85e506ecd1674f881e95d4cba869ea4ec24d994d71f6418584273e6c1d6e7d0d2e53029600ad5f793f767b9ea38
-
Filesize
581KB
MD5dce2090f6e7b389f8313e181ace2813f
SHA16cf648ef8b31218b02280f8c060168dd520b5b65
SHA2560ea8ba9eebdac5fdda5b0e53a2316d04a974c13710971474c0b3b2bb12687302
SHA512174b64d0ec0e5a1c0d2aa887e28a7b82d92dbc1f63f82ed3874ae1aed203d336fe921af1c671fcdb95a5952e1d2085738a31e905a552ea8a4308b0a80edcc04d
-
Filesize
581KB
MD5126159e4588694bc1910f8fabbad8d11
SHA1f64d3286243f8ea63aa6dc48ba079ed3a3ad5a62
SHA25692ce48091c1a54652fc7b61a05a1a6824bb08e916dc6ebfa3b6187860beabf41
SHA512b31af4e335367495588b1cf74500bcd8cd985f9205d88bedcae8da71374d30ee2d500d8ecb23854bab4d32693745f669ac1c2755ec5f166ee3bcc8ac7c6fa6e4
-
Filesize
581KB
MD5c2189143c4d2de52878a806f2537df3c
SHA138a80ba4b4d17bfcbbf842e7cde1fea5d5279db5
SHA256d35d347aa9cd555d51cbc1a265b8e1ca84a7df997bbdc12f7fa9b6bcf73827ae
SHA5123d4ab6c9ac532150a6f61a9cc21b06723648abfa63c1be361186071212fdf3d261ab5541f69542d944cfbe40b863596b84346d196fb30276ea19f5104c04778a
-
Filesize
581KB
MD5476e81dfdd8fac4711219be1e1948738
SHA1ba89cb04d3d959292b07fc26fc4d4a096cb96c78
SHA25673fe0671719842c40c764bd359a29d0517e45062ef526de2281bdd3254325082
SHA5123b88c64f373f451a35bc097d04a3ccfe5eb0a0f0c6eea23611a41165e609b3b8238c3c22574b1ddae169eea241736a375698cc145bd2398133da425c527a47a8
-
Filesize
581KB
MD598af28eca13a601789db68983703d490
SHA14276bcd3487510a84598add1b7b0401dbf676272
SHA256c603bfba44b5b49df11ace19846f6f5cc4c0bd06e38bcdc41d0b003b22759417
SHA5123c803fe1b96867bb5c434cd234ee5f35a5fcaf05b78a72ec24821bb2059df8c7a4a6d0fec60afcfd66f678100e70def46e16afe0caac3f1233148ccf01029c6d
-
Filesize
581KB
MD55a25cd73aa67e140d4f14e316298e66c
SHA1b6497b056e80f7bd04fc9f32a17d902cded986e9
SHA25617716b01e42d732f12b5d8a30bb46ea10ad57d5a02e37bd74a636b6d9dae8f15
SHA512902b5cd7f7c08ac0c5f61ab1df630fc8376bfe50db95ad3fa8866aad05d6e72fdd4e5516cbb52b6139ed8351091e243f9c67c9318a59b973bc43ce7ec30bd24d
-
Filesize
581KB
MD5b67c08a458babc0faabd96f22b8cbf61
SHA1103a514de284260abe1c2f918bf474acac7522ec
SHA2560f5a7cff92a129df4a201e6a5c3ce9a03d92b3051acec152cea78350ddeffdb0
SHA5126a36f67b87407b23e19d2c2e74139743ac2d456081ff892e9d922073dfe4e0ba02ceaad19181b6b49a9a0c7e774870e5f76cfd6fb182f9b922c126b693ff70e7
-
Filesize
581KB
MD5f8f025ea98a6e09ce16601f2f685334c
SHA1b606de7b3a1a27ea18d2a98aa33cfcb7b764399c
SHA256682447c70f8002c641edda4117bec7862a74afa340ce5ce00a9e0bddc7e717f7
SHA512a451f57e405c58a71e43b0e8fcda6c0afcb06e3263657dbf9aea383abc7e911b5a2f1da0a93ec25557aaaad4d0452bd8362093706bda04f70aca311227b4f8b0
-
Filesize
581KB
MD5513f5ff09e74aa8baf385b77f6e8754f
SHA15c23b58bacbc8a23d51277e50e18fea3fed3ca99
SHA2565b97cdf47b2bd080f9a527830a07c99575389199870f0af540b1a4752cf5f64d
SHA5121d105f11c6db62aeb6e376fa821d2cc24836944a793ae9c7222602658f925bbd09c9a5f5bfba17ffed22667065235edf9025b4f8f50fc9d3375b49a7df7f1ff0
-
Filesize
581KB
MD534a18ac059bc3dabba0d7ee4c6a77413
SHA1314860d054b1fbf6ae573e8eb6315930abaa50d5
SHA25626ef0453ce8d1e48dcaff6fbc436a5f66c95c3ffed63efae4e089dbfc7c353e6
SHA51292a09ff1f60e7a9bac8562cca425bb91ec2cee9e598f983a6e4a6bc34c690b1d5bf57d1765da4f0800af6dceecc8553fa1b4c92d304673a3179613c897471607
-
Filesize
581KB
MD52907f2fc87e4398dff90196ece78aa53
SHA16a11f69ab6617d17dbae97871edf0b8841315207
SHA256da5dcab71b526f8875be65af5ffadcbf2a725fcf1d0a5a4523d7279650761d27
SHA5125f91c01f255827c75c3b1ade044cb45df5b3c4e2c292ebb89726aa3ba1b265d9abba7551b560e47d79431a06907e5655210b40a7e1e219ca20899853b5a74f3d
-
Filesize
581KB
MD56c68d9797200af861da2f3f69bcd3fa0
SHA18517ac166ea792ec990df26b5e5001968726e563
SHA256e424cc0d8f789f7f2e477b0c10ca28b3e3c724ac4ee10939e398ddb9b9ed5fb9
SHA5129346c529cd4e524f47b8a884231527031479fd8969a2d5b84fa408d2492c5290588a495e76644def473cc09472a34708be650f425ed2c105e3c0b40e3336362a
-
Filesize
581KB
MD55f75b08d560d42e2112b375c3a24a0ea
SHA1d704ad4d4165458b641017b5bf1b3c50301b52e0
SHA25677481bf22ad19f77d8823a8c3957b6b6f579c5215cd16e5d16722249775746a4
SHA512f39fefedd13448c980993e80e3b25e42b59deea57f212789875673e2c313d1c91f0a06b8aefb3840c26c8a038393304a83e2e600d1a4e582cf8061fdb48a16f3
-
Filesize
581KB
MD5abfcb4d80327118cc4fe8341e32a6529
SHA1de05e301be99516f901b2b4fa3766af9eaa1ad08
SHA256223d1f807a02cefd1a24cdda1587c5c75c06d57e4a5d9954bc6f4dca93dab3a6
SHA512bda5c009a8f6a9d9fb66fd0ba178c073db5e8e2a8e080f0ddb0fdad109edb15bab85e5814b1abbfc9c42513df013bfe001c5912206a504752952daa2fd545228
-
Filesize
581KB
MD54ccf99682f349288058d6993238a01cd
SHA18148c41a9b029cab529d577b3dc82e40d299ca84
SHA256643dca181360e8a0821b5045575c984802aefc831c753f57490c870db8b28996
SHA512e72c052707b35486ddcfaa8c2505f4990607c65d275b7f4e226b1f7fa4f09355f3e2e54d817a426c07c346ee13df11b3ec56f981cd70f7424d521822bba631f7
-
Filesize
581KB
MD578aaf418a6ca39d248c9eb421152c7b3
SHA1b05f59c60576da32bab94a387fb9a32a0e6f2f88
SHA2569ee890513fcf9e0aadad9b30711e679c91b28f9b5625a943e6ac028029a6084a
SHA5128a6396998cc40ed90de649971ba3ccb1edde2a6daa40170d5e7daa19e50e271682581985bb8e32d94696ff2f2dd0bb139c55c3ec8f33b2669d090cd93d6b4746
-
Filesize
581KB
MD5ca129f4ae7cf7e54be8202974bb385da
SHA1e5d923aaa662c119cb46f47bd0f3d067975ad11c
SHA2564a342cfdc7cd75a54107228f447884dea84e61dd829615b9f06a349f65b81b13
SHA512b03060c1a6188cd47ef9c708be75d7e32860e36a1d3a18896fe71a84eaa340446b2a2c670f3f26530fb062ce7689f3486ac090bf37a30bad51add7c3849d0f86
-
Filesize
581KB
MD51d676edf85b955303283b7e14a88891b
SHA15472c792ee429348d225121e027237211ac47068
SHA256fd79f3281572f4276cc588257b6bd5e4703deb9e6a7929709b4fd0044ab9ac6b
SHA512de1cc1e6d8714b20a5df9d98c64c9b1317a622f3371cc5016e1206ddf00e9f8afcedd0e64f40ed79479050503807f9f7314f2804cd19b744d4ce040ee264d781
-
Filesize
581KB
MD59d65fc66d064678708126902922215f7
SHA10b83e2601a4b39b6ac2b83071b5c499aa7a10672
SHA256134a0003e0850434ed06850c19eea152aca089ccce48b8918570811960aa064a
SHA512734aeff0338ecd205178762c955cc9a09148d8d47b76475ca23288afa3a75399305061ab4789e3e1f4fa00044dd2ebb5b8a16a57b03df09a43d9fa255aa48a40
-
Filesize
581KB
MD5e2f0ce4a8479fb73260598973fa833c1
SHA151c22e9a0eec64ac48e3b1ecf6c1b58ef6faf620
SHA2562a16bc75de67df045786766a3d0303406129937a5f8662bc0c56efa065ba2d3b
SHA51245440cb10b9e7019c0abf231958329ebb2262e7d2a1db6601cf4a9e17c9a9b9f106e9d0111ceb98a20442df0757822d8890c9b047c949412ef4fe87ee5b0b63d
-
Filesize
701KB
MD56255a9eb3cce650651363408392697a8
SHA1f81c5997a96ca419b61511c529630bbd121fb127
SHA256bb7ddd88c46079c8fbae6b4d4a191aee4a94fdb4e720ff28d66df2ccbb059eb7
SHA512edd279ef0fa9185b96753bd69b1a5d3d080520a4aa1da5243d7e4d76432e5bd4a5b4730d5b1f85fde3e8c9c27a49fd48b249d3968c91747ca5ca17ed0fde6a82
-
Filesize
659KB
MD5d13f0afcc38f003b8561bc2b255d5035
SHA1a8bd0e775f1b6394f62e045526c38e2ca640d045
SHA256bc727fc51efa4df2e6d6d7a71b0310aafbb1d7ef364461cee68759a114f37602
SHA512f2e43c63023ca0866af7d3970e15fcad6cfac8df710b6dd3f2eb5a8f98c6ce8ca5577613d3bbf58460d11d4dc338415bd8bab321ac7a2ae98198ec34709c74e3
-
Filesize
1.2MB
MD5de35df0eca17c8862d8bb92e93563375
SHA1bf7dba03873032cdfe18ac8fea8bcacf4ecfd939
SHA256725945136f4312fcfececca2b3550d8f3a2a469f00cdbe4da0dd1ec0828be7e8
SHA5125653b5fb2c5d94073f647ac7419175e4ec3e548b0d480262dbb099350de692d3358480069b665ae4367a555b64ddd88cb4112e6db66ea6d866b8ef8b7ff22d65
-
Filesize
661KB
MD5ee58f0731a34ddf67a968502ecd2a00f
SHA169c22e672c9e017e590be168547b75046ba1882a
SHA25683444e82c5ef9afa60c84df50daac70ea7f42c5ca0febbb1cf204496a30fc862
SHA5127d36bb2c46126a8ab4d099823c2ac2b4a52e81f49c4a075a273c91e3ad23c82efa3b327bcadf885f6ef05d4267694c6d4cae9e2feb428efa432a39a82f442db2
-
Filesize
1.3MB
MD54a12123cd5944a37a15a3721788b0188
SHA1a709fbdca2e883cbd85b8180bd506c242539708b
SHA256cf755a71ade6dd5c34f89015ac96c23dc098703e64201c51dd983b13efb1a946
SHA51204a3baf48cf3f67faf4afd7c6ca228a9bc2de84483caee2403162f3f4ab0da5ac8f3ac3fe18f7eebb93b13834ccf7378003ced5dea6f3febf6311d188e4b8454