Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
02-06-2024 07:04
Static task
static1
General
-
Target
2024-06-02_17615d4638a7ff5176a82ac67aed5f82_ryuk.exe
-
Size
1.9MB
-
MD5
17615d4638a7ff5176a82ac67aed5f82
-
SHA1
2aac503c34b6863b1844a94af2fbfe6f6e71b93d
-
SHA256
79ddec8991cad03bb6e8c405b117ae897fc7d77150efdac2bea63a764388290e
-
SHA512
f2b09f7fa31d1e6aca110216ff640ace09c3416526c202a54d8d3070baac7c41493cfbd4297471cf77977d16a8c59749d0112b1ed8bc87a068b2fd9f2bedb877
-
SSDEEP
24576:H78r8FfC3F32nUnCdAaKu++nOd6LaRFdGJm0Q3WKVSwdr13Ek0VA:H/fQF37CGaPG6KFdi2Ga9x3Ek0V
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 1112 alg.exe 2624 DiagnosticsHub.StandardCollector.Service.exe 1036 fxssvc.exe 4016 elevation_service.exe 2968 elevation_service.exe 5112 maintenanceservice.exe 3772 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\System32\alg.exe 2024-06-02_17615d4638a7ff5176a82ac67aed5f82_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-06-02_17615d4638a7ff5176a82ac67aed5f82_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-06-02_17615d4638a7ff5176a82ac67aed5f82_ryuk.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\95bd469dc3136770.bin alg.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-06-02_17615d4638a7ff5176a82ac67aed5f82_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-06-02_17615d4638a7ff5176a82ac67aed5f82_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104468\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104468\java.exe alg.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2024-06-02_17615d4638a7ff5176a82ac67aed5f82_ryuk.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2624 DiagnosticsHub.StandardCollector.Service.exe 2624 DiagnosticsHub.StandardCollector.Service.exe 2624 DiagnosticsHub.StandardCollector.Service.exe 2624 DiagnosticsHub.StandardCollector.Service.exe 2624 DiagnosticsHub.StandardCollector.Service.exe 2624 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 664 Process not Found 664 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 976 2024-06-02_17615d4638a7ff5176a82ac67aed5f82_ryuk.exe Token: SeAuditPrivilege 1036 fxssvc.exe Token: SeDebugPrivilege 1112 alg.exe Token: SeDebugPrivilege 1112 alg.exe Token: SeDebugPrivilege 1112 alg.exe Token: SeDebugPrivilege 2624 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-02_17615d4638a7ff5176a82ac67aed5f82_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-02_17615d4638a7ff5176a82ac67aed5f82_ryuk.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:976
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1112
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2624
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:1516
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1036
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4016
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2968
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:5112
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:3772
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5a819ff80b1efea6e1b880ff7726bbd98
SHA162015d6662a38678241f400e85b0cdb4fbf862c2
SHA256de0c988d5aceb6ca0a18666ec1a8f43f3c357d951eb060f0b6080f653470d509
SHA5125ebb592f5f67ffd4016113ee22e2f8445edfb5100b0432c968e86be50317e421fb2ef650989fa7a249464f50206b38816b1f8912170adc4774f99dd91df6ce13
-
Filesize
797KB
MD53bba8beb451f01ab4a758d35441f0d4e
SHA16a77f2e15d1fcd1c041e12230fab5a217caee23c
SHA256bb441817e45ad63673ffe245186c8fd3f4df4b2932db53b7b475b4f2175f04dc
SHA512e30099d1d00695a6f256d4062185241a9943e92b2e5c1bca3f4345837653686cd408298b4e38eec9d626aebb558ad5ba22bd7e34e3b2079d84911c90addeef7c
-
Filesize
1.1MB
MD5f0d94c3787d7d1281b3a25ec3416883e
SHA164413fc31f96735e50f9aa71c5e72a2163add4ca
SHA25633c38bbaf3f9c7aa37e20777867fcd16ae285b66339e8d4243a8afa79321f3e5
SHA512a4c0f493be2592ad8e7e5c3883bdf6723ade3e9a929be00813468c05ad417d9eca10889b5751c9c5cbaa52ede82bdb7fcba6841809918aece1e7b9e74e3f470b
-
Filesize
1.5MB
MD559394e28c1e836065e170cc6d1fb9d3e
SHA1b7f7af94f5a55a80cd18ef2c9912322a24ca8c58
SHA2560411238e7dbd7edf97ff368707eba248725b9304ad244aa18cf39fef26e96be5
SHA5129398c27964b3d5f20205295a34b5c6474181f5e958e05e26712c9041d7f0d03a29d7b19408316f63ef40507fabccd54b4d1246008cd1566f64a6f522ede9122f
-
Filesize
1.2MB
MD5b696e3cbc775bd849ce835ca5732245a
SHA1ec2d2998ffbb3c92c7c3abc325502dc644f79d46
SHA256a3592ed33e16c24bcfc33c2f7b16e5ab11f2d2b62728343f060cc07f1b8ec3d3
SHA512df167c032661a8493ea7ecef443c6bd268e9e8269278595c273bd5f67a11b83645be5ea9855722b55250efe2a9cda8e7b4a81386e8d71e421601bd63bfcebd1f
-
Filesize
582KB
MD54466899867315fb3d7eae5126abd1fe7
SHA1ae7e3f15c089d918e3d4f4f64dd09d448fddfeaa
SHA256fbddb40fae21f50b5706bdf070d959c3f532cddf6dc282234cad63049662e168
SHA5124f09f78a35c135157a81e7299f81a9be703dfd168399d24f91348cdeda67728b66187894ae51abe8987212e217a8c5190cc4dc94200ac68834ce5a3d1deebf06
-
Filesize
840KB
MD5b5137de49f4dda3739de234e4ed1f927
SHA1bb093a2b42d95319fef0ee72ba7d0c84dca200e1
SHA256315a74f274e131d9b78e40e9886e463a23e703ca1ea68afbe033fbd716b5502a
SHA5123fd730e272003846daec6822352122011f005430483704dccd8c9ab95fbdf057456e12034eb7656a967dcd5e35936fa8452bd06266c036855a80163e772b12bd
-
Filesize
4.6MB
MD5395208b0cab877bd19a5e9fadce86b2f
SHA11c07528cac9e26856c12a3daff6132089ed03c57
SHA256c05f4ea5fe7c262b6c4df7b289d83d93004e2b4659f4f2058a1db32b540af46b
SHA5124905bcf8ec3db63a3eaa1edd6470c4751bef19f65ce29c4d8ba38e5f201ffd7c1827c2a93d6eb17f52c0a85328b4ce6302b8a05c6e2306a65c52380c5fb205a0
-
Filesize
910KB
MD55701ed3dad374dbe1d868858891bbce4
SHA11a6d139d6510a5140bbcfab5cdd21ce72537f47d
SHA256e7f5b4926d3d909f7b39359556ffb96f9fe007c0a1c873878a70aab26964588c
SHA51243ec315175acd9d13c8a5630bfc60a40cea48209270bce52c4a7dbdbdf17d8add707f60e26edd554d3d84322a226ceed80317b008a1f07bf6ff3cfe40cfdc1a0
-
Filesize
24.0MB
MD57006c5f396a58105b1200c55b4320093
SHA15d3f6048de8ecb33e5d639e4a781f4ba8b7f6b78
SHA256c23906621eee176818e7e2ab0b76c1353b7fe7971167c58f422f4da8c693bd41
SHA512c1dd8d66eb9dc690d741ce76b03abefd44a5a03c480595b08216134a7539865e9e7b307775731b76074afaffc0e72b33f17e3af6e11d561be55e163fac77892c
-
Filesize
2.7MB
MD5859261159c7ad8c8b398034290e27fdf
SHA1e27ce99d708794ede91c016b586f0ad0203eae23
SHA25691f58554d38b74d660843e411444cbaaece59fe57e56356a8735839ccf4c959f
SHA512dc41d2656ec844cc270c0e88093c2d203a26a266a0482960c0027ee56d3fc3041144b97fb5e6c8dd3913acbc44e068d2f5b53561442c192f1ec94fdf050a4d4e
-
Filesize
1.1MB
MD50e98256684683fd421791eebcb6e9d00
SHA11bb4e4905483004c961a1b8b8b41a708fdccd4a6
SHA25615f18530db9e4d6bd656ca277e551703568109539763fd5f645a79863e755a2e
SHA512c2f82d0e893eb191b2511333f12f75b9ad033d63390cacabf355f7e0a0eab9ac325aebfda0b4bb61d9b13f6c8ab1690b5902ce21d8031a06fc18bf575d41d662
-
Filesize
805KB
MD5194104dbb07b5c3acdb96a626bd3a414
SHA1759c4aeb7cd75ed5ac44a5f30b8bcc7f97ea278b
SHA256fb31fe8b7d9fae6453fbc9cde42b7d2df507f89f52c7bc81780569fad6c255f5
SHA512c3d5bde5d7db5c3f8e8def09b98f00adb49bbeaf3a72e77d6ed5a540960b0b389c846ac39a1d797b8ecdfe5398d5cac4dbe09ff8cc304795bb043d86ece3ca2c
-
Filesize
656KB
MD5713c7f0957dad3bc86b84002ea9d6a40
SHA1074c249a2872f991a8a0e5120032fbbcefe647b3
SHA256be9ddd8f119afbbb8e082776c2d557c540737cabf95875c4ea5df9751316bb2d
SHA512b6a6d5cf2c3ab380ec18f748a872bd0c9d6df8104d3adb427fb4b4112b6e0b77bb10b287e3d422eb45bd10e9f99c04d0ecf1f1906bb2ad3cc3f982c95981289f
-
Filesize
5.4MB
MD5f4d8aeec1ece64587b93118c5fbee449
SHA1623788b2591d90a98eb929d398e373cf8a66a2a1
SHA256f75ad4ff873af1fedde57c1d60dad90e28eeb9bf12ba80ddd83a22dbed788908
SHA512e590aa47bd879ee4f9b78ec546967cde3abc823b5506497bab15cdc89a11431b63ab4e26499be8d2f55e04a947a3c2f775f54f301394752bbb2ffb8ff7c1bc32
-
Filesize
5.4MB
MD5c014909ab925199a4034ddc2b4adaeb3
SHA14cb4aa5c50ef7a4f5d41236fa77426ff85c399a9
SHA256b332e4b62fbfd05e4ab1820b2b2566353f0c1ead171c28128efbf9ed871ebcd1
SHA51239c4192cd56d685da607e5f99e8ca5da492e69013025dc49b6906706f2de8bfc8a86f8a98deecfd1c5cd133d37facd1d6efddba443ddab8e5dfa601ffe22f68b
-
Filesize
2.0MB
MD51d173cf463d5c9b3cc9ef1e81db49031
SHA14102e6917dfd82a9f90cbae73eded8a8e4941cfb
SHA2564ac6cdf2f8df94d7369e1619cc929e544e8f36dae3b14e0a2c8d66002ce8cbd0
SHA5123cb6d0b688ff770b677c0f36fefa97981f047fd4fdca409faceaca00b90182f8e8d496fa4b2199af15aba57fa687630485dfc333d2c224095a5eceb754006503
-
Filesize
2.2MB
MD54d78af9bf66217c409f10a19b2782e6a
SHA1433983f95628b43126266237aff872d87ab686ae
SHA256117a008344fbebab78b21ce14340d783749676852b379ce02b913a0eee5aade6
SHA512f697497bacab851995ea4ad1de5b6c20a8a9f538972a264f7a46af703eec79ee93def4a93bba96bdee67845f41614185856ebd504b9d33de83580a8e5d522277
-
Filesize
1.8MB
MD5cfcf5d2e72b1b567fa5234a111255c8c
SHA192e6d1b5f7aee2fe0d064ea2ac98d3f05d407c8c
SHA2565b57ea94b6cd3c4e40763900ec5583f59051ca2c62b4b8779122d77524d1a118
SHA512bdfd528c13c0df7248cd1586f57812da7d2b796c16442500ee76aa7c774a0d212dfab6d22c24a29a3d1ee74f0ff9ef8239e456f1bb0f2e9c717c68ea37ba0ee5
-
Filesize
1.7MB
MD5832dfb23b797ee61f8210e4f0626b9d5
SHA1929f56113afb3320993d7491c0bd2651d00071a1
SHA2568ae06da7f67b93a5a8a8152a7a5cd5df56742ff30ee6a8ff0229959f8fa0b9ec
SHA5126453c0ad3dd6613ffe6fc8301c3716934171424f2088744ef1097814cf7b747683ee5305c6f807a2ca828401d7e2c8e27db758a21a6b2cb49e6fcb40271dff09
-
Filesize
581KB
MD5f9d6a2f50d8dd7377686247fcb6c7c47
SHA192851b2c67a2d4410f725b6c074570077883804e
SHA256e145873f348b634378f2804acf22e78b6dd7081d17a50055b57b973989bc754d
SHA51219138b6507a249e30f26a9f81ff433237c45c42325f41d628d208b6f780d9b4ac0f85fbac4c3fd931791515d83ecf0d6e097bb731201e438219d8f14517d764f
-
Filesize
581KB
MD5a9604f0860728a4216a0f9de4904ff72
SHA1c4b5a714c4c6ab6e746a8be5558c3d48ae4e0282
SHA256803f70c73ad4f1508d7c0beb6c5a05cd6d9ad158d3b9358f055d8e4e01bfd4d2
SHA512542b7d705fcb9c4c1a89f6c3e88d5e103c1e2d5bbee6461252c8a575fb76da3721753119040b0da66cd2d7b365a94b902272ad17649c38c15d8e2d663e90e7ec
-
Filesize
581KB
MD558ddc30d17a78619fbd75dd42e469ce6
SHA12c5ee6afe2195035197c3c212a8832548698701c
SHA256c375b3c46abaa2e425a914f1307e7d81777768bf4ceee335db6a97c2bfd84b52
SHA512d7ae1ce09cee4aa7b930255d2bf966cbbb8ac106b6648df2d00d9414d736c1a2dba30b114a2be0cea7e2a78aa4eaa5e8ff83cfcc3a0d7a62ee2ef4bd112a7232
-
Filesize
601KB
MD53b734491fde39c696a1edc47253bac1d
SHA1d81964c16b534e3de77624710dbc261401b04d06
SHA25641ffcab6a0b2226cddea446e8a6b113dd486f50fda7960880b6a3e6e374ac900
SHA51276d4150f37a17666b5afc322d20c2f8104089d49c29d2c1b4f81ebeaa663633817f34e6de2a6f96d54e212fd918a6e02f3c61574351a6b1f8d59a9b22dbcad77
-
Filesize
581KB
MD5913b4016ce1f3f8ec633fed692a9e882
SHA1adbc14f1d327b72b0b48b07adf9aeaaa577dbcdd
SHA256ccf5613c8b586f5791c0b8fcbcbd5ab5eda9ce2bf39057c5e54cd72ea9c6cecb
SHA512d27559b8e540171b2b2d78e98ecad0126f7d1656af17b1a131658280dec1eedbac3f3795d01ab0eed7b63c52f351001d7a05efce14005c13fc4c22bc23dabe17
-
Filesize
581KB
MD5c0cee569e63291d93f414e396bc7fb96
SHA1348782d215489a3413bf5d9998bc23feadaeb19b
SHA2566306b2464575eba78a9a576a1950daae7a2c72cf8c2ad07c94c9257f5af2ee9e
SHA5124f016e1489b01f567d07b661fe4bf62a20fd1a4c46ab985b2e87b5046b454549f89190f3af3f882be115a95405d3ed6fe70aec0eeecfd15bc6eb236dec78e9c2
-
Filesize
581KB
MD533fa33677068beeac21fc314366b92f6
SHA164740a28254b3e030768ef7402a49b59d3254daa
SHA256fed9cc5b651bacf4e6201c0f521e71ad94593fd9c8a92a8d8028f2e672d15c69
SHA512146cd1002f394740a1dde681dfad528f660d7b94324c9cfce01c21bd769cc23c2d2b88ec464445d5bd8299b5176a9a546f6e670375d81698c4f040337fd6f032
-
Filesize
841KB
MD5256feed11c46c8d8d8ba45bed593557f
SHA1a16cbf8bd7a3716f269d3e378fb4f27be0d86913
SHA25658ed5e734b939e7a38fdbda3c131f5903169158892220fba2904f32ace08cbb9
SHA5127cbe8243c9927e781e5df7ca98c63bcae6dc578a1f98650e268ab9eb15f51783f6bc82f35ab663f84b83517adcac725afde205d343664bb46fb33116110cade0
-
Filesize
581KB
MD50527a4fc0cdb1a99f987d023d6a70879
SHA1b0bb2fdb55fd673f166252105209ab2ef4f3997e
SHA25608903a0c9d56c2d50004aa064dc7835e1fa95e143c7f40fb72c6eb61ae1b3570
SHA512cf5322e7b034b4b956a8aa734a26213d12f0b8e14e7247998fd0ec47c5fee211bd0429a7c84b50618e89ef663a0808d6fd7c3aa0cec69af742c4511cee9cbfc5
-
Filesize
581KB
MD5be05ff1591d555e75db3ebd31cc83364
SHA19a05f2b746e1c85bd6c88b3b8749767e1fb02d53
SHA2561ea35a1e58ac8bcd5ad89311f6a660e669de2cea0a9be0c6ce0610f0541a2ef5
SHA5126f4569e35101ae2629030fdb745a4fc031197f408fbc007b7692636a3d005a858e4db21fafc38bfab9085a6f9dde5efe50da0ddc93774c28bddf51d1fefeacec
-
Filesize
717KB
MD5b654d422922653967f0e2a2572e02d35
SHA1544bb6c1cc9239438be78f50363e908ab297c11f
SHA256ee825afa0389f775f41da01a346541ee92c60711fca5efaa5c04e9389c446dcb
SHA512f18a34fb1a78a700f0a2fb9e73a363d2fd7aa590b0fe7a98b8f2090bfda6f4560d36822caf49b49634f79bc23655c36075e3b58e575f23520815304c2b7a59ff
-
Filesize
581KB
MD56a2a816a941ab643031eaaca21b1db01
SHA1e3862cf6a82efe64c024228a9a0e1c1407a1356b
SHA25696e4f19c2e96c182486b7c68ab3f117d0c959cd770260d1e22d8adb2cac60a42
SHA51270501477da8523d1d748fc8abb39a9da74b1ecdfabf98b60b96c7c3bb2e375c0e776b93e4a492cd3d30476fa2a570bd99e6dfecc9f2fa060696c986556b7cbf6
-
Filesize
581KB
MD533fec42350f46b22e5af03ccc4c33e47
SHA119e8e830c0cd5dc902faa05d9fcfcd5696770e94
SHA256af45a4176fdf3216241789aac0f723da80b27fe04061b7387fcd758c48d41990
SHA512cfa445bb32ea0546da5ad2225d9ee961e1fa691f576683a8c245cb216a11db3380da496403312438a16daa6d92bbe5b9541f7b4db6a590a55183dd12184bc305
-
Filesize
717KB
MD5a446fcccbd66809097184c67e1425c18
SHA16ca6a6a1135cb8e0b82689f45243dcdde105de44
SHA256a5c8ba1e96899e02150060faee8e24af25fc810f723e39cffa2a317b2fe50d73
SHA5127e38c8b4f580e89f8eccc8203aa2748b76cf83fb6d7144f4ec968d156f30e239a862753bfa7636ea238e97e697cb24477943a082c7eea53721da61ef10f12b38
-
Filesize
841KB
MD5c50d7cd8cc032f523a5d5ff53544b378
SHA1c71ba232e3260e13a45725e56b7daffebc47d35a
SHA25669046bdf28912de0b8cc725753df0bc854a0f1a89fc64f62f6192ea3c0a8ac42
SHA5126e29f45d82c645dd1f71afa0ea00bde11de6187b999b7c9ed48e1cd99ce0b260ff4c41a237531e42d347ab88f31415335617a5dbf8943ff076fce8bffec71882
-
Filesize
1020KB
MD5ff050ebb92b2969e155cc9d1092453ea
SHA1e515760d8ae20c104c41b2e43b5d170d0d7cebf7
SHA25681acad3c04ecc230aaa6d70e7266293ea677911aaddef8130f7b721c18e5a381
SHA512b6758d011e387e06cef11fb09ea499554ce01026ceda1c352036d84dfbf5cd846f28e32207cc9cc679e26aa4ace99277512cfe6aaa4abd2aedf5236efae22df8
-
Filesize
581KB
MD58e86276856f767fd3789c3f3740988b2
SHA1ad63be166fd1699166dbb04bf78ee54e153222d8
SHA256ce9146e14f48a7eb614144fbc981b8c77b0f088e2e4667fd59b59bc118f811a9
SHA51217eab39aa3aed17fb6bd6146b54d884a2f9b11d466d54406cd689b833b0cdda6b1c13b63a66711cdbfa17855abcf86607d5b05cf208ba577e29ce4a3fdab10c3
-
Filesize
581KB
MD52fa81de5f78f3c6a6932e478dffcf03b
SHA1ba0fc37874c78aad98274343a1e7bdd4d0cad231
SHA2567d172bf39a39279b72efcd66f8160c537361c280567f90f6a836626a86385dc3
SHA512e0e2daea3085b211142e1a289c5eebc1e9fd44aefb8e1c5a022822c22a069123fab43c0e1f4234a1a7faac60447d52b59b2a455f7eec26ef5e72a3a305a51dbc
-
Filesize
581KB
MD53328426f0f691ca927f8bbcec8ae347a
SHA169a2f20ef764b0a30a8c47362c2714c4b2f06b83
SHA2569ad4ddbfd286527537185f93000304a145e8aa54c38a5d4cbef12141c5c03cf1
SHA51287b7bf33b7c3013f6d40b29e722469dec3f90b34f1d197e80604c8a8c913744d8973f35d394ff990fb912c1634babf752894d98dd292e8118cbac9000d2e9e9c
-
Filesize
581KB
MD5a1e50f2e719d8d893bef76edad15a697
SHA1f4b64494d44bbdde11a1126ca5877aa30c6550ce
SHA25665ae9ed0067f6564f3250b5738175ed41c60adbc7979b5cd44309a738dec6943
SHA51283a600cccfa243a37e31ed574681c49d0a45885616d14d8971674bd3402bccd18d4d32c225853769a1ba48d0a8f49a861cb0502515d0b66d43f0d4c51683a013
-
Filesize
581KB
MD58ebcb7870b12b52943a693e2f13ebe51
SHA148910a4b5dba96038573ed69fc8583456fdee9a9
SHA256ae6d98883044f683b31dba15b1df573fb5493aef273d998de4a5a14690abe735
SHA512ea82e57134aa83666ac3194fbd5ddfecf9d6089346fea45943a57f8617204b519b30841822374b5b2a2b9cba105e6474a41a34d8ed4d4f8b63e6efabe767bd2f
-
Filesize
581KB
MD5643a971c25760812bbf1d8acc34f29a4
SHA163c7a2391ac99f1539c7904954322c66b93edbcb
SHA25619cfadbb40fce510c9f1a1f9ccaa73ba4a69a824a4a2f0804a40e9511b8a4771
SHA5127ece79850828858b4457db845e73e47018eb6deeb245464935239c1d89d7f9f500c34041509daa230c9d7eb3990bd2d1bafa620ef1d0d68ccd3f9b62cbc41fb4
-
Filesize
581KB
MD50ae72a2341277a3d3615422dc7995d3c
SHA1498864653ed64206595272f16ac6279c9d9e0be4
SHA2562d0c450bcb93738be44b4e52e1825ad759e48bab24c6d5030882b966a14e4f87
SHA5123fd9448b52e6caf21ae073c0d8e87f01e49a0c67be9c338ba2344c2f6bf0f4a34ea560a62518552a1d8e724d3bc0155366837fa3b216d88d99bff4c49ccaf77d
-
Filesize
581KB
MD5a9848a62d308d07fd53d41e77b3c9d0d
SHA1392412494cdd73a77185fa6d1bfa90416e30b884
SHA2566ec28fd2ec302ae5b60a0bda2456b4329ffa7521d1d067de669543d03825a193
SHA512214659eb9a3ad5867105882b940e516d0d4f44372646cf524c7a80458d3b9f030becb27b97661d76b16035ffe2d08cd4a86fbe2efbea87d7a99d58b2db2461a4
-
Filesize
581KB
MD5a444586c4c42e771b9207870ec2a155a
SHA182042c42235be3faa705807fb8e271f81f8ea4f2
SHA2565f2c94de590bff1b495f47319e7e64e6232a742bb018079dddba495eac4f5f95
SHA51253fa78bdc292c0508e662bedf7b8343ff8344a67fa60c3edbb964161ed8c7cc4fa92475455b7028215cfab5a0cabc3d7e792ddbd85723e3ba0a4a1f52528a2b0
-
Filesize
581KB
MD5ef71dc945d2401af723c45b714388b99
SHA160f76b1bb7bb7e5ec55821cc02818ba0006c7787
SHA256bb72dd23dc278b28f6020e6f5c0d0a4e12a8a4b818a9d386529506aba86b7c76
SHA512e365c8b84785c3b3bc7637c1630b1e509f57c98661194d5745fa4a948b8dfe0a4931d77a59927a6e9498d7b6b3a8e628cb78591bf082185b59ead5d8838c3809
-
Filesize
581KB
MD5fd5d7b12ad581c806d828be6933de1c1
SHA1817638833d961beaa375c827485b63d1111236c6
SHA256910537e8faa9b5725533f631d83af14c52bce6272a4740c69a8a7d69b158c970
SHA5126a86c5a5cd8e06259dc7728b44a1afad96c125b401f8f675b334c34e67546127e06df6785dfae74393a5c53bf66484c8acd4e3e5bb55ad8e48dc21c404c13c9a
-
Filesize
581KB
MD5f183a29d5a63528e2d85f2eff148252e
SHA1752411b426c25a42e33d005fe9085426bf9c4168
SHA256cddb8fd97999d8ba7ed7f8684077fd5a6db32efab306283e3b518e9d6847f1dd
SHA512f81806826a5f4d6d86613fd29095cd155fcff10361e3a0e93caafa0ccaa43fca3fd376872356d22812d1b7593fe50a4b4a561b626779302b559c4f5b6bef60fb
-
Filesize
581KB
MD50d4ea77525e11931bbcd8ba05f75ecad
SHA1b6d48c57b0f1f08152c5f2d1b09e8092974b0d5c
SHA256bd53a6e5dfe7148b5fe34c46782a95dbc59af6e36ff69ea53fe4871829218efc
SHA512ff2f193ac078916de14ebc50784e0f6283d087421993b05abd2a2e4bfc84a2188e3b400a0d8291f2d5f224d578572c28c3b2646741651c4f5da129130a028e77
-
Filesize
581KB
MD5da4779059e4663a8293f5831b4dc6d98
SHA1b98f2149fc6e1f8dd0a49ba0e67e8d1468a1fb94
SHA2566dc88f773f93a927592f5f3345f3f91815e860fa8427ef3ac3ca64ec61fa2b93
SHA51201c518081edc4f28e10ec070948d7b59a8a4e323d0445cd87f3d8c5a6ce5bc928a8f73fc8a6f57b93c94a88158049ef44b811700d23f7b227f2620815dac6213
-
Filesize
581KB
MD568aa66f2340655b6b1e6b3e71aab792e
SHA1467e50900e1a8f5bcd8836ef19e6adbbe1cb7477
SHA25681872d238ddb660f61766029b003fb23d0243ee115a340b029af6f0682a71127
SHA512282cc572c87f66801f3d7f3f5cd2afdca9ec7140e68835e56414933042a4bf52fabe0de2e9800842c1c55928ab85aa751c72785718a4528e120100ef1a062957
-
Filesize
581KB
MD539099babff9cb07ad68097ccc7d1c19c
SHA1335a5b16da5202709d30844cf74f8bd09f121c23
SHA2569ad68e1176c27025acd72ef921333ed39c6096ffb83b83f98d9c6091bb0f2f32
SHA5124c7b8263c914bfa5736c0534fb29f2165dce7fad6586a2de274d05d682e56c803b3810d930b15eee4ed83209b31c91655c81a51f87a24b54504d6a849ecfbb89
-
Filesize
581KB
MD514e4d01ab7328da98f37849cfe79c119
SHA124ceec2d5feef32a401ff751b6bb2dede617418e
SHA256d71cb3f43118e88ff611f177b8d6b25e09df640e892812f6258045912721479c
SHA5123b26103dc413a8042c9bf9637955f800f5e606679f83bda086e352b46a63a097d123df1412d8354fb7e7d3fb1811e9ae11dc7df6f5afe9e05925082f557f2ef6
-
Filesize
581KB
MD5ab2068f97d187dbfa1fc708014baa4d3
SHA1ffbca03da6cb69dcf055f133cd757f435fc2afa6
SHA2567857f8916e9112afee3486acf18c6f093f5849ebfb22897ae26a43d9f3ec9a27
SHA512f0867f8dc513ab22332aa3e67b6f48887a7299a7fffc967061386cb1da3dc138265251d1ad54a4735952002fd65a316f540ca04d20aedb7574f3fa5c7b91ec20
-
Filesize
581KB
MD573b8f90a642dcd7e1a288ee3e13687cf
SHA143467204b0a3f25b554a5c2f73abc982a3261486
SHA2560e2f5453458f7ced0b65c1d0041ebe50ffee47f94ce51f16e25668e8ea577813
SHA512e0147b46540239c327857427dc502e8c709fec115e0d8baa0e71cdb66c029e24d5f158e8563563549e378cfe25f059b9aec55fcd91e321a3e8239a55e1d11084
-
Filesize
581KB
MD53a5b2d24443673aba13bbf7ab74c8eb7
SHA1ede37ee837a1ed22009e0e5b7623c1139850ec2a
SHA25649472b80c55451c0b2cdd4fcb1c2671fa27daca067f55d4713c30fed12aacb1d
SHA512340f54db8187fe6703b75cd1544abd3d74245d04596022df80e3dd41949de0e9cb2bb42edc484a51f086bc128e9c080e711e61eec7d54ddc7b254c9beeec4739
-
Filesize
581KB
MD5559db4440b89c4653258799c2d58b5eb
SHA19d2768387d57b57ef653d2dedeb2e3b164ee31cc
SHA2565659b1a80bcf5052f2ae991b383cc8a4fa45a59471761e5e0971f5119e8466b3
SHA5127c9e9f11ebc72097fb0e1781f87c33b2e1d428c3f2214ffdadf91e503c9e097375f454d583be71299cf90f74bee7dc44de6cf0cb714404d3919f39cbf4013eb5
-
Filesize
701KB
MD52505e5d368016b878f5bd77cdbaeb321
SHA1029a88a228e42139353f864054cc0d3af7dd6003
SHA2568ba06a8407e6e7d6edc5682c5aede1b4921a67b948cdeca120935e22f895ca8e
SHA5127a8387b41ccdb6c2740b22437d1c1e863d29b8e6352c3644b4f3776f1ff91354687f2d0f070cdce4f12628a798871d72f5dcd6eecdba442efe3cdf195a378951
-
Filesize
659KB
MD5f57b83b5217951fb8e83b32a74181cd3
SHA182534ab090c0621f5962744b146c9714175d49c8
SHA256669a3d361b8bc85f58f5b436be68aa10ec79c1c79458d17d768a1630d4803ffd
SHA5127289e8427cacea6ba4823088660f37899a4475af1866dbe5625b4a180ea7a3bd5e0c76e17925b17171c4405141bb7757377c748b7882d8ff6ae9fba4d05df12a
-
Filesize
1.2MB
MD5975c75c9f9243b43237a555405105435
SHA141a529eb4675c6a511c73475295141a3fd8f50df
SHA256877bb025efabea56f45152f38141b853fb56d817cce87705553ca56123909fe5
SHA512f314bf1c5cc2cea94bc7a085c86e23ed9a9e29c16fdaab4cdf38911bbc6539c3af56b2e80733a3dff9c3eef6433b1bf50e7bb60bec957d043178b60de0a06cf0
-
Filesize
661KB
MD59e3f1039df24dfc25a193bb6b570f127
SHA1f1c71dc3492eb8c2122ba517139068d5ccc48ee5
SHA2568287c017b2c3ee254f5fec8556042b1ed58b3a3c0312a19e0234ebd6241ea2b8
SHA512ea1e6c252f3b003003d225e3c2436f2e28512d802dce6c842ecdda185c8d7fd65559114093cad050adaa0a5d88a1808f5c37a82d5a48115eff3a5b3cf5cab2c3
-
Filesize
1.3MB
MD57aef567b5bff66935f38854d1beb6bfc
SHA1b49684c16c4b332865679746088c6b67a45aedfe
SHA25672e3f4d37ed6033407e733f13e56e10dfd372c175cd1c56db7d7bbd550aacbea
SHA512f117c5ddf3db3ebf1e9783d4e534ecd51d106984a19c6155588f7444a25b159fff1c080399421cc75676cbd31beada57b48d546116c5712d24197a1c10b8e745