Analysis
-
max time kernel
1s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
07/06/2024, 03:14
Static task
static1
Errors
General
-
Target
2024-06-07_45649cda909688286030d5e749624395_ryuk.exe
-
Size
4.6MB
-
MD5
45649cda909688286030d5e749624395
-
SHA1
638b8bb5e12a058325161275d12cc54a25e3080f
-
SHA256
41f0e614270f05eaeea2d314104a86ca9da344611c96dcb238a5e14238ca8a51
-
SHA512
107be58ff0284d24972610f28982f724d7cb0290bfb0fa9b3fdb6ad87a13604da8436cca3930f63fd2e7c1913234b7ca6caecbdd83dc4f91003a9e3bc61bc217
-
SSDEEP
49152:RndPjazwYcCOlBWD9rqGZi0iIGTHI6DOnIIeNxu6xl1aZt6m5xbzDI6bpsRJrAGw:t2D8siFIIm3Gob5iErOkf
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 3436 alg.exe 3476 DiagnosticsHub.StandardCollector.Service.exe 2320 fxssvc.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 6 IoCs
description ioc Process File opened for modification C:\Windows\system32\AppVClient.exe 2024-06-07_45649cda909688286030d5e749624395_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-06-07_45649cda909688286030d5e749624395_ryuk.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-06-07_45649cda909688286030d5e749624395_ryuk.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\c37a4b78e703f493.bin alg.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-06-07_45649cda909688286030d5e749624395_ryuk.exe File opened for modification C:\Windows\System32\alg.exe 2024-06-07_45649cda909688286030d5e749624395_ryuk.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe 2024-06-07_45649cda909688286030d5e749624395_ryuk.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2024-06-07_45649cda909688286030d5e749624395_ryuk.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 648 Process not Found 648 Process not Found -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2388 2024-06-07_45649cda909688286030d5e749624395_ryuk.exe Token: SeTakeOwnershipPrivilege 1568 2024-06-07_45649cda909688286030d5e749624395_ryuk.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2388 wrote to memory of 1568 2388 2024-06-07_45649cda909688286030d5e749624395_ryuk.exe 82 PID 2388 wrote to memory of 1568 2388 2024-06-07_45649cda909688286030d5e749624395_ryuk.exe 82 PID 2388 wrote to memory of 4448 2388 2024-06-07_45649cda909688286030d5e749624395_ryuk.exe 83 PID 2388 wrote to memory of 4448 2388 2024-06-07_45649cda909688286030d5e749624395_ryuk.exe 83 PID 4448 wrote to memory of 2596 4448 chrome.exe 84 PID 4448 wrote to memory of 2596 4448 chrome.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-07_45649cda909688286030d5e749624395_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-07_45649cda909688286030d5e749624395_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\2024-06-07_45649cda909688286030d5e749624395_ryuk.exeC:\Users\Admin\AppData\Local\Temp\2024-06-07_45649cda909688286030d5e749624395_ryuk.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=124.0.6367.202 --initial-client-data=0x2c4,0x2c8,0x2cc,0x298,0x2d0,0x1403796b8,0x1403796c4,0x1403796d02⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run2⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdadfbab58,0x7ffdadfbab68,0x7ffdadfbab783⤵PID:2596
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1740 --field-trial-handle=1908,i,10978239665798633665,13930590515878652032,131072 /prefetch:23⤵PID:4272
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1908,i,10978239665798633665,13930590515878652032,131072 /prefetch:83⤵PID:2488
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2160 --field-trial-handle=1908,i,10978239665798633665,13930590515878652032,131072 /prefetch:83⤵PID:3320
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3068 --field-trial-handle=1908,i,10978239665798633665,13930590515878652032,131072 /prefetch:13⤵PID:3600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3084 --field-trial-handle=1908,i,10978239665798633665,13930590515878652032,131072 /prefetch:13⤵PID:1108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4384 --field-trial-handle=1908,i,10978239665798633665,13930590515878652032,131072 /prefetch:13⤵PID:2996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4412 --field-trial-handle=1908,i,10978239665798633665,13930590515878652032,131072 /prefetch:83⤵PID:1604
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3928 --field-trial-handle=1908,i,10978239665798633665,13930590515878652032,131072 /prefetch:83⤵PID:2868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4752 --field-trial-handle=1908,i,10978239665798633665,13930590515878652032,131072 /prefetch:83⤵PID:3028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4900 --field-trial-handle=1908,i,10978239665798633665,13930590515878652032,131072 /prefetch:83⤵PID:3836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4144 --field-trial-handle=1908,i,10978239665798633665,13930590515878652032,131072 /prefetch:83⤵PID:5732
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5100 --field-trial-handle=1908,i,10978239665798633665,13930590515878652032,131072 /prefetch:83⤵PID:6100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5000 --field-trial-handle=1908,i,10978239665798633665,13930590515878652032,131072 /prefetch:83⤵PID:5852
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings3⤵PID:5832
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x29c,0x294,0x298,0x290,0x2a0,0x14044ae48,0x14044ae58,0x14044ae684⤵PID:5932
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=04⤵PID:6024
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x294,0x298,0x29c,0x26c,0x2a0,0x14044ae48,0x14044ae58,0x14044ae685⤵PID:1188
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1660 --field-trial-handle=1908,i,10978239665798633665,13930590515878652032,131072 /prefetch:23⤵PID:6788
-
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3436
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
PID:3476
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:2260
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
PID:2320
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:824
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵PID:4844
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵PID:1188
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵PID:2848
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵PID:4048
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵PID:5108
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵PID:2288
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵PID:668
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵PID:1464
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵PID:3208
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵PID:2108
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵PID:928
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:2124
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵PID:2540
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵PID:4976
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:5148
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:5232
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵PID:5344
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:5448
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵PID:5596
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵PID:5904
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵PID:6032
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
448KB
MD52a62a6b5d4309c18b58fdf0c35581a77
SHA167ae0e846656d5d55129b922a0c5440f9a5ef50c
SHA256fc38c847f341fa8819f53bb044e3f96e05c52f60a76e1bfdb3264153f6f2d1b7
SHA512a12f27d645a68fd0f909e2269aaff7b160f554e2771c1f522ab9ecc26397e0679d225d4f60395475291aaad30b1258357b1de81e7aba6b06d2577d7ce054d047
-
Filesize
448KB
MD590794fd73dd39165a7dd7f60fc4e6c1b
SHA1463cd30ee60ac8411b2f309088da13da27d64085
SHA256214fcee1d4ba2398f3af2ada3a642055f4d80764db47f990578e081bb227125f
SHA5129ce2c076ef04abfa76d267e41dc5adfbcb52021d46637dfdb1fd7e611e33e9c77f59ce6b5e8d3dfaeb96aa6d293dd2b18c9d65ebad69f0d61ac3e38c38240166
-
Filesize
128KB
MD506144ee542bda6ebd56c5e39db428b9e
SHA1ba4653de60e51fabdc1d52944c19a0b04fe93227
SHA256b6a3aa90b659c4af7d16500e11ca5d4498dba01657dc4ebaa1e68de3c88b17d7
SHA512dd6116f7c3202b088a0ae2d3ad7075b0afef8abe45fd0e748ddcf28efa7bfd9840cdd7622f9201debe3ad7234fe68788c2cf6f37b456c312bbe98102c9555ffd
-
Filesize
93KB
MD5e2a7ba7c6cec643a1f0dc9e21859cf48
SHA12721aaf5b54f2a9c21528dd6e3cd97c82910fca5
SHA256d950a169648bcc75c2f32b4310e6f656ca9d99a5151b6263d726ec3c6b2b0b54
SHA512fe2de1187319d75e96905ffe125e0656f0d98b7f42a5409e6fcfde362b2b74079256172e82713be62835013fcb11a7c6f7a0822fd56cc517228244027cee2882
-
Filesize
95KB
MD5f838603cf34743e180d3e4dee764bedd
SHA1ed11c54ac3fdd6ebabf94ab57b308e73f8272424
SHA256fa34bf648a8a8e148fe776abc8c4a2ad58831390ef726ea5138ab13b35f00326
SHA5120657b02541f781082247750cb57fbb13b9b9f5bf592303cb3863675def7500b8bf8e59ab397f74cc24510bc9550cf94ff895b4dbf7e8c9681097d8a238b80bee
-
Filesize
128KB
MD5f11e71dd376650fa63fa2709a2e41f67
SHA12f4d46bde0ebd869cfc204baebca35b954fa9730
SHA256a45c8e5b4dd48fa55d7e25764556ed8c81ab198243a3b739c13b5200ea0b5cc1
SHA512ce36122f77051cbf44c1b6d42249ddf223b8795174e49faee2dce60868c6fb4ef63ea426a49b853197b5b04464d94a970f94980e49d7bc51fc229c73711bdcf3
-
Filesize
128KB
MD543120195952037394c4aa6dbdaaa7668
SHA1bbbad53c49870ad1d9e16a4efa2c2b63c6e38728
SHA256ce6ed9d0ee61ab0bf1b8ed82cc6a619a5f69024a68b681b7819cc086b5a574e4
SHA512bd989a26cd4f1dcf42a791d2002ba3c54054ded9c6f69d2efbbdeb71d77abecbc8442b8b61984b9698b4039f3f0f1abbe69e15421cbf30fe9372d9fc80766af1
-
Filesize
93KB
MD5560b46ad509e608ffd5c5fdfeed58614
SHA1fadcb7f24ef3345900b4b3a3f423a8089e089e59
SHA256a7e647ae66ae7b2c157518696f76fff4dd633e398cc345354cf67f0b67df6fbb
SHA5121ce05f541be750b31dc97df2930be24bf20db68376c545cce5dd7ee3e50c9308819835e2cb6d215f4d964aab9674c2595f7fc8ca8455a8d500e464d6e9c1a29f
-
Filesize
128KB
MD5b59fa91d627068c616b74fd824994f62
SHA110c0334108043113059b3fe57b57299cf672d29c
SHA256583bb4dc3288f9c4fc6f8478078e12780de60eb3fc09e8430e217751afc4f1ca
SHA512fcb51cefbf4d65faf79705fdaacce2abb082143aea085763c0e56cf682aae41f161c9b0a24091de6273778314957c370685c794d62b15f0067dc4320340a96fe
-
Filesize
93KB
MD525960c48dbe2919dff6932d4d9cf49bb
SHA19e794c3cd254964e7363f62da34b2da6f59d8839
SHA256edf56dd912fe61af1f43416f641eae174fdd9d87bb079b9b717cbacf0759d6b4
SHA512ccad385612be182010e587665a3d65d8a69879b4cc41a4e95275c9fade1b3875717886a99cca8af23c6b2c6cd4bf87eda7d8a661a1f9d5c5bdec7b4573c14643
-
Filesize
93KB
MD5deda8c3f90d662d2799911ab1088c65f
SHA1d010499e9b1a2881439a91ac41bf5f0a3639b2ce
SHA256380a6aa35a20cf09c824c4bf854144f34112d51232075fc71d0362c609458f03
SHA512fb38c79a110b894508440dfff3d81cf01315354058de64af651b71a97c6551a72b3c6e097c30868c040c73c6e4ab30c606ab4232f083d2c9c3f00cc2b2882bd0
-
Filesize
805KB
MD56c3d801c38e4284b2cb56be17a8fb240
SHA1c67257a33166b760d70d9abb4f3e4fa78a219c0e
SHA2565164fd930258d97cb1e6c731e789ca8196f9cf17228f92de33254304315e507b
SHA51259871ca25d488880330a3a51e1ca9275f6c34b47b2ccf015b41b779122bd15922ead0bd998740214c701d31d5fde19ecd937145329f7a47f49b1f1c251f0c011
-
Filesize
1.3MB
MD5a9c0382a0bd17728b89240ae76e6ec5e
SHA16b7f6082ec80669a6ac00e4a82f17686f291c649
SHA256fc68c1a3595322f3591afe9a8bddb06725130d268dae082c5b526307928bfa3d
SHA512636313a00b8e9d532caaf217915e620e6fa6c661add2c1d47a436874f5fa78922dd74b83b7876032d41720413fdd14db6f6ecfa4e2a6e1b3e4f36e5e7a468972
-
Filesize
832KB
MD5aa5f2b0397ba6b8ddb7a0c0f9c114770
SHA1e843cfc3f6d90484ee0f6cab581b05f3d5e564cd
SHA256d8f93cc7d23e93219b9e22804e7b497d7240ef2f10a00187ebd72b9594fddaeb
SHA51246871767c4e4c950349e9bb6ba54cad065e6fbe92889968765bb49318b0f86df072a1abf0053c07e46da693c929a9ad5cf9a05d668cfcd1d40382483060be8ca
-
Filesize
893KB
MD5e1f4e1a98eb643cfd9e60f93c930bf92
SHA18aa2d4417e4e538094e75190449d2c9c872c2bee
SHA256f8cba7db274158cfe9f98333d3badb7f27f7074598e3c8d730ec4aaf48836bd4
SHA512449fe30351cc5bdc13231b54b388ec39f5e3477d8fb617f3e92ea840a92bd94bfc1d09c90672196c695d89ef3ab92c9c992da8e7871ccce4265e481a5f3a1e00
-
Filesize
448KB
MD50699d9607ba911dc802fdcd21e01b6eb
SHA1aef2e7bb36a2df97516606a5a31c58876403532e
SHA25697ed1883b92b744ff3139baaa1e96b40e408e6cdabddaf8a9fee176cbaf74f37
SHA5121c1de5531063012ba82c6293e39f228197723c9033af0a4d5d2f263823a79cf2742551a69b30623e6c4a712bae72935112165b2c245e4f7bde04f3612f80d41a
-
Filesize
488B
MD56d971ce11af4a6a93a4311841da1a178
SHA1cbfdbc9b184f340cbad764abc4d8a31b9c250176
SHA256338ddefb963d5042cae01de7b87ac40f4d78d1bfa2014ff774036f4bc7486783
SHA512c58b59b9677f70a5bb5efd0ecbf59d2ac21cbc52e661980241d3be33663825e2a7a77adafbcec195e1d9d89d05b9ccb5e5be1a201f92cb1c1f54c258af16e29f
-
Filesize
93KB
MD549f260b95e3f8f357e9f73890d1d3787
SHA1b5c6eed6e2a0ce967f0ea3f05ee84c74b80757ac
SHA256818929c6f3c0e78c048d45dce3f1e28a0605071b275b46a15f7c6f97bf2fa931
SHA51295581e253f128d5780bf6ae184ee1f0914ce23af845204ce6e343b2b8fe81ca2b0df0cc7006687f6a4ce234ce9d00e302b415e09b7e0e6e12a48f0e83a58c33d
-
Filesize
40B
MD5d0df793c4e281659228b2837846ace2d
SHA1ece0a5b1581f86b175ccbc7822483448ec728077
SHA2564e5ceefae11a45c397cde5c6b725c18d8c63d80d2ce851fa94df1644169eafc9
SHA512400a81d676e5c1e8e64655536b23dbae0a0dd47dc1e87e202e065903396e6a106770cec238093d748b9c71b5859edf097ffff2e088b5b79d6a449754140a52ad
-
Filesize
193KB
MD5ef36a84ad2bc23f79d171c604b56de29
SHA138d6569cd30d096140e752db5d98d53cf304a8fc
SHA256e9eecf02f444877e789d64c2290d6922bd42e2f2fe9c91a1381959acd3292831
SHA512dbb28281f8fa86d9084a0c3b3cdb6007c68aa038d8c28fe9b69ac0c1be6dc2141ca1b2d6a444821e25ace8e92fb35c37c89f8bce5fee33d6937e48b2759fa8be
-
Filesize
1KB
MD58dca6384c4dd14d9dbc263ce1d2003ce
SHA1e774805d2a99cc5c07b4881e2f2e54bc207b21ed
SHA256bee66a0209b52ff71fdabac1d193b4bab6aad1632857fb4c3147c4760cc35378
SHA5128a6c14e1724bf1bdd731a3118f06d411cfc2216a1a9189b09eef2fd71f7f7a434de6ab0ab0c75939bba5433e23a736f33e2edc52f4c0a24ebac8771908298612
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
354B
MD5e367724f35a1eb2d5e26ac44ff6221ea
SHA1de69713a9d69a3ffbaba5942c57b7d5c77263c7e
SHA2564ec53d7a8a1e361e0c710e8a07a1fd2ca11fac7c21c30c0dfba708f4d58b506c
SHA51214e7f4ca2c8397452d2220f64a11d09117c7a736e65ecb8c0cbc8069d665ee98db2c8de745d3ed75c9e83ed41355da515d258b44ade68194794c3a2bdfc3f0cd
-
Filesize
5KB
MD5c914d207db398a025afb92a6778afa9d
SHA118151762923fb6b0727e25b3289f39ffe846d1c0
SHA2563721aa98a5667b1f1587b13add13032ea7c70ffe6f4c0b44118c7a11691e9214
SHA5129796298f86632a2092aa835469db0a2611ea98a024a8614c4788912a4681d142340f71f7a3d35d17147d78e75516aae5422dba6f0c19cf83bc0e5e60307673c7
-
Filesize
2KB
MD51d0245a0816fd932b1963600bab98460
SHA182d188a3a5fd107ed83000e16e41e0d67eed941b
SHA256b9d8f68c1f5aeadb1748f8efa21c33a4235cca822bfdf19951d296b2f29944f6
SHA512febc999100ab08b73d52fa2a08f7c09cf2281c420762d121150da6cecc922372a9591619163881a5d2956cc20a7bd6d1b5017b6f0575b55ca6baeeaa604632f6
-
Filesize
16KB
MD593b113b906bd645e4122a490d551ec3a
SHA1bdfe14a68ef3137eef2971d7f734dfa1a862cfda
SHA256ba011bac3283482381def235abc7019e88ed6e6f532a7c995fb9c250672cd92a
SHA51264e70bc0fd67aa1f4d2c510f605f9b7e28d8b9c9a9382371d1f6c35a8bb9368fe58ac1d4e9f68019b49e7c7a5bcdf445f25cbcac3096ca8aa835ee970f069f61
-
Filesize
128KB
MD5204298116231f7ac479f7539b2d89cb5
SHA1f3322413a8869671d13938fb73dea85a3039f6c9
SHA256ef282dacfee77b1a96ed60e5944f8b1f83d918f7d578676fccdcc866b7b24f39
SHA5122c9835e7c5d29f3612f9859311cf994419bee4a0a7160a03c65b75f15383cd56c4ef21fd073feb1d775858d83334bc4051d3bbf9ee1a119e66283064974cd11d
-
Filesize
7KB
MD5c7f5c7df52f8fd0346e2cf8597d8c70d
SHA1a167fb5977930dc2f7e7d2847d80b12f821e8ae1
SHA2569af86ed3891825955ee020105de6f27bd016061988e2084ea65cda909d216b48
SHA512ac20585ee2a48c65717a34878d4d717a970a1648e47089ab9d8010c5fe89f8eeca2121e3ef6d37202f700b964ff2b8d7149b931dd8e5dc22fadb210f52b7d131
-
Filesize
8KB
MD54b6abcbd608db3f0e2e1abab5f65b11f
SHA1dc724ddd43f9d5fdd3d30f4f239e0e4777c0fe39
SHA256164091f564413ce1158722f6884bde63e553866a9d39af200bd918ebe16db1bb
SHA51236e9982bd46b3970c0e5f23f75fbc0c5f97b7e38488c691515a651c258df834556ab3817e50e5dae22e7f0456ed84684e5fd0bb359734e04b512d005b6206dd9
-
Filesize
12KB
MD58dc4e789b4a3526e113a9db2fec789de
SHA1b0f9cbd353985c297ecd3310a2b959c283b12dea
SHA25639bb264f4d2b80a79d944d08eb172e33314381eb414c1e73bc081ef9f2d54ca3
SHA5121bfe5b4533020af1a7df5fe204ac1c753989a3318954525d13fbf8c8d9fac832d131d26117bb70616118108bad15845c70c74d83b9e2a298506055d212dc7e3a
-
Filesize
128KB
MD5e6c8968975772d3288d125a94facbcc2
SHA180197a5a50660f3dd159a37b42dae5365d7e6473
SHA256df19320381de7909a6f2dbffc284fca787dc626cd0e04cabc0a62039119c626f
SHA5124203bf0b12f839cedef1effca5066c10e89d4bb8835426aae339bc0db1ed83df20f01bbe0c12533bb87de4d4254cf77429809deec1005f157f5e3997247934c2
-
Filesize
448KB
MD5a95b32966a92ebd3610ad14136e0db85
SHA1331fc69d0144ae8e692cc90751456d119c74ce06
SHA256d5c92a4b75f3e7a0a58ab61ce9d093e2ba78a95b1b81478c20a8c13a019ea9bf
SHA5126fca9985839299d6b00fab6ae80c3beca0b196b09f276b6cd55a47da02ce914f5317b0a82c3f36b382709e4c6065ade9b463d617b02e24e9acf49c6cceb0754a
-
Filesize
534KB
MD51cec7da7e04c26f11071369561310046
SHA1b3b5afcb67413232ac1567e5c8ff462bc31cdfca
SHA256bccc8568935082530b78be8b8e6fc5cd18f677e11fd887ea1a28a311f679c26a
SHA512d7a417ea92e7718c1405d465e53476cacc83749dfb407689b09c550e8f7dd7171dc90375662257205f800eea839f9264455906c7bdc54ca485a5f35ac6cbbac9
-
Filesize
448KB
MD57a585ce41dead919be8be5410a0cf412
SHA13d3345596787fe053e27d1edc2e6148b12f63295
SHA256a6df0e1e77dd6b6a2267b979e9429e6bbcc83c946701df4e682d45f81e77b223
SHA512d50f2b5432b1416667365694809a213b657e949b26e4d30ed35fe0ad34aeeca656427dc74d19024d6e2b6da0684cfcf92f3fae2ec0ead78bdf467d2d5be5cf66
-
Filesize
128KB
MD5ccafb0abe8dc06b1dad03f9e29bf076e
SHA14564ecd61d4433cc54f62f6b6677234b517c61ab
SHA256f3a4eaa9268970211e1c6d2042820c07de77aa72fdccbfb30a25d2c5270058b6
SHA5121c3ec2e9e10ec41824ea9262b4565d8c7076c91eb67a45dccf0fd22ffa64e35a3e39190bea6dc7b3c4c0235e10961747203d1a498ed2b26f320e6db6d43171cd
-
Filesize
128KB
MD5d20eb194c4778bc486dba8c4a2b48237
SHA126572ccc061624a2c4a374de727e4402c50dae4d
SHA2560a5ad70cd886e18e6f6d0715a67be02bc056f3edf2dfae87e0511f370754e6b9
SHA512054050c83cc98e8c09b190b3f54f24c0dd13cf046a7ebc2175b5a5d20e6a8d436f70adfa820969d8595e4c66f9f26619ccc8744c0f46e015f7d1b2f99ef9e8ff
-
Filesize
128KB
MD5b150622410f219f8097a40586b2372fd
SHA1246683301e2ddd865451246fe2371e4acdb040be
SHA25633e1d95c363312fdb4813808acc99558107ccabfe3a0c463273c3c0075eff4ac
SHA51261191a980c666e208bc60ae8343a180d245c819d8a65014ff3d440b922c2ebde79758311f2f7d6f49f97b7dc3f0938e6fb279b3e474966ebfaaed2d4a5bde751
-
Filesize
128KB
MD54ac82cda34b40eb1117700917703ed9c
SHA13489893e2c3ca73ac072fdb80f24b009d958f445
SHA2566f1d6d5427feda32e9f5577401fddaab0cbfd880c77928e49800dad75cdbf723
SHA512a91eb52872745b92491b9c6b38ebd89949658a41b80f7be5a5907d4dabb0a67a2a6c53b5f8d66688a05bb61e91911a68b0e249455dd085ac6f9b74917839d2f1
-
Filesize
128KB
MD58023f908bf3424dfd5b6c78bfcb36d0f
SHA1ee1bd0684003b2cb15df36889631eeaaee09f19a
SHA256f1496b2f6b35f25f7d77602a60e4ec237c7528a5ff137df2477f681c2eb69368
SHA5122cf58253605e3cdfff414f4df2e87f5c54c24498665399241f242b26d2934d9350ed41299a09f31714180500b570f43baa3f197e3858d43c944d35a6f9555ad7
-
Filesize
448KB
MD5e5a67e1fe6d4dfe6792dcfef46bf83db
SHA190cd4d7161ea2180d7c0dc9631d0dd9cab662299
SHA2564b0e8814913a3198c3caf8d7ecedcae91e5b582bd8089fb8d51c47667050c7cb
SHA5129c8cfc4e97d4b8f3b84619b1e813d41d79e46d4f8c163e26b9ef379539ee1b0e43045d0bfd6ef3575e3f3666253d4de66d6ba4bb0c8d39e76f40bd012716b4b2
-
Filesize
128KB
MD501fe83beb75f74a59151a4fd919b77a7
SHA130cd1bc6b6ba121427d5f20eeb6320c61c4c9aa6
SHA256abbf8e7f087b46f908a9e7417e9e5f691ae390eca28ec7a01b711347abf85a37
SHA51205a448ec0973fd7d61090b3159a30751468157c8e869a235e5c244946f68b22900e873896ee55bdb54f2fe792ef8a634a1bf2f3481ae845b46906546e368e39f
-
Filesize
128KB
MD5433ef7cd43267fd34331dfa693dd4bdb
SHA15f148100ffbf39330e7560682ab483ba755fd4be
SHA256e89f87f4767e8227f92d9022e2a7c609d3a096a8283a034eedd9d0bca35e0ab6
SHA51273af8152a38e89318b0bb7c4f34caed0a84f815c03536abedb2d598ba0710aee8bb03c6b1f27d14223ea33323182737682ddf07bc964b10f01bcc9219c3a6587
-
Filesize
128KB
MD5809e77098cd1b424c0417c9234041f6d
SHA12bc56804587540757d8eed81f92d93bfd7d2ed74
SHA256a27597fc1f64d1608b559507086bfc6964b6eec887f42302ba1b9218faf3563b
SHA512c56e2d2d286886f1911efd48c06113b6965c63e017a0434b3e6d0a5a76cfca1d3781c99e185ab7c282a2701cbc6a3935469bf890192ffd218961c3cd6a60a9d5
-
Filesize
448KB
MD5f1e9dadad5d77e5cdef73b3281f5b9c1
SHA1375bb5d9d0621307d7b72614512554e7c1f0a9f8
SHA256bea99f86f078a91f6e489c447209f65eb2067e0a36c42ff45effa7e21932c6b1
SHA512fe9c70de1a32c67bb2a57b417cb9d7a2bc41d345d2e63f027832213370254df71ea066ceed7964e7e33b87c11ed8dc8eab06c4f46335efc3ab9ea4eee7cf9f2b
-
Filesize
712KB
MD5341003973c51130a469a0d26fbed9c7a
SHA192a60f338387bfa32e48a342367b22cba82ddf47
SHA2562c2a669aa79446d31b0c54269603033be458053f9276789bd3839edf204980ab
SHA512488df69d1e483fa21c41adcc7f0d8340eab0c7f5d930cdfe2de3133c5482eadf551bd32adb81c5c24166b11b891ec180f8fbbcbef76f7cafd52f7ae43f9fa13d
-
Filesize
128KB
MD5e9d19b00f5a23a911233946f69e72320
SHA17a21a9848d70ff4010c03dba5608b5dc6ff2e328
SHA25625d5d8ae61738e49bf8d34bc8af4f567036e929d4ce0d048a85ed26aa745f8f3
SHA51247d9c8ad5ca22ba5f0221d21519881184f373b8e060e53c8e140d1c0a8a3137d4f310bb0040d62a06082c834f596718c52addfb08ebca280df847664603a521a
-
Filesize
128KB
MD591017478038c9c0b11c68880c87119f9
SHA15dcb1f02f911246297c84b439136fd08e59291e4
SHA256922ab11c548ca70f7e35aa0ab5232a65d14141885830d1de37736996b4443c12
SHA512856cc52f70fcf766bcf0300e94e15d629c912f99a86df238f0aac4d4e1473d7a46181dc10a114d1afd56e5caf620fa2d8f2021c225293c1a7fe06a4fd840d429
-
Filesize
128KB
MD50d344ef4956c5c1507e01619ae4839dd
SHA1a1128d28213a610496dcaa9a8eed3268e761bfed
SHA256122de61ae0586c8c9beae5342eb782ebff7bd1e798186b06ff2e65d54f5c77cc
SHA512f3681d677f1ed2c6590ce8865d71a51afbae72ecb0bdf1c1c7cd2a6e966ba3aefa106a24b8dcb3fe4f4ebdc3270c85fff5819fac7e4dc4c0b8eef9bb05d70c12
-
Filesize
128KB
MD5b1c7eddd99255a64ee123aca740f9c36
SHA1d0ff1b80aa92ac0610e5254e916966bc4bcc3c6b
SHA2561437a529e404abcd7789424210ece04a2368bdb5f0e81448aee7510a990e69de
SHA51292cc30fa41d676edc1770cd35e020b4cc1f436fba5508da96c2c283a74cae0746a940dc94e1deeb1919de35a6d0c230f016ec93b1d72162a3ad8f17fa30e2b4a
-
Filesize
40B
MD5dd7a044bb22136e85285d21163fdef66
SHA11fcea0d904998de1bdea9cfa654a50c20b3dcc5b
SHA256b918a44d48859b4ed705a9a7a23d4a816a368aa2161ad495a7a6d1c6992b61a0
SHA51267afbad0468b8d5b405186c63a0960f5fcda15b2ab73767c292863e221265758001b2e110a3296f5d2ba1463863d556a535850a65a107344ade40a79c33bf358
-
Filesize
93KB
MD553ab952937504801da29d2255d048921
SHA1e8d914fc86936649f98d8b05dd357baeeebe2c01
SHA256395aa0847b19e672aa88dfa5e38a2b2f37f91e62961246cbf0dd2453a28f6bde
SHA512cfae37a6993faa6240127fe3b5e020e20136d75a972b97a6923afadfa35859c75ff9b684138e12b06c37a4ca89bc71b2b8e3f3cb8fe8a59ca832de78fecdf89e
-
Filesize
448KB
MD56e3e2c9742ee3db26c2da9f4075a553e
SHA17d3996abfb09ff204988e4f216ff5261a3272547
SHA2565b46ce132e9c51c8ee45101999d1e0ff57f547e3efce52ea603accc6f460fb4b
SHA512fc0a849ea959a2e8648bc71c8e48a55310840d47131b7e92b7893b8a017257da8b419bc474ab239f99fcc225981e6e6d5528cb9a1bbff19c84acd3bfb05db0de
-
Filesize
128KB
MD5f82af64aab36e47a81160839e87300e1
SHA19aac62c02a1655c9108845b240550b3db883e923
SHA2564147389e2d0bd4d5806800da1bf7ac3bc61bd7e40560704e17eff69d27eb3e15
SHA51275d24500ccfd9b35928ec68b5c8985e28c7c75718683b7184b56eae0f2449f3d289d8b1f11833ca0d9bbc9ea3823b594249596911bbcbeb6d018f99d01d9cac6
-
Filesize
1.2MB
MD5a2482e0148d3f63d61a8529ed9062e2f
SHA1c3cefa6481c542f03424e05b1b82e3003abf26e6
SHA2565a3cf997a2cda84a1cd22b0ee1eb6b0a53c5d482f62203965be6bbc76c2fd8f8
SHA51267657f69617bb78f464329c5137d4ed4fae30e4da8ad45638501f89c2f5b67273e8a1792b5cf3b17fb722310dfc961695b60b225fd7e6baa43528c3fba9c7649
-
Filesize
128KB
MD52c694717b37b1308da312752a6e0bdeb
SHA1224fbb2adc1223fec51700aea56cb07ef797b423
SHA2565a0a3b5e5af7900418528b5870bbd29dd85cf4d90bab259b983ce26fba0aa349
SHA51251acae10c455c91a5f803a90e51c7c834cf2cf0fd35979a9887ce3f2bb3f913b3c7b1c7a2934a11fd72106f9a949478f27c8ff65d56ef2ac8919d4fa3d09dbac