Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
05/06/2024, 00:53
Static task
static1
General
-
Target
2024-06-05_ed17056c0c6f581b64a3f3bd3f8f39b1_ryuk.exe
-
Size
1.9MB
-
MD5
ed17056c0c6f581b64a3f3bd3f8f39b1
-
SHA1
095215d829c5727a60535bf3b4025f2c596761ff
-
SHA256
7be1b78ec018caeb843a8a221d7721ac494cf851502fa2210750f913f981a496
-
SHA512
754a5dd749f029a6ac2734163fc79e88604bb848dd6fecaf69de35ac260c7e15ca79fdb6d2c25a68e735bfc8f521448c3de9ec6f451be72e765594ea08a2f482
-
SSDEEP
24576:R78r8FfC3F32nUnCdAaKu++nO8RVldlnXfH9gPwCn7vOb7HHcp/CGXQp:R/fQF37CGaPfRVlbnXf9gPTTW7H1GXC
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 1908 alg.exe 1936 DiagnosticsHub.StandardCollector.Service.exe 3344 fxssvc.exe 4824 elevation_service.exe 4612 elevation_service.exe 4712 maintenanceservice.exe 2192 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-06-05_ed17056c0c6f581b64a3f3bd3f8f39b1_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-06-05_ed17056c0c6f581b64a3f3bd3f8f39b1_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\4c2dcaf2d590e271.bin alg.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-06-05_ed17056c0c6f581b64a3f3bd3f8f39b1_ryuk.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-06-05_ed17056c0c6f581b64a3f3bd3f8f39b1_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-06-05_ed17056c0c6f581b64a3f3bd3f8f39b1_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE alg.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_95296\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe alg.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2024-06-05_ed17056c0c6f581b64a3f3bd3f8f39b1_ryuk.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1936 DiagnosticsHub.StandardCollector.Service.exe 1936 DiagnosticsHub.StandardCollector.Service.exe 1936 DiagnosticsHub.StandardCollector.Service.exe 1936 DiagnosticsHub.StandardCollector.Service.exe 1936 DiagnosticsHub.StandardCollector.Service.exe 1936 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 660 Process not Found 660 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2096 2024-06-05_ed17056c0c6f581b64a3f3bd3f8f39b1_ryuk.exe Token: SeAuditPrivilege 3344 fxssvc.exe Token: SeDebugPrivilege 1908 alg.exe Token: SeDebugPrivilege 1908 alg.exe Token: SeDebugPrivilege 1908 alg.exe Token: SeDebugPrivilege 1936 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-05_ed17056c0c6f581b64a3f3bd3f8f39b1_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-05_ed17056c0c6f581b64a3f3bd3f8f39b1_ryuk.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2096
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1908
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1936
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:2900
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3344
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4824
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4612
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4712
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2192
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5aab1aacfa689454126100186bd7fbddc
SHA1c908271daae826939d556166849dd160530c230e
SHA25607e1864f6ce4a066fdae702e0fc34e47ef6ce32b366aa6f804af0b5b55d01e80
SHA512e57736e1b9a7c0afcbf5160d621c5fc8ba8105e9126759746b492919464fe9b8ee7fa8d32fb9ea71b7ec50b82e658988af3e15d2c62eb14b76e6e4594c064053
-
Filesize
797KB
MD55eec167b08a7a8799585a9964df85075
SHA13614a8f125efa3b9e381f5dfc932efeb9fe3f7da
SHA2568de0763744522ae7eafdea1664e7bdad5e950546d2ed61478ad9280b501bf927
SHA51269307851d18bb959e9a36202ca43e663b09bdf0f2d87cc526c9908cfa0c781883dfd84ab3783bc7a30bf6c72d6faa8f4c84ce3703288f36b69adefa42eb79cf3
-
Filesize
1.1MB
MD57b89c3e80946fba851d61dea2f63be03
SHA14948012e3776c7a510af21fe07e06dcf348b215e
SHA2562ca0ad63483b992097564dc252ee4c83d90d69509bfd9cbae58d70c67006d39c
SHA5125b4aaf84950caa653d0d1be4e4183d276f445f625647271dc4e6d6e953e170b1541fd13c0db8b87f4b480da5282db9316b4decbd6b13f91b49f224601069a09b
-
Filesize
1.5MB
MD5c6664239628b8d9730a9b25ea438deb2
SHA1118f25086304bdb58c7e3b803118aec2b2b4383d
SHA2561f1e4502d5c52d23de040e8c632816af4062d7a102d70b6f6a39fba910846898
SHA5127d1c66cd48b2bbaccda6f18183a4abea378353f3afbbc51972a7d0752210f6842a41db6ec85e418e9fac0f742fe2fb096425f04a9d88e735348c1be0b3fdc0b2
-
Filesize
1.2MB
MD59b54dd738749510497039ab86fb6b6b3
SHA112ebba004469b33095f02044a969a42eb68c27d4
SHA256245da9d3a09a4b88fe55413315e873f27e395c3a4b326c2d0e7f8764cbc58f26
SHA51248c234637589050f3086cc76767faf5ff698e5a3dd3b565e134cd57e7bafe38d9ca31a292eb550a0bca93d37d5aaaf6d2d88614220697320d18249df08bab57e
-
Filesize
582KB
MD5649e8688f233fd75a05f0783d4a34802
SHA14c69617059ae393ad40573e3db6a671787afb60b
SHA256b366d4d2d2ae5a4b063de0b909a5c6f36aa4c538fd38d208fa8c6895711ff336
SHA5122d41c7b0ed391a0aa05a351e2b6759247d74e59e17947ffd0cdf78fed5c8f25cc34bc9e2da07ffd3e3ba8429594551febc964799c544e5a19084bdbec71b732e
-
Filesize
840KB
MD57b93df8dadf29bd0ba5cc52e773b7c60
SHA16dc14224ada53f3e29b58bc5842e9aaa00ada6b0
SHA256e320a095199d8de39ed1fdfdc67e23f30c9fd82aa0cd0bda2fe5ba4e7515157a
SHA5121ba332e8a3d5d2410c1f9ec5c590b3fdbb3ae7ae82038034f821cb03bba1bfe6c05ca09d2a070ef811a4b7b07a78e8d683c39e42e2af8e55891f91467b9ed73f
-
Filesize
4.6MB
MD51bfa77a47cbe9644aa01d201a842caa2
SHA11e690d8b1a4ea51881f0d9db9d62dc53bd1a0010
SHA25602fc194716723624828c30c10f1bc2e2f0324eb07eae7688ecaf0c193517f728
SHA51269f4657a0c3c441863d9020012c3aeb4727b1b9a8dd0bb1e58ce7f4794cdfe861ab17b283cd980009bb1431e834db356b2a4cf5ad02e1d7a3fd1fcd961a2c8c9
-
Filesize
910KB
MD53ad903b5415b2ed15db4e152f210898b
SHA12100ec06dd9a5224d007e3dac592ba4ec43f6744
SHA256c7486fc9e49e55e20224054eeab371f38402f77c3326e4188f8abccdf68bf411
SHA5125ac7ce76b967c19f285f1f868210ea45980859d610d809cf705f55280ede029a23a7824cdace2ce644fbe688292a7c79f6d55cb0f5385f21f501704465d4d222
-
Filesize
24.0MB
MD591a16140bddb27dba20119aa9524dd58
SHA1e8de775b0e83cfff4dbf62da36a1215dabf1d86e
SHA2569561aca691c54e300861a33d9a8a2fc6a49db60fcb28adcbc98d3edb41540513
SHA5128489e03317ed9d7cf2aa53b8fb7570443b7efc17cc90370666d0904ab4870557f8bcda0b6296afe02586e08e22d27301ff0f2c05421a93c5bae7249598fc26a1
-
Filesize
2.7MB
MD5cfc78218173831474065d79de7fd506b
SHA18e1c1d0a4ac0d4d9f6ee593eab8494ab475c905c
SHA256e9377bfaeb5f3eeb9f5f992f55abcdccb520efe387f432a03e95bcbdeb1199f2
SHA51290825d5355e28baf48504e2faf7850455836d20bf16bb98ab4f041e3fa5ba95ed7616ac78e252dc73861d3103bc4c0afef3b2a6694f18055650e4cd3c03cd590
-
Filesize
1.1MB
MD50bc7ef08ee48bc51b9325cbeb5942081
SHA12a488a0315eaadb66bfa4f5d4a8369db672a1ee0
SHA2564ef417737e5740d76510defcef2a4b08e74d0567ddb0a8ee4e5f700d75858050
SHA51297bf557e6fca17d6b93e295c65fdea5950182fc4236c89953e59df93601fb6bfa7032509eecf743228ea801b322b5c8edb6c0469c4735ba4b32ca39dd60f12bb
-
Filesize
805KB
MD555f00b9c85625aad1b5db498de7495f3
SHA13f3ea2cae898b9551c03b00d9a513e61e6600451
SHA256323ed32b9fa37ba17bf930cdd67fed6f94804a66912e941a94f8b614f3160e0f
SHA512ca424b1f5e7dc7c65e9de0093587955650a7e70919371557248f4d3a5da8056190fc8baac554dcf55d29ac068e0c58a334238b1c0084b6ea6c0c39792d563c4b
-
Filesize
656KB
MD50a8aff05e7f2ba6461b0abb746653cd7
SHA1e3a935f46b8e85c1fbce668f7f32eca9d146e5e7
SHA256a886cb9d415376170e6697766d9c58819382a276bd10036da1a2d65a6c66515c
SHA5123b14b206a3e2ea855fbf9729a59b7fb9333bcd33bfe0439009ca79028b89fff7dbde2cdb7177e51a46fd6a82e0d67da3a2b5fb68eb151e76e787b85c86fccef2
-
Filesize
5.4MB
MD56f35571ebfdf890540d4e200ecc2e82d
SHA1895eace0c1c714ef7d094cb5732f80ba50f5d176
SHA256d58778c052061c96037ff1375f641b6420fa8f6a7987d6a36d00f2c1837bfafa
SHA512df4fac0cb9125f8fb4492568b0b674948c79345b35fc249725624f60b4a31fc1f746cf0d16fd866dcc01f36d83a146709367f60692000375908a4450726ec363
-
Filesize
5.4MB
MD56658f9415f69a6228d44be30131e0772
SHA1fec080ae352dbc8d9fb6b6288982a39b9d81fa63
SHA256ccffcb5862aedeed7e305284bf3ec244a5644a60a0bff450a6219dd4a60e3b0c
SHA5124ab7300d5373e57915e19b68d8bb592d30e658100c282e8c939d8f9a8b2fdf7f7e1da381f2deaa9d358b0a92cf240522ee46d3407e3347c3b3d79d81277d01f5
-
Filesize
2.0MB
MD5c5ce21a2fd00281a968083daa9d0854d
SHA190424f6283959c8c1997e695b137c08d0b50ef24
SHA256970aa32f2be1c7ba1f09e4487fd4a93f04375fbee57e879d2ec1b9fdf9eca71f
SHA5120734f1e29acdc9e3187c508aaac440dadc5a24cbada49d4551b6fbfad5ae682137e551a6fa23a6dd8c7b9f9f792e1140b38a50873af5949fbfe6cbca6597c2fb
-
Filesize
2.2MB
MD57b3d5472f1a491ed6b7ffba5b871b753
SHA1a29fe34e4056b9d0f635be66b7032161ff2b531c
SHA256e68026886b2e876f36125976a85c6f83f43c523fe859fe3f5ac68eae2beee391
SHA51218de5f4c325f180908df39a64c7d3a204dc552bedb08e67ccc08284de4bd0951809e237ad3d574dec9af6849f68161e3012df1e7b8dd38074403b0c5d91cdd9e
-
Filesize
1.8MB
MD509e5eaa650b72fc6f3fdb1fce5b67d27
SHA10bc532e4c3706ea12e4c9fc76f5a5755f4900328
SHA25624bb9a392ba1b4bb671641ffbdc3bca82136920a2c13f771e898dfb2f559c85c
SHA512dcb97c51c1b7a3b3e18d5f0e45c14d5a9095076c8a26ac8099b260c57a01b44dd348d88f9760675eceff13597afa978d2377efa67243e83119baedbd7f128da2
-
Filesize
1.7MB
MD5fd7f04c03a64c12051ef8cc848ca9d41
SHA177b5a0c8d8c5f9aa75f1a03512f976ccadceb80b
SHA256ca100d60bc54fddfdbd884272797f1268440cd3dd8249fde33c1276d38f15bb0
SHA5128408fd7e42af7a9c4f3c7b38cd4fa632c2cc0c4bf2a178309acb5d9f03f31686f56862522a0456c397d8aadcb79d2c6cfeed620c1315efb21ec07f2a1f71bc8a
-
Filesize
581KB
MD51ec4722a0710d0cc69e16302b2c09284
SHA1aed7a85acba733c8497676ee0c7e551b5483be21
SHA256e21f342284ea77046bed1bb8c823aed55ab1fc7b1fae18180970bba87a00b15d
SHA51297ee8b639d50cb20bedf94dbaffd14ee9d6ce249a4aa3de4a0e5afee77f7392f5844abd18d17cdcdca872b452fc2f363d71c8ecaf01368a01d979a51554120d5
-
Filesize
581KB
MD59857372b57ae8d2e9f957dbc46ed3647
SHA1b282d97314f7daf387c8f577d5c0cb71669c3f86
SHA256b8df321c619bbefdf0f443f7177c64b8b42388845a3e4f751a8abb03f3005f9b
SHA512745aae9dda7922fa616bbcd4385f4f9aeee044e3b04f9211b960b0318bb074605e9132103a33d34bd66b558f5fb2fd796f34ed0c36d1086c77783a37ad2fc130
-
Filesize
581KB
MD534f24070b94f6b576b2686863ee7797e
SHA12252af1794ff2f0cc82ddfadffc77aea86350b8a
SHA2563f41bdba1f67c80f41ccb93914db5be6ad514c787a0f726438ff465d82edd892
SHA512a5f44e7512022d73a25550bcdbeaafa1f1abc4e64fb84a28365328739f6be55d5e2ac5ba8cbb66f241ef6eb62a146746c2f4c9f2c740a98921e2f4ae67611f36
-
Filesize
601KB
MD59b82def90dac7f497299b08d1180cf89
SHA181a4b72dca6c6aa3b6bd22df2758750efc9c7fd2
SHA256e00ba88de75fbb01ed1086a6dd46fd4e15eb747a620e5334a8b889d8af19ae59
SHA5121f451cf80cb657b5fd5373733967ea14a17e6af587cb67b577a65c1a16243287cfc0e36b8bb99d10313213dcd023decdcf2aecb891ba7f7d9744fd8b7a3c73ff
-
Filesize
581KB
MD51999c1a2e940096ad92691635eaf7b26
SHA1bdffeade35e090e11dcd567f18bc8267fbc33596
SHA256dc9f4a9c392ba89bc4ae538e5226b90444adb50e765d00054f4d4bc38bf8f0ab
SHA512ae4c3f690d439f9428acf7e407e6290f89bbffc71f79d6a3dae5dfcf22c7fd1c345fad35c2fd41aa09fe48367fa93ce43fab3e527d081a4154a4f36e269254d3
-
Filesize
581KB
MD580be9ed82e43ee6768a2bbf55be38b98
SHA1f31494a82663b88c0305d742dc42fb1dd29b2067
SHA256c5878f5927648eceb8e52a4b0ae4d6a989b3871187ed012434d16cb983024ac4
SHA512040f9f03939a98c9dc0fdc5d68d49005f67f3c2ee8c5aba29bac8b5250b3917f2a39a55b5cb564cd6f2f37f726040ee2ff04d80d55b59388ff13577940349fa3
-
Filesize
581KB
MD523cd78099a09575df4f839301787d9ca
SHA169871dee22e792019570aa7608797e136578202b
SHA2562ff751eca42c6b959547a67bb78b8eab66af498f27197ba106dfe1ec0398cd00
SHA51249bd8d35d15aaa7ea6244f2f6944e587c98a7244aa989727033a0bd17a7b4ea4eb49dc86a133a9b46917da49668c81cc1d0191b16f2523351cb8703c6e3fc7e2
-
Filesize
841KB
MD5120f35283593bcdc79fd714f501220d0
SHA18b2c5ebc6a17ab7626dfefd07119f1487effc3db
SHA256f87cb3997349633be0afb6a44e4ecf4ddb9baed8da9b484a53031b2c81cb7842
SHA512b06a1248c537a84ba7295f9035735080f2b2b839d2c5d09b20e0b295f983629ebfcc352f1e3e580982b018b101ef194a54a7e8fe7ba589827d10f7e17c2f924f
-
Filesize
581KB
MD50fba5ddb3dfc8985628f970c6efc1b03
SHA13fc509ee777a02e5274223d04913fec818f9ec91
SHA256fd13d34199bf6bbe0b61a07e61cfe909b3f699ff43b79dce9b96921e994ef393
SHA5122c7e157812f247d6813c8e47aca9c32927d5731ee753d33606bb277ef814a2624118d3edde8f141e59ecbe87f0a2774afe9714c0855ca01e86b4b3cb10b6ff68
-
Filesize
581KB
MD55bca025511522a687aefd82b38ba6373
SHA18979a5eb95e2dc44dc91e7395d4996b0fcf09253
SHA256be9528a165087b6bb59cdddfedd50eab7288a7d1f963398c0f11c0bd725014e9
SHA51276eb019b9ef157cdb025727f6767a67452b7673175ed435dda97b1fa69d341fe56508cf4fd8eedee72bd04a9323118992b64eac60fa59c3c0e5d46b9034597bf
-
Filesize
717KB
MD56b7af96632f26621e19b7ce549d47970
SHA1a8732c2c46725d3d4f852088b8f640054728f714
SHA256a867e40b259d59e5eeca7c4a9a4702ace945e80eb77356d91c0b6aabf9ea53fd
SHA512219d7ca7a3055473a7b556eba8c3cb14a9846ae83f9f437790f9d1f454b95f9d6346d41cf3c2b31d878092bb933ef13e95f97d31a5c86ddeff93b27fe7944d1a
-
Filesize
581KB
MD5148927192e41de5da4e0d2485367f26c
SHA1e2d3032101dc873679f5680189d9804b6689829a
SHA25651be77f7db9b41eea99ad78eb139fff8e6c80e9d7d1221452c6db8fb0cf88939
SHA512beba3529aa7ec90a7649b48ad3e65ee8e5e2f134723d5e971ef2923abf07d22845abfadb3f635ebaffc2ac64131d1030e7c96bdd204a184e81e5b8727ed8e5d1
-
Filesize
581KB
MD565126b636a20feb3ef2ecdea89c89e49
SHA101c5b1450789a9d59ff2f0e1c3cafaf62d2193ed
SHA256a2d3dca09b3d8bf7cdba1a2dcf279b53fdb6ff5f9493a6f28f10655154878e48
SHA512fd65d5c0240c2adff6e85f146109c0a7a36ca34034d4f41ba62f9e4716a138c5ff04365dc57d3a43756d059abbf4a354c065c125a56035102dfe7d835a2c44fe
-
Filesize
717KB
MD553abc67d46ba3ad5004500b4729b3d3b
SHA1098460f3fc77eca35158163cc7f1847978841dfd
SHA256dc2e33e546c4d7710713c233d5df2d81e8d3740c080f403420e86bc4979b5897
SHA5124be9584e7548d690b41e88ed46289fb39d592dcd4c296637afcefa2c1714ae11d27749c13a62f7bf2f79930cc53a7b69751450082d69d75208b9b92710536a15
-
Filesize
841KB
MD56e60d6017c70b24dd0a5af25b3974ddc
SHA1a2286d5ecb51975810730ba8082cf75e1632ca33
SHA25650ac29238cee821231f305a859c59bb048e3b648b2ad770eedfab65ce1fa5426
SHA51286600358ee0a9384f0f7cf80e8134d990373260df2f388f14147d676030f2c1377605b012e9894e10538030816b4662b3010138676659869887e08ff2aba9e9d
-
Filesize
1020KB
MD539d2d8f118a4aea5cc16184ff65ed4fa
SHA1e41b437fc0185eecb3992b6041816f0bc8cbfc58
SHA256bdfd167efa2aa82766ae403a6e639cb690838b3366d28fd01fc9befd1a261bd2
SHA51219b76306b03f1c1d2f3ffdf781407d48251a53865848feb72f70aa6ca1c77c5ce6910b4820d72d0905d74f205ecc460f492fef6eb6ffe089b17501ae9823ad36
-
Filesize
581KB
MD59877b05c183a9b4de21df1a9bf390bef
SHA105917a7cb08e8dd09f4748f91780f966666c1664
SHA25676a85747ec729c6b4847e5f090d3349cf02589eaa1345ba649b6cb47fd7aa819
SHA512d9cd52560f729c722974fd489cd2059272fb0a9c40678593ab9ab47e5367231c75aff744b0a12c2cb76d76161f8a3f15f8d763a6317f1aab848991788e73c6fd
-
Filesize
581KB
MD5fd595cc0224733c05455c4f3eab56cf8
SHA1d83549dcd2cc7392bbf1333087493edaa7ca18fa
SHA256e540692cc760e490df17aefa781f086cdb55fd188d59c38c876f15262f8ff47f
SHA512cd50f24ea8af40b872a49154538700bded4f260f537dfd0f1a48ae4cc8a5099877db8e88f3d89cb2b25bf1f579169a1339aa8a1855cdb770d1929b1d36290b29
-
Filesize
581KB
MD551b3cea2d06b66b9c05b4223dec5b08f
SHA1d9a95ac60ee44fe5622f3c6b0d005e58863ddacd
SHA2567ac7d641e4ac71314577a92d3138bfd813974305d6c39ca7e0abdf92898c4c5b
SHA5125c747eab575418e5d2a85beced3b7a4c1fb7782f7a6fba52e97652de53044cb86bd4c6231f9049ba76de5b72957335e60865acc31314b53f2da792c819870bd4
-
Filesize
581KB
MD5eecc5f541e10abfaf793449bd41b58d8
SHA173fb6394bfacd8e1887dee7b2213f5be3a07d32b
SHA2568eff0b1c8b0e1b143f63dc2bd03b99483b0bbce7090eae0a639bf36564298b21
SHA512158d3b33b94d465b7c20a0dca7fcf6dc42611bb0b7952a0f9bc085f1870d159428e962bc0a5e9004113d6e0d5e9abe695cbd2b2186f4a0c1c4d7d7b753bc8da7
-
Filesize
581KB
MD58b8d705f6897200c2298af42c8c1399e
SHA15613c9f6789d1c60def3865e5700d94b58c0e4dd
SHA256f317f59110bfbe4763c4a4c02b110bfd34b99bfd5c68098d074ad145cf60650c
SHA512cbfa9f73d13f4d074d28f758a05c0633b96a0ff0e7b5ed47b8fc28563fdea632f2774223fadb7e2cdee00c77ab056ed7d7d96243cbc3a8ab9e9933b8b03baa48
-
Filesize
581KB
MD51b77b508da97d09cf650c5811a2f4dd6
SHA151cc32e2ab01756be206e437b3195552fefc3970
SHA2563ba755eb49423f981ef7c909e713a29e87d0c45c9d3ca7fbe9b5a6b4472d175c
SHA5120db39c84ee1e7dbf0331f92664449a7822237b44e33622ca6501c13deaf80d7b5461241302e0e492eb6f3b9cd9578abb07d13570b98d30693e0a32e3e80af4cc
-
Filesize
581KB
MD53f04b595ea3e4e9f4ef02ccb13802d8a
SHA131ec8e97b54d53bf63a5457b1603933fac06d31f
SHA25625b4cd37617c38346ac899bc927f14e258fed257a0f1adcaf8ada88f76936901
SHA512e04dbdcb28394363b11b71bb4b97370e8c1cd9438cd28030cee45819dcf581f404617fa991c7413822e241905b9539c24e43739e62036d51e88194ae9d80704e
-
Filesize
581KB
MD55fda95b96009edff1c13cfc8a52d37fd
SHA162f81c00abf2d09870a13db47acb47e9236f250b
SHA256d63922d05d2a7f4b1149428b6bc00d7d8115e0be15111e82ea923e29261f51b4
SHA512abd3641c5383d6355f9063ad4fb85da53eafb198018909c926f69cba26e99c3b196b14d7eaab786876fefde65fc5c8a5d789739bdd48066cb7e64864cf8e018f
-
Filesize
581KB
MD5f5037d3b8895a35fc896ca9ee1d7df15
SHA1cda1cfbbf891666da2ad17d8e92a58ebd207b996
SHA2569275549e5bcf63687b884a023236b5bb3ada967f60265c34cd39ca4d6052d584
SHA512a022c1f509c442f2ac6284dd12bf3760d37477b40066ea71394c279aa262a421b0af70895f7ac531adbfccc0720d37f0694f7dacaed46a496acb7326ded1457f
-
Filesize
581KB
MD59669681a46b8fa1b05de4d5aec167f23
SHA186a87b5f48ec8ec90c82ba17d0c641e175c277da
SHA2563b6da24dd80e42159666f485642bda187e92ce83def7e174eb8e349a8d5b933d
SHA51207e471b51063ec1036535c4d933d7af488e609422c38852e1f5129ad3c6e5edab688f4cb558f3ced54a877db774bb0f33cb5aef2e9c66fa877a3912939799d53
-
Filesize
581KB
MD5885c25e44945ddac98082cb02b241726
SHA1ebb91a50c2019ec315b0ec0b4cd3f9c1002f9c47
SHA2568bfbb8af6fa589e13e6e512607fcce71b40206bd38ed8f4c790166d51a10e571
SHA51239ae725b9c868ed384f19a795aac86530a91ec3e9cf3fec59c55ce714d616e2ce104c1f990d10678c56b036b6d93cef83c27a4d3d21cee7069f1c82fb5103c81
-
Filesize
581KB
MD569e0cca2cba4d5e4d1d494f991981dab
SHA1d20969e1097f1c76608998f56995863e826e6f67
SHA2566dfe567c8d5f5e5e0129a4561c88fa08bfba1fbab182ae566f4f69a3a3195ed1
SHA512315e78afd8efebc57a320c3b5b17b3668473b59c7d073384bd1769f6ba239695dae8308de9bcac71429f921b129335ab2936f11e2ce0ee13d63a861695f7115a
-
Filesize
581KB
MD5c289f3a2434c70f2075733835490d4f1
SHA12345a0e8fea29483e0d8270f21c4b6509c0fb093
SHA25697fcc05b473a31110c49a75de235d4156ecb4a806d4e48548ba5a56ecb83fbb4
SHA51282d66641e3cfbd6ca9eafdb062627cc1e67e980fb06c072396fb2412abe743c71ea29a066330f5c9619ee3714ea6a661e4bb0288bb4e52ff5fcdc3bff968ddfa
-
Filesize
581KB
MD5a2a5812b6e90cbddfd5c709b26bbc31b
SHA1a6946b2033c4f941d9579b3b71e9f9ed7b26c4f3
SHA256d81621bb988688f87faecdfd6a8e25d1eebccc8f16f1e5a5347f65f9d3c8051c
SHA51293bea476f9bd9ac6da930ec5cb687d80796377a54147adbe1df1fb16fd68d6b37efadd5858ff921cd9b527c093a24d4bbd6f448af967fa1390dc6c04a28a553b
-
Filesize
581KB
MD5573d83ec4115779287f00f1e2f5f1523
SHA112feb053f5715e44c798a7d970ea8042d3bc297f
SHA2560868aeb7ca2b5afbefbc282710ec9bde897b0d084799eb2d618b5d3b33a4cfc6
SHA512f932fb6bde07677a59c454f44ff707d72ef7dadb1e622ef5980cb7fb5286c97ff65c7bccea8a07f065261b8d06d984bbdf17d91f313aee85a95adcb18a0cfb47
-
Filesize
581KB
MD595d04b6552ef454b136710a838dc2598
SHA1efe1fa351bb09babfec8ccf87c8f6bb46807a821
SHA25611db8960fc69b1992df49af7b4ee23426a7d8552e66fc7b7f74f7fdd89810a6a
SHA5120143b27926f7a07c53eef40d8c0d92684f36a2369d242251ccadd09e3d0a81a4c23f1900b47ef8a613b8461db34d761d7c45baee77e4653b29b9542e0ee6abbe
-
Filesize
581KB
MD5477a84e5c4c8bec2bc9be712752c785d
SHA1c09933cd31d61449e577feb8080584b2393ab121
SHA2562be7f10084098865aa87fe83dd6ffff0419835e3a174a7144e5370f5d434259a
SHA512c35ef0bd0f66a8dd42456b198b8a6ea91da6e2148f0127d4a5f2cc45015395134af366c87c39ddc124eb39872eabf784dede58975485fc57bb18df3e2129de6d
-
Filesize
581KB
MD5191b0554f813f8a2293debbfa3e7d15f
SHA1ce8fa5cde14f25253e579e3e3c39ee0e7ac56b35
SHA256e03a2d38b954360324b3eba5f1c653f1c969e536bf747fd8fb01846933012f68
SHA512912cc331c347d0c3e790b4c65fc27ff281153b1a87c978311382b8df7b18e329bdce070bf117b1656579e7c0583a52ebcda224a4b775e46f69835d50a3d649d0
-
Filesize
581KB
MD51aaa0c2032f282970b12e6c019a90642
SHA13567a26150695d2cbc161629995dea1a23b628f6
SHA256631b10bc062b59e1cd11427ba352d5cf67de58c4fa650f40ef74bca604622367
SHA512e86ae40828cf7f11d872c9a139939e8f57d8ddca801005a737fd1bacac5ee4dcf1c4b261f1ab16a578d318fc6a06c0a776a1b94d5121a55627cdf772c2f0efcd
-
Filesize
581KB
MD58c4c9bc0db4c0d9ea0eccfa1acdc6720
SHA135396a7868b843cd1d003ea844006f8fe3733fb3
SHA256fc554236d213a466ea1ae1c20cc58dd6b2d60d14d1fb34dc17029bae96e5c824
SHA512898af6a55c64118839ad8ff8552e3476c0889d5d9364afd5a454252ae11dbcb82db64cbe2ec89892df001a0344745bb1b2980d64208de0f73d0ad8b06377a090
-
Filesize
581KB
MD555b68d1e0e13593ab8c500569df2f842
SHA13b4c9ee3940433f0c4e33119371b851cf23fd807
SHA2567a72ced4eaccf2b2baf5f0ca793e6e95d0ecf48915b9ebca768b00621ed3beef
SHA5128bbd5d8f804c3662ba5f8b557a85514355710e636ac8d12b79bf0cc97f3fefd91f6a9533eeb6b6769fbedd66902b24f23bf6a61b7ff2daa65bbc9f76ef116bb6
-
Filesize
701KB
MD536733640d0cb850f218cbf8475636165
SHA1fdafdba13c970a1a537848edc9233fe577c4daed
SHA256795202c555053a125e1519213a74ed21fccfa35506b75de44b4319959f1e93d6
SHA5128157e261027bc0bbc53c81098ae6cf37d7487b0fdfe7f9ab191f4163ef0a1a5ac8d35dac120c3094df9f25c2e730751382f37e11a4530ba42be0cbe1dd3acfaa
-
Filesize
659KB
MD5ab588f51b7cd9286584fd26bf6791937
SHA197f9698b48b96f7f732c0fa6cd088b7d6ff6e252
SHA256ca957991223b2c6d5a97cc58669be93564947b84a3f78993792ff7541a2dbdd5
SHA5123607797d729ce8021a54ab1c2a4c17ab42e8689dbd3716fc2f28958a843f7e65f141eabea9f03641d45138d74d40cc52d2b7dcf626dba3030b6562f33e954c66
-
Filesize
1.2MB
MD5e70a2990fa5c991243888457d4ff9c6a
SHA19875e956c47a3b6416c573d7d79119a667629d17
SHA256b70132c5371b88bb5845f89ce338ceb47bf3667a7f9b8d19a32ca7f44f6430f7
SHA512771a98a5774b90a9b8599dd4ebb8f3929bf1366c6fa513ba2767fe2d960e98db3ee64611db77c1da9ce3c05c3d2b4fa63e8bc200613fa2b0aa0dd5bea4faf169
-
Filesize
661KB
MD580daf138e4490ccd45469c6c89c03288
SHA12d6e0cb3d07290b7901773d69f72864bc4c97357
SHA25609af9242eb44587c0342097ab66f3cf182ce9ea73c33d32b72216e9dfc0ea2df
SHA512f533c3b8064f0a6650b218b6469b4119ba59186ec707974c95f76265df5f03b63c35f475d9e2385474ea3295e98fc1a569d507f2316b5dd19abae1856c64150c
-
Filesize
1.3MB
MD5fd140b34873588f2c5e673502fff7308
SHA1efdbd0e6afffb6a2b3f2227a821d82bdba9d71c3
SHA25656cdb5ff26896403e7eb5592001a8c5afa3251f3093b184afe8e2d451eba8c76
SHA512fcc7da1afcb5e203940ec4502e5bbd0b04ad246f29558f37312354ddf8412856e5b7547de556a3b2d97c55e8f5eaf91b34a0f0c4561482120ec70ddbcb3a3aab