Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
05/06/2024, 09:56
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-05_411b6058ec1bca4de9c102023fafd787_ryuk.exe
Resource
win7-20240221-en
General
-
Target
2024-06-05_411b6058ec1bca4de9c102023fafd787_ryuk.exe
-
Size
2.2MB
-
MD5
411b6058ec1bca4de9c102023fafd787
-
SHA1
06331fda4d159762457102079cd381558b0a34e8
-
SHA256
bff6f5ad884feadea5de04e94b0fbe7432662209876902cabcb9220fe476628b
-
SHA512
2357c69c44c8a34d2c8d0a43971df201f7bfc76500ead5d6df27c82bf2abed2da71e75d1e4bf7228b8ba131b239e08550f47cf4d4abe1ceb0dcc4e2e6e5930fb
-
SSDEEP
49152:DOOh3aN4kuLbegmtGQZmNkpkxQk4YXqalYCuG62B:zU4ku/ctnQNKkxQS6alvJ
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 2872 alg.exe 3496 DiagnosticsHub.StandardCollector.Service.exe 4360 elevation_service.exe 2776 fxssvc.exe 3212 elevation_service.exe 2892 maintenanceservice.exe 4748 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 11 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\a4dc087c293b476c.bin alg.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-06-05_411b6058ec1bca4de9c102023fafd787_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-06-05_411b6058ec1bca4de9c102023fafd787_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-06-05_411b6058ec1bca4de9c102023fafd787_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-06-05_411b6058ec1bca4de9c102023fafd787_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-06-05_411b6058ec1bca4de9c102023fafd787_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7z.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_102250\javaws.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\dotnet\dotnet.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_102250\javaw.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe DiagnosticsHub.StandardCollector.Service.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3496 DiagnosticsHub.StandardCollector.Service.exe 3496 DiagnosticsHub.StandardCollector.Service.exe 3496 DiagnosticsHub.StandardCollector.Service.exe 3496 DiagnosticsHub.StandardCollector.Service.exe 3496 DiagnosticsHub.StandardCollector.Service.exe 3496 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 660 Process not Found 660 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1480 2024-06-05_411b6058ec1bca4de9c102023fafd787_ryuk.exe Token: SeAuditPrivilege 2776 fxssvc.exe Token: SeDebugPrivilege 2872 alg.exe Token: SeDebugPrivilege 2872 alg.exe Token: SeDebugPrivilege 2872 alg.exe Token: SeDebugPrivilege 3496 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-05_411b6058ec1bca4de9c102023fafd787_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-05_411b6058ec1bca4de9c102023fafd787_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1480
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2872
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3496
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:1820
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2776
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4360
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3212
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:2892
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4748
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD50b1af550f68948cf34169b1b5c831bb7
SHA1a92ffbea06e7032ae41314f4edfe84a9baa16766
SHA256ee68f91f18aaaba3da1135da79a385cd74d45fd23c1c4b78ce718256ea43bc05
SHA512770e527ff7bd8e067ca95a86b0a65af21b2277b60014f495d654ff74268835291d347d0b13ddc3fa8cbc7c1d0f309bfab542f22f0ba8d23cc8cad24d23be57f5
-
Filesize
797KB
MD5ea1175ae044d1dad0111767828d4403c
SHA1bd9e1aa75a582987f86d14799a526e394182e1e3
SHA2564cec9dbabcc22fe085f6c84788afe0b2c34fac2e0c267c305c7944d62c1d2a1c
SHA512ddfdec8e85f8da4c2ebc52f254df62e52c3791710ce8f93c9e97f2084886fc423b9ce530f4eb538f3fd32331935c8da858d2068afdcaa362035b1f3deabeb83a
-
Filesize
1.1MB
MD5443c6286ead62a8372c715da6835f32d
SHA14d95b5608bb216aba6b8de68c581cd387c3a2d2f
SHA2568a24879bd668a5d03c0a6efe28e1b4b929c178ef9a5816838100500f1682cb3f
SHA5120805e25078aa52b21cd42fbacf6ae9e4befff29eb72f972596152b736573020b4b51bdf24ca0c171118a5d8d160a8ad37486517c68f66b738155347f64e142a4
-
Filesize
1.5MB
MD59d12a319e171fa7f0374d062a1a6fc39
SHA1820d72d3c3abd916380bc2567e727592eaa1847e
SHA2566b665df8ec253c8e452c00551170a8d44fbd8f114c3d17b3ee93c80b6a791a22
SHA51229e60b92b4c99be178cb30f468e23852463f9f7ab7cc5cf39dc0645cb44a493f06181c5fa7c81b943bb4c9113fd2ddfd5bce8a1b1d26cc0cd53b25bdc398ceb1
-
Filesize
1.2MB
MD5af5ec5ddfc74391c798a85a8e24dca45
SHA1391edf18df01a0e69efb616f6fea1f6c6a79e074
SHA25630c19547ba0e0b5ae610162c21a2c5880d117414171a4ea481a70a72ad1a68a6
SHA512cb63d549c62222aed2ce646d1d9ef398f7c6f487b13f89381a138163e211428a2ad0127bda4f570c5c839fec0d5db1d7ebc7acc151c2e3a917ec08ee69f981ce
-
Filesize
582KB
MD558927bd9ae2bd67553b645fdc97248c5
SHA10608d93209f8107effbadc2f0d2c4c35413c093c
SHA25686d7eba8f2615aea722b9f6b490069a2f703d2607054a000ad202aad6f11b14e
SHA5121ceb2a3952e31a71b44e5bdda29b13f39393dd384c5b1cf67e386f45bbc62837298acb2dd8a585cf102b87fc6b88e0c0cf5a1e00fa74e756b4347d28a0ad961f
-
Filesize
840KB
MD50dbec4144ed5c240fda6f9ef928b763d
SHA1f27825d76ae2b9ff3d082a01512f9b8520eaffd0
SHA25610d84ee95810f7cf38cc5867c97d7299ec7337e5b252f46d0d322dbaf7b5b51d
SHA512bed276fd92d2deaa466fd85d3486284f477880f2f684964caebdb8c506dd94da9f250ff598d822a284a0c9ece72aadcb3bcaa432ad99a87e8209f57f169aa333
-
Filesize
4.6MB
MD58ef26e43b8dab37bbb47f3dc54292e88
SHA19057b5c5939ef18a985dac472e9cb73cf60bc742
SHA2569b4dcde8c2b5f7e810b3675afc001a172e9feccf8416225743ec64d82e3c0bf3
SHA512d912616810d82ea8f21481a33c8d8881b486378bfa116a1d8c326e19f58b1731258f844e4d42ddcdb3f270686f887a06570a842a93626b0f94fd685a71098e15
-
Filesize
910KB
MD5fb94b291d1ad57125a51dd8714e32dbb
SHA13fac3124f86a20de3f50cd937efd716a6e31d815
SHA256f160802acbc62f71e615dcc4eaafadaf9bac03da8a580bbba2de0ba65c6591b1
SHA51254073c26d009a5f62f26b7407d4a95db8675076d11546e296438421cbf94980f9686fb54b3f95325a7132968867c56a067efd63097b31041d8104216a17bd12e
-
Filesize
24.0MB
MD56827cb389571973d6be4b541eb1206ca
SHA1101c7b4d9e692a95a556aa062eb8a7a35ab6cf17
SHA256b2a01c034161249eaff525ab247fea60ba915fa1b9ec9e0671d42fb8900b6eed
SHA5122ec106c2197d15354282cfd38e3823bf1fcb729c6f3fb5f3ced6336fdd08be8599e6e1bd59c0ae603722dac0bd2eda4190d55c715730a0598e382a9e65b6446b
-
Filesize
2.7MB
MD51835d1e45bdd98f68f0ca9688d483853
SHA14fb77a8b90c1510da038efca4e1746adb7cbb334
SHA2568fc53841e2828c09a59f8a3f5912f38395d2c9edc899c1c6a39a9d3c91765ce2
SHA512b777f40ef6ea9cb113d15ede364a115a54f550f26bdb13fbd3132552888e22420a93b35380c7b1c56748d6b80bd56491eed1b61cb1aee4dd227dbbceaeff7c8d
-
Filesize
1.1MB
MD5e4fe5843cdfd684c21e4b295d8c9f074
SHA1821fc5717cf3a54e3c48d3b2922aedde6566c40d
SHA256fb611145b442c56b4eddf9a748d942b513c963577750aa4f6967048c8fbe0b56
SHA5127cdb0c750d0c641f193fd97897552ab034f4538b8052f886a6994a9c633728f7c43da55f03d5d90106b1d37235a194ed240fb27ed813e2034535ee8c4aaec09b
-
Filesize
805KB
MD59a09fcda83688b3feba44ab99776a7b6
SHA1331f727427fe6047c3f0fa67bc12fff84eaf8dfd
SHA2564b5bce22500ebca4c2f4a0d137689d2200d3bef3b00af9722d40e364e0ca720a
SHA512ce97830ee84d87730fafd5e3e23432cc2df330aa5626bb82dcaf43881a293cce3d5b3a7180187fec9f003b78faae6762e5991b0edce5c11fb9f2fee4ac1895a1
-
Filesize
656KB
MD5e70d3b644dab2bc91f353d32450fa6dd
SHA1272aa1b4be7760dfb5138625dc6d3abe39427649
SHA256a69442a3945a89470000a7728ab0c872bbe80184ecd19411d56f16560b527641
SHA512bc7e6d537c73f4f9567154496feecaa984037c9431ff5126fe3c2d5a373fd5bda44a9aa87ccdc740daa4352eb0852f437cd041c73b4ebbd9fb193ff8c715c8dd
-
Filesize
5.4MB
MD523f34260971fe886f1e9b806e191d461
SHA1d01293fd0d84dd46814c922cf001a812a6d857b9
SHA256278c4321f0d6890c6d0f7502e889d33c8834d9100b667f2b5b93384e4d11c4da
SHA512f7d1e9097321d33069c5957b232b1f3cc0edca1d1b9be6ef743238216aaa3b38a5bf4c4b43653f7646bfffc1f2be7332fd6b2b2d205d5a3f61efeca7377f3804
-
Filesize
5.4MB
MD527637df3c337898681b4183173c236bf
SHA15bb2a6f8351f14607eb8b3c9c08e265a7e384f6e
SHA256377cf390373c8d77a783f7592c4ce04cc44a36cc444fc2a7d36879a6dd50f9bd
SHA512cc919a7d80fad1b3752ece6998b548a02507bfef5892dc7ea3c85a37498426bdcfc75ab52331bff763e0ea4c3fce0432722bef29275d823fffa545fa6cac2cc9
-
Filesize
2.0MB
MD5eb218ad7542a897255f4404d5d2786a1
SHA11d01fb506377a7557f23c9b3ba8d6e2aa33eaf65
SHA256931fc52b353745ce39349888f210d9ef03c46053e33452da861f27b26c0d1088
SHA51260fbd94a346f86e9e99acafb46117e2ecbc1a19f272e5a1bb53fd6b1e8c79ac6b91bdf4aee6ca436c3176478468bc723931190adb5f57bd2b22c8ac6d41ffcd6
-
Filesize
2.2MB
MD55ec892993825b1b7574f97c8797bc9de
SHA155dc1c113b7f04e201a4d871291a2d07ee90b012
SHA256dfb5769e730ae63e7941d9d57ca9b393bb5b211645de930e06814eef54c554a5
SHA512b5a5c06a1aeba5de7abce4cda277749315cd0e4dc2d456206fdfaaa929ed7f604513840a637cc4d8eb5adab7cd4eebd5961672186c949151e71548e9465300a6
-
Filesize
1.8MB
MD57057cd914ef468567cb2bcaa3d974d18
SHA111ccbb2bc4718c09b4cec1ad621f24b3e5894d86
SHA2566326497999a0e5e6eb35256120b4b4f44f776fde109d1f22ff94c8d90189c666
SHA512d82ae218e37184a030a523d4fafc28b2adf58d39bee2337ee82dd657f019ebb887fc9a6334feefbe5b78990ef047e849fa96a4d4b01ea1bdf3d18346564ef2dc
-
Filesize
1.7MB
MD5b61d628a5e42b939c86e5f80afc86055
SHA1fbbcee36d383da1338efeecf3e558150cc071547
SHA256a0341df52dab2ea19fb44e966f3fc2b93e8c716a63cafb87db6c157ae7b6ec7a
SHA51288714a4e0505cb2fd0f12b526fd82c75d740629de798be7d2c3d4bccfdfe40fe7c9c223f3e30fc02ab9cc6ae789e58cbafc3c4473c906b8be8d4b9bef62a8f53
-
Filesize
581KB
MD58fd4af72f54f36fd6785ac2dd8ab1659
SHA14d5b3d3b2fe9721116c1f793acf732dc3fc6bc12
SHA256c3cbeb85d9b1ee2f19f5b6e8b571ec707a93f6aca65d94e36d0266a9f85444fd
SHA512f0205dba170f4d13d8589f41a4e97730f150f1f471255927f349f268670d0d41658634ac12606147873613ec2c05c1b41d9f9020cbfa33e212de5cedd230d174
-
Filesize
581KB
MD58eaac5cbc9aa973675193202d5d42958
SHA1b106502ce82a560561319f401c6475a3fac81be0
SHA256276d6554e27da61cf5c27b681c6f8d70578ef8602a752855424b60dd5c7466d0
SHA512c52b7bf9ee30b1cc609a38034f329fec4d03bac637e26e2b457b25b9e7cf2f9ea32e466419d771773e5e05debe398e6582312332c5c41647397986fe6b2eccb2
-
Filesize
581KB
MD58a8f53d501170a00581c1ab1eefc3814
SHA17e52510185149cda6330efb4411c87e8eb2af9d4
SHA256f9730e2991156fcfbab600825d49961eee861ab35e24b13dc6807ef18e0cd2e1
SHA512d0eedb7b554bb39744e75fc313abf38310d3c3c63b4f2c117e15381d18c6bd84cb9c6c78d5f9ccda36b1c2996a6c80c52ece4b9704915b2039ec4d3eeb7e94a5
-
Filesize
601KB
MD541eed571e4540fc4f32122237d83f3a5
SHA1ba251939af8e01d59aa1c1a18d9aff3b4f89260e
SHA2563979d3b43e16406508225264054f7cfb6879f1e810c3d90d9e082ab65f108339
SHA51217405c9be510cc9b315ad4eb6c84e88d2243cef2d9d9316efa1fe232b8bf5e6441dddba102077cae461a15dc7ffa0a4b0cce782ebd1f9889d0c714e0bfff5f5c
-
Filesize
581KB
MD5ebb5e9acebfb6f5a1d8acf989f6c7200
SHA1a93f792613f73e8ba60c8a4dc5446b24bb9a317c
SHA2561e254fd81f7061b78ad005a8422e3123340771b50f5959b7ea4d21ff318e32b5
SHA512672632597ab5520cd5ee8144883cefcca7b6a0cc829231e1430dc695a060fa488ee5fced70436f0995f13039e50d808030793e85a320ff84fc7047211e470eb9
-
Filesize
581KB
MD5a05d84d0b59867d74232d5092011ee6a
SHA13eb85ae95b55f7704b627f4d5707e357214b0305
SHA256d3cfe5b878e9d1e382a568eacb298f7d2ef08c743f5192956a6f05449451213f
SHA5125f4278d10b3ec54b85c8a7dd6be8f0ad9a7aa5ccecb5e60abae099454b87ac8a22953148d3808695b12f08f7dc66c27e55dec9fb7c1f8384ba354c3f2dd25617
-
Filesize
581KB
MD5cbc6736261d7cdd0bb1e91a78d6e7567
SHA1471b59d66c83c0b9754d12cfa370ce0fbeed7206
SHA256dbb92492cdc01531fbac719652bf6469de9b736ff6deb8abdfe467c205dfb212
SHA512e44b63a665a6c90f582f72b1fb70c183ba4416e9474ed9d3d93a26bafae4e2009a205dd7a44e31b5f7edb00cedc0fcfe9d055d60bf5a2eb5c0688710cf87101b
-
Filesize
841KB
MD59dfe12d5eb0aa1c03f482ac2c4c2a139
SHA133336fffdd202ecc3c083e3718e1f9ccdb2350bc
SHA25626e35e99cb5843bb42e68905c92e455fa8f942eb444bab2042275c5c10ab68d2
SHA51212280463d6db998cdcc3db08d581c1546930ac440659ae4a949e4f4fea11303ca0275e55f0a7f2e467eece96b8bb747d7dbf73c58c0694fd7a4e8a9e53f0d68c
-
Filesize
581KB
MD5d244dc53bd26b1c387b362df3d17b213
SHA1100fbde404c0314b803bf8f10cb23e4cdae42612
SHA2567bfcfffb4810195f8cccdbaedc68a6acdd2948c53b880faa3cc2a4ff366ca717
SHA512d9f541c202b87f0d360139e0cee8a56d14de357e5309286c1492be264bd619010d1d23f456c037857291d1e1ec2526ef580e5bef038e48532af1bcb842fe7e7d
-
Filesize
581KB
MD5257acf94be14d5fcd3baceade96a1410
SHA1958887e1d859c3689584f527556f850ee1097422
SHA256fed9204f88f7c0f991a6e6e4e8d5157023cbf0cfb455906ad328df97e9ddd5e8
SHA512bdb30690e60942c11d439c86f9f714bdb901fd48ca21cec5d4caae2be7cbf1a82d0a00a0c66c53b1d7881a0538463a52adb56524e16c9fe68e05dbc40d09546e
-
Filesize
717KB
MD5a19c53028ff155f85caeb31d1f1894c9
SHA19cf0a24e2663549b340c5604e8c5cc81b95b1117
SHA25660dea744b9573adc5f6c9133218fdb0c936714523c0f5b205036d8558e7e5ed7
SHA5124610466259093b897660fc2fff4894af64b329a15fd317f5c7c2e737a4def51500f8dc30986ead0e4ade0f8386b0f75627296fa772b1d0c520b68100834eee43
-
Filesize
581KB
MD561f5460fb44f63a64fc6fd51e07d9210
SHA120f0c98384b8d04d2885bddce220d360b806dd84
SHA256230a630a0a81f2062a69a9d95a14c254b3cc0e0ca7ebeb0435b89c16fcfa5df3
SHA512d13dd6b43f4d11519ab344f8974f4847c81f4239916a621aa8973e1ff91919086fb03d89d19120d3ffc58a038f86b97c38a51c94a0d0c145cc16b0b95fefc303
-
Filesize
581KB
MD5e70bea5ffd4e3371fff9bfb4c7ad6e73
SHA1640310ccd7de9b3f3cc6a66f0c681925e5eaf5cf
SHA256b3e898f9ec1e985146d104b3aafec2fc9e7bd8944157a0c72c0ffa02fcac13e8
SHA512659a3bce89d73f96e1b353b51c466c624c8835eb55a989d2acb8a4410a1a142d524e3fe154abda570326e523d2daad4ed361b9420f6f862d0278f9cac8c42e0a
-
Filesize
717KB
MD55c578d9dc622cea94c4eb04a6a61bd06
SHA151d81d41e704ebbaba46e4c0250b5c4fdfaca53e
SHA2568381b6848fc1155dbb10fe26eb1d0bf11d458964fd532479625a3117f00c610e
SHA51248aa14c21cc6bfb8ee66fc133b6795612cbe505fcedd8c7e37dba02cfbb3e688a8ef862859089953f30c07053b5942b8d65fa229a344f32a6f27bd115b92469f
-
Filesize
841KB
MD52414cd37c05c46e50ec93041988b4a6a
SHA185744c520f141b05ace8f371f7e54cce5e0b3fc0
SHA256558b30095d6cda1bb507c532e641ba52ef2e0a571f48475e5fb06b8f3ee0bfc2
SHA51265ec99b965bb1b0e1f69734c33e65f215ebb64329f1345d70c7db199fe53d60a926a64ace476124bde7928ccbd9d1ebf9a7bcc2b8e55221c9d7380aed23810b9
-
Filesize
1020KB
MD5975e8adbfe7db7d692e4ac4ec4325b3b
SHA1498cf6412810f15e3d37d5536acc88be78f98dae
SHA25659b613fea56d8dcb5475148710da8d850e496bc0404d2ea2b8f0a4f5e1eea2e8
SHA512f2a39e57a48fda233105fe1f8507210d8f5c67d8db7bce44ce143c80b2ecd5a1f0b5c11477648a3dbe34826171bf135f2bd61f9966e0b8f2dbf819c968f7fcd0
-
Filesize
581KB
MD51a1ff2d694f6e3e773f69ffcffdd20de
SHA12fe15f56ef7ecac08209f9395e1408048d172ccf
SHA25696ede3063cf5b9603fa556bf36d2ad66eda02b6e55c672c12cde2d3174afea0e
SHA512f26264e165be7df3769262146b680e4d19f829528edba3c1bf94663b8a7c29d2f4cfcb96c5f90b67a8c4a33eb26888af74b1cf21917b65c41ce170b67954c22a
-
Filesize
581KB
MD577e5e5526dc8d9add3c0f774de4a6f12
SHA1cc34a7542840e8f03d822fec85d14147e4756959
SHA256ec7e84cf6a5d64e1a16551dc660fc105fe834a7c168b7151fe19086e64097c92
SHA512fa5aca18a8801762a6e0bb2e086b0859a643f2ba5103f2bd55d12afea955ab5843fffea69de00da31c30ded233fc57d80f8054096157b7b66a4f251352e8d56f
-
Filesize
581KB
MD5bdad2f0ea8474b529a97c3f87037da2f
SHA1f2bc7a5e999350f58b175c98414598edbfa06a86
SHA2560cbb6cac7675b143a5b5de6bdc74e25e6641b30dd49943e7f6457120e56cd89e
SHA512bfb18742ce748b8e222c71e264af6f2f5c9291b092ced4df2775e32085380c620fa70fac693e8fc90995b07cee2763635dbea3cfc01b2d9751e91d8f98cd0986
-
Filesize
581KB
MD51b1b7bbd3de230829a1f28edb806000c
SHA1dc84d2e1c48d1b243e10d03b889896cc840dae06
SHA256aa241c94ae64f100dbf37c7f67b42ad68240e840052abbd6f4f7ad13218b57ca
SHA512e81cfa90797d4371222c6795aa108fe49ce00be748f48897da3f40a91ffab0a18dc0303e4191a52319f2b5d3f4c74d55dc5b7c937bb557881e4ebcf03b8a97a4
-
Filesize
581KB
MD512148547f3eb574b89d41e31b0f05eaf
SHA11351f2fb873ad6c38f5b6cf8d872fe4b95dc5b54
SHA25638a9edb207d2eeb9778c5d9e4c175cbe111620e2aeb23ac6d1d6f48c85a4e3f1
SHA51243b412430efd4d455f132c4ad53961283900a632109b37a60739ba1614db0d485eb8bea238b350f0cd3759630f93a1978daad944f43c14c55b79c5f76aa0a919
-
Filesize
581KB
MD51e48fd57269cb4cc2b520b0aed118d63
SHA1ef89a2ae3dc1a9d01fc72f547128d9d42c2a8bce
SHA256af742a198dc0a67990e3b24300eec4af206205b1691ab890a13fcd1a5d23e55f
SHA512ba5299bd8e10495c43aa2c6d0a72986bfd9edd8f20efdbe58c2ed4890caee0bcc08c3d10d0300d8ff0dadcf273bd1541e44f6308969696ecac94b2e5362facf0
-
Filesize
581KB
MD597eec69ada174a1ec8825fe33d0ee441
SHA1237887407f4091b7990b8faf28b3f83f446885d5
SHA256be9e2fd972a2aeea774526b4c99b004e5c029d6c11965c04c86bb137be230447
SHA512fcfcea4377a68b70c433a3d19a1a57c2721593eb6209dda077e1281f8101d179604e3f12e9705ad44ad099c2bb1f6d885ba84162d334e75e55d7c4383b7acdaa
-
Filesize
581KB
MD52aabdbc5d540a3fb98670757a46cd01b
SHA19c2e2f6197ed46b39f512fac2bd8f784e91db1e0
SHA2564f7180ed2661c6281d1ce63379d67dd24f3dac24624ddd11682827ef18b5342d
SHA5122c5f9d7a5221a75b9e95c65a81a5b72b3d028eb1aca4dfa005b899cec18b5ec2115b7e4958ddefd40f7217dd1d0c85f194e5ee301a6b6a11bc5f4a616aa2cb6d
-
Filesize
581KB
MD5d352387771c9ef10a953f99c167567db
SHA1104f7506e10309f2b909d4c555e54208bf0c582b
SHA2566121fc5702623ef869655f5b92777bd6401a44a1e87daa48e471cf4b1f824ead
SHA5120ae4fa64fbb2ea8fd70d641d3fc70ae47d233fb574f5f35862f3d42e9cb97e9a4bfcddfb1ed869ad5765e212c3ca98036422f1029c0e49f5e6ad3a150f167c0a
-
Filesize
581KB
MD570cba3b04cad833a8a78eac40a4246e7
SHA118b3678ba63cdf5b88480984036fe11896a03c3a
SHA2568cdfaa333aec799f23b655b2efac84d302664bb2d8a8e42546d3f66147aaca3a
SHA51240caac01add3ec0d1ac77947029e0fd434857b3fc16e0e2d8fac6672402fc21ca49e1ff618935d142f86fba9ef064e799b2c99f21dfdf8697c558c9f6865914c
-
Filesize
581KB
MD583c774a6b6badbfdb3302cebc95657ba
SHA1e79064cf2c722c40edcc923c13d8e862d51005ca
SHA256b53d10b221b30482bfdb0076315d24a28276c86bccff01825934c6f43372845d
SHA512e92011032b5f23a6522b74484297c7c2dc584d02aee9f162001c3ed0eab00211c7a29b1b115dc9e8a91df4203faaa3932097d7ef8f2cef4696fa1017fb79863d
-
Filesize
581KB
MD541487e87aa59046efbe194ded04fc398
SHA16d7129c53fae5a5e0806381d45eba3e74685cee9
SHA256d77e32ae0a635c624e59e24faafc49435b5be7bd7352185a3aa4a665c12c0cb2
SHA512ed100426f54afa515089a442b6791a045c61eca7c7529e4ddd3ad7387c2848549599b59b66b1d438505b2007fa5e8be43e93409d582527ac1b409cc1eb45bc05
-
Filesize
581KB
MD54c8a1b03e408dd5ddd03c3ffa696a45d
SHA179558398e5bc810c9982add2b23d3e1fcf88276a
SHA256c81470c45f3ec1ffc409195fc392782eb33420ba978c54097693b6126b2171d4
SHA512b025671ca384041993f6a6a5a8e1d3098148d91d4688e2acf99097d5c032c9a3e2f67141844964e8c2a223d0af72811207c7fd7925cc3b7bf8487474ba1b8037
-
Filesize
581KB
MD50f43871dd09d7a544f7b84bb96ed6df2
SHA105cddd49a361ee08afa42a198d8e6f694cc8a4c7
SHA256b4c5a08ef5e2a0c3e1eff31cc503685858296925f9dce50b9db06a3f23f3d755
SHA512a03eb9bcb67e9cb0ed2cc6c3f94e08d242a7f43786cb7e2317ec4c2c1586daf30de88cdcca6a6db2f30497b31402340b38b9a006b7da78f66a93ac9c6c858154
-
Filesize
581KB
MD5b2828a18b6099fa91d34822ae01f0965
SHA1d917d1220bee2a66cbb093d20607f810126cbc0c
SHA256112593f4bfb1a8b7a5e68a3d91a50b62dd287e2159084218d71687eccbafae11
SHA512ba54d59cee58246257e4f2e970ead4011ed36a7840d5e88788b5f2fc2982085cd9e0c10d060dc04b54e817c02294694bfb09c3f57f3ed94ab32b6ec4dd63e321
-
Filesize
581KB
MD5bbe09426d62d457706ee18d558004945
SHA1bdb4a638e2ca608011e2f94e822142aca7ddc9e7
SHA256028d2676d4d1ec766a1ce127fe4403accd91745a4a8c891c701c9688ecc12d61
SHA51244bc1a44e1f9cf755daa6bc615c331287ada2a407f21c09d4509c5bce561e389b65783d466218e44c845cc4ca10a21718c29eac86e35575dc55459c4734180b5
-
Filesize
581KB
MD557d14cbe9967835ea5c2a171512e0dec
SHA1092f99ab9fafe6786ed0dcaf844a643ac23cfabb
SHA25649303d459b544348bf159d04472b7cee3193de8c850c9284500de4c68f21981c
SHA51232d1aacf023417bcf50f980eff3f798c5df7eb2f70543a5c874f3053844386efaba19b4a573c3d223cc5a62f39f9bf10d77163572231bdb406de1d291134f2da
-
Filesize
581KB
MD5eb3ffc559a765c6184f1cceeca6e32b3
SHA180759c1269fecf2267dd4f2132a940c81c50db60
SHA256313ec2ea2ee26b595f81bbf17031d49a60f4315484b45ecd8a75ac22f67020d1
SHA5127b043fd8fe22cb35ecffd0943db001672b70fa053cf285705988ad10b61ab58ed0da0b2748584f721b7d4e2423323b4a780f591ae86c6d90717226d45caa70f1
-
Filesize
581KB
MD5c6807c25842135aa13e20f07b2b8d01d
SHA1fd19b2f447c244aa5a1c1b7c29922007ed2e0c86
SHA2560d6aa8347424c93c9f2951dc17dfd4b3869107d39e2cb28c3507ad1ecdf471f8
SHA512a5c1d54cd337f40d1b06ae513b39a763e72915df4072f5023f26e0e53df25fffe1c1850f19d0bb8c961f862f23e6abed9f141257949a26f0c4357b2860029510
-
Filesize
581KB
MD5425625c1352af64fc7e6645b87673683
SHA14aee44b6b872a2188d8513f00728c9cc1822eaab
SHA256df6272fb030a2468baa8e8b73994dd61418fd6cca2c723b30091d7d631c95c2f
SHA5121a87f282757f8cd07bd05b88993607dad2580b90af54597e9f64335c0e6ab79ada6cf7072ef3d047243d0bb5e3b97b88109b9034bb0bb7c9ab0dc2175d7330a5
-
Filesize
581KB
MD574ba55f4cef4b767895c1ba723aec9ff
SHA1c32773f16606eddbf633596d3515c359595ba8b2
SHA25680dfbec28d63909b1d4163ba08dcd4f648e9c2d0b9612f7bdda27d8fe9716b57
SHA512de360d197fd1f629c841749b87d52726761abc8b303816cf6c8962177c41ef9814db478d1c859aa29dc1fbe74c4eabe422eb2a8c5268b0920d954ef4803d1df1
-
Filesize
701KB
MD5ebed9566eb726c1eec336ae62840796d
SHA14c8bfbf3938064d0fe1499afc36cde2475d08918
SHA25645be1f0bba11eb4db4341e25e108c3dd6a13aac464487e8eb20ebab66c3cf739
SHA51202be5fcf139703b3ca4eac8ae5ac50ba4dc7f8bc0677a3b2ec708955ac36cde994e7e7916902f1d8a348c5a5b28c08964cb768396201437ef44e10bbc56fc438
-
Filesize
659KB
MD54cb56c5fc9668e0517dda69af3965128
SHA110e27088810221e9b514d0cc8e1a4cfbe7f1c6e5
SHA2562055f224d7d2e9d8200c220992a9eeacf263389d14b3469d09e734654037b692
SHA512c2628538e88564e0622718d6b132ea8cb3e04d5e5c2802a66093716ab5bf1770798fa351aef7d01ad956ad735ffd186cfdcaa3b524d879db41cd667fbd256f9c
-
Filesize
1.2MB
MD5bbd0c8a9f1524ee7b21277d26ca818c0
SHA18c40cdaffdc761fe9b282303fd78ba5c31d19534
SHA256cbbcc0f470514b0b2a78ba7a5187804729c19b11821bcedb747facfc117611f0
SHA5126532e71ce45bff38b532e203df514b7d547ee01b515f1a85d7f14d608a90660a5cfcd17d3ba51a30cc94d8b91894a00d045cf5f2c69dd7b29517778166fc04aa
-
Filesize
661KB
MD5acc71bd3d4a070d39593ba7d96742768
SHA14fc9ae0877854db2312de0f4cc2ee4143b10d30e
SHA25629db5861bf5a51637176019dadd49d600afa4b04e8a4819c4686f66081975efa
SHA51265a524896d137f15ee2523493a1844346dec4e860907d859b0b0f243cc728c950af65f9f2a6de9336be3ab4ead95dce2214c92bf5cba6db667c3b74b40e0d9a2
-
Filesize
1.3MB
MD5af6a800cfe36c7a90d43a83592206d73
SHA13f21bdc6e083b1a90fdeded1d12a39cdb479553b
SHA256912871cfd74101563c71bef0c22722eb4eaf15d7a31293606c8d3aa521600ef6
SHA512a690d15235cfb2dd5c583e4e620fdddc26212aabf1a7e40db053a039c2ab669f7abe26abffca53672994fcf0e19fe0b630cd1b61a09e1e31650ba631586bc7b0