Analysis
-
max time kernel
136s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
09/06/2024, 10:31
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-09_3d597d75f9e7401d78b2ea691b6c0e66_ryuk.exe
Resource
win7-20240220-en
General
-
Target
2024-06-09_3d597d75f9e7401d78b2ea691b6c0e66_ryuk.exe
-
Size
2.2MB
-
MD5
3d597d75f9e7401d78b2ea691b6c0e66
-
SHA1
4fcd65082ac136c8205576a3c4b1d58983be106d
-
SHA256
2839431739ce270a678dbe2149807945486439372f642a39fd5642e8658956a9
-
SHA512
0777cd8dcb281adb537f3f28c58381258906ea2e5da455d4e4508d3d89a3d6d15bbba1f75bd43a6bc41ab9c1b77e77bb5623976644c6b149c69efc39d3341910
-
SSDEEP
49152:eOOh3aN4huLbegmtGBjWWCITN4SM8BFz5:oU4hu/ctM0cN4+Bx
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 3964 alg.exe 1812 DiagnosticsHub.StandardCollector.Service.exe 348 fxssvc.exe 3580 elevation_service.exe 4784 elevation_service.exe 2272 maintenanceservice.exe 1184 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 11 IoCs
description ioc Process File opened for modification C:\Windows\System32\alg.exe 2024-06-09_3d597d75f9e7401d78b2ea691b6c0e66_ryuk.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-06-09_3d597d75f9e7401d78b2ea691b6c0e66_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-06-09_3d597d75f9e7401d78b2ea691b6c0e66_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-06-09_3d597d75f9e7401d78b2ea691b6c0e66_ryuk.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\a18b6dfde703f493.bin alg.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-06-09_3d597d75f9e7401d78b2ea691b6c0e66_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files\7-Zip\7zG.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_110750\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log maintenanceservice.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe alg.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1812 DiagnosticsHub.StandardCollector.Service.exe 1812 DiagnosticsHub.StandardCollector.Service.exe 1812 DiagnosticsHub.StandardCollector.Service.exe 1812 DiagnosticsHub.StandardCollector.Service.exe 1812 DiagnosticsHub.StandardCollector.Service.exe 1812 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 664 Process not Found 664 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3200 2024-06-09_3d597d75f9e7401d78b2ea691b6c0e66_ryuk.exe Token: SeAuditPrivilege 348 fxssvc.exe Token: SeDebugPrivilege 3964 alg.exe Token: SeDebugPrivilege 3964 alg.exe Token: SeDebugPrivilege 3964 alg.exe Token: SeDebugPrivilege 1812 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-09_3d597d75f9e7401d78b2ea691b6c0e66_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-09_3d597d75f9e7401d78b2ea691b6c0e66_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3200
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3964
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1812
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:1792
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:348
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3580
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4784
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2272
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:1184
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD54b61928ee509e1cf23d536497e5ca501
SHA1dc1283ef20721ea5c80e8bc94ce0317a40fe6ff1
SHA2564fa082efa2ff8b9ed7d74603923b95153b4790499404da029b20b0d031311708
SHA51203dec8e0e218878a89aa72867b3dcda1655fe0287200aa3eff32eb017700256378d200f9d6156fb3f4adb72d696644ade78d6228831f2b09fa097b7f954e6cfb
-
Filesize
797KB
MD58d9534010bc4c3151f7ef5705908510d
SHA13fd3ec0e2820f9f31d92cc805a863a0e8c7229a4
SHA256b3be417fa124dcc991089061f3af0e24586215394cd6fa0afa28dc3919c8a728
SHA512d453c71d87477fe45f4d5ab1c4f7d1c48e293f3babe37a18b3d6171cf449ef4d74dd770246ffd8c1d97cce88d6615f6dc9a9a242cc56264d845e07366d15e3a1
-
Filesize
448KB
MD59a33cb2bb92d18d70f16707002d6fa27
SHA1f3c7ea742da1cd68b6e88d1ac0480611e0f785a3
SHA256833b2cbe8718794bd746d60c1b1bd9ca64509c6fc1e3402e601a2c5b067e9c81
SHA5121a3f9dff5d30b2602e4843487d1b7a617f5c08464789d7145ced8b0cb61558d5ccecb0383ac22ee5ca35526a3711d13d27973ff709c2d5add7585a111547b6f2
-
Filesize
448KB
MD5321373154875d5401b0291fb0ac982b9
SHA1fe93601d89a01006beda2c4dffb3778f6387d6e2
SHA256c29484b0ec0d9fae2e9c7397f60d6f8fb4ec1e72a589ac21ed6551c299114d4e
SHA512727a8ebf091da6ca79ff39fe403c1f488fbd8b5e100e6c3d2e0100d2e5614f08608d852f6cbab4f3750b9343ea79443d79a55cb594ccf33f97cbf7f62df91857
-
Filesize
448KB
MD5163e2ffebe4c4d8d9dbd2c6631c93d85
SHA1dcb019bb89b8edb193bc772b2149e0be69f1a757
SHA256021d5e62020b4b7905e271a7009fd9da50b00ead14841648c3e75f1da79ee988
SHA512232382f4e66949fa08eb5fe72764e445fb20c6a9ad9dbaa41cdddc2096cec5456baee8d54c20fee33ad18a188b24bd963b0a23349ddcf111bb596102fdfdc156
-
Filesize
448KB
MD5edb81b3f594dec586fe299a54e1d7b08
SHA12456d7e3e438c27174c902dbc45069d6740c5fc1
SHA2567d1e65229043d24a8ec7f97fa5a868173b088f195b9b1a26e8da6c41be7d18ac
SHA51288eba429d36efcacb07696da4dd0daa8d9d514086a7bbb6264d437d06f2fae3d61aaa3373f249f26be4c0974ece9760d4e810fc7e7525d4175e6e26c16395619
-
Filesize
448KB
MD5383c3c0644dca2f85f381ebe08a8e08f
SHA177755eb937d82469cdf1131ecd4d5ced0bbb6988
SHA256acdcaae099a09d1c87af3e9b2ff6f8070083bf7a3e0faad65335de03a8be5ebd
SHA512c56f7c61c58c70b22f3577b78d196a7fe0fb54b9379a4a51b41262d5e476554a78e2182b953119e2a41d9da3daa283d2c4d37421ff7a6d53b18bcb81ed7f5296
-
Filesize
448KB
MD5340e92189e16c6f9764c24ad2822f588
SHA179d9b568a50c5f1cb1f577dd09ae8fec9761f391
SHA2565febcf1374907181697f6735acd1c9a896647c4b80ddc150d0186f8764f2e91f
SHA51253c1da58975714030403edbca83072a2effa22b80557c0bb492159e2f862d3a0d5d58d6575f11adba831fb2e7474663c8cc22fb322e5b2cddd0efae991463e43
-
Filesize
448KB
MD563170e438ff0556976bf18afa73fafe8
SHA1f34e1d46053dcd61d618644ee263e35a078b2aa0
SHA2564994ab3f5341a43a7297bb7ed45ab6c87e81fd620e6a30e5fee916340d90699e
SHA512469d9bd8dd8d953b560e702d45715c6dc0d6fecf44109b077dd50bd7eebf83055501b13672ae25eebff05f5609099afb563dbb93607efce2b6f922dc80254913
-
Filesize
128KB
MD5d9c99520b457c94d5c3aa2b7454b647f
SHA19d1f5c037228a2e1f85286d61daf96cf84bd2f4b
SHA256fa627a76f2697a4cc950ecaf74f26df95ed1e2ab906025be2202e64ef3d4cb6b
SHA5129b1422ab5035dc798e8fbcbadf7e59aef8c5fdd6a3a25a58e405a887146887418a6be3d39760015cb3388d55edb76b47d1df41ac38dd8f4a8340340ac94dc735
-
Filesize
448KB
MD58b43f4e4cc0965c39a5013eee476fbb7
SHA11eb439f24cad65b6bf49daada60eb8667728546f
SHA25659dbaf1044c8818dbdb1f8b95f633a2a575380627f8141a1748af1327f0b7c13
SHA5124084930c48be052e71ba7064d5120e83d67a4f8ee35e7e7b049d0f2ec4390d2beeb010621843e75c115e60e8972953a02c36a165a9c53b89117f3fa0e50a74d4
-
Filesize
448KB
MD51ee6e22081b8d1dbfe59376a2d0be727
SHA17f0e0662aefacc86cf7e381f7c1e1841a3c24bef
SHA256d0450e2b501a6971b274316c367e60d1e8a95562d018f3f59008b2967c332381
SHA51254b324306c7d5ce77137d0c7f7bd738cc856583f08dedd6e7e244cd30199483ebbdf3a1eac2d19c23d720c1ae783ffb1308199b40c3027a9984ca2145a5577dc
-
Filesize
805KB
MD5b11b5de04dcb1e6cc685d13c70f24b28
SHA1d3df2c386a7369a6849b2e8002d23bb1b6bec000
SHA256dcba8f0ba7696150b0fb055ff62c9dc61cbabcd59b7f7a8462b954725c073e77
SHA512a7339e0b0a2fefd944422b1d0babfe9da9af8ad7ea84768871bf4fb921499748c20ab79071f220bf7fde5c1885fe16b90b65af61ea388b6c44a324f5d11b4dce
-
Filesize
448KB
MD5174018ba4ed7d4f4040081ac5440bce0
SHA1a5ee71326d57d1aeb0f8254a202bef0c945aee56
SHA256905ae7d8b92079abfc7adfed548cbfd31c965af4074847aebe8e1f1a8f9bde85
SHA5124806128551fb222507a0f4ba04824feafebad6b199a2dae8162af7332a547799e59fe542aea22ba36d3bf51941b970c746842ea4cbcc67a534697563533d6ef5
-
Filesize
448KB
MD5e7f133d6d40f413e7f8f1443315670cc
SHA14052879d1ce26c3446ea6c492f9211e5c1c17779
SHA256ed2de836c1654874fea5cad92d74aa5e9dfd71b182f071d621026a73afa0b848
SHA5121883cdc38b1e39306c1dc1cc4402da900f743749014f8573855f5db3f1856810f70d69991b9232c1b8ae1e07b5a593e9aef2e26ffd9aa4f53918d5395fb0a90a
-
Filesize
448KB
MD5c8d43e6722e60036524e606fbc54a4e0
SHA1fc44fcc79b14961872449064bf821d8022bcd894
SHA256047872f56ca1f91c9bc31fb3b4d421f36e6ea91c34be405587a0221be4d51f50
SHA5122da2b6c119d34394864f6e3a39a560a89e8ea853581925da0998d85243b7dc35f217692e1aab208cfe4983abfca9a894b963cfef0c49c20582f1407d180f221b
-
Filesize
448KB
MD5e44898547de568f38ed9e108345edd9a
SHA128d95cbe394977b23481c5bc85f7b48de7e189bd
SHA2569e01f88991f387d3911e0f0ec98aa8332e5609ab1f9d93cc3d69fcdeb2b14a3b
SHA512a3044a7c94eac2b39497d1ef23c77fce2e7d0c66d97b970e8f83d9d5f66073f516bf5230b6a67cee0b0515c9ccd1aa671a40769d273ed331d80354b2e112d132
-
Filesize
2.2MB
MD5a0dcbf28355e8d595a693f3774aa1bfc
SHA1595a1c0bc5788b5926b613b22d9ea125c8cfbdaf
SHA2565f4e92855c182fdce969e4c15e2e2d9d6aa6405ddebffa7e968efbe9125e90ea
SHA5121d2cff92250738bf222d72122e8017d1b40dc3be6acf67bbe5a8de41218d76dcd6edd24cf713f788874ee13bdbe46cedbe293e4dbeec4b4882bad5c601043aa1
-
Filesize
448KB
MD593c738847fb08f752b1654e8a2e81e1e
SHA12c36f988bf9594b1c0a6c39c7f30e2fe18fa7562
SHA256ba90ef905ab7582a9e29288a7c8462beb0d9e1387f1ff9ae80f74cc57e27ecd7
SHA51265e86fc7251d9c4832902e8611f9c684f3aeea6c40192c6026e6e39ae3eec7ede2103f5286b66e89d9e9d5131f87b3e2e63e2965f355f65dc3df409ee29d3a4d
-
Filesize
448KB
MD526c0da8bf455141c25eeb17d13147f4c
SHA1fee96465518221c8db18c879d3eb8b2569485b0a
SHA2568a6498f2ee4e3ee02338fdf74722a97d114cf04aa44526cdf2af7cc0e6e02883
SHA5124c8b3545fbe2198ceb6b911da9da328795075b0e7b13e5a4e1f788cafd301a105eeef5169852989a45f93807fcfad8692d676d167de45a1ffa212ceeb37df035
-
Filesize
448KB
MD56114affa5b022e5e4da58231e03dd59f
SHA14f6efd3ebfcf5e36943bb0f3a4ce5940a10ecd10
SHA2566a05bb2c0537d9ab127c1de7b85fa8401d92260dc739423b9ec0ffce1ed93bfe
SHA512c869189459ecf1aadcf5b56834f68af33edbc5a6eb32e7c8fb772039a83ffd96fca100a82c2bc00e3805043c7891161bdd777dbc9cde8e587f04d6481071300c
-
Filesize
448KB
MD52d3565a82c8159d0aaec06f5dc18d864
SHA125ede7e2b00cc6b1eb97d917a380598fe0b1d7da
SHA25645a40a08797515e6eae9843ac8d4c797eadc106b45ef20d5ee712b1fcdd8d021
SHA512c487ab50287cd48a824e03107d3264c994ef1b139b7ea5bc1213418be7acc79e4a91130fe256504fc116aa9ddc925d0c25d7476bfbaea8e529ce665e38ebab41
-
Filesize
448KB
MD5781034132420c5ed68c77aae76a5e3a0
SHA1196c539655ade8421430608ade75424fa84d6db4
SHA256b8fe8628b11640a12cf770bf4a5291f55039d238d86c8d08215cabe8cce2be15
SHA512b5c907c1a3625526aece6e9d0b5dbb2f7926dfd7c738d8218fc8d7d4154864fa44ee8abe241ac2722dcb0752600bc9edcef749aa09aa14cda57a277311125784
-
Filesize
128KB
MD5cbe90a6be0b6cf4e750b16379186930b
SHA1271850395d0c7a998964c824a505e52af88b12f1
SHA256c7c641341467450f90889071e16aec3150953281591e7033c4effef17d4baad7
SHA512a945f36eda8947cef89895200e58f9e3084c07ae8f54aad9b06022433beb2ca54aa52680f5c789de2be5561571b2fb392d86b282bfb023685cef3c9ffff51b2f
-
Filesize
448KB
MD5ca07823369f412b6c5290447997d8240
SHA1d8bc1e4979f1cc423192e28f7257dcdc8b0c9da5
SHA25670fd7bf7eb43d27ca1f8e143488a49a3ca0da344d2d79758cf7dd5ac1757ad4b
SHA512fb7f7b67326dd2964baec878ce92eb515a2b83a3de8a721d1804340bd0daa5deb292966335bd0aa86866ed041b78e84e1429bfac02c9fbf13563f03958fb15a2
-
Filesize
448KB
MD559d4a26e493018ed25635653da85716f
SHA1c39a15fffc502e50a31764b6a3e3f4d08e38cca5
SHA256bc24f6e2815da643a6b326f8a99821bbea3fadc1f757a01a5dc37814d987800d
SHA512846b16b32ff07a1d1152f295065cdfe9c6f0e7c8c29d912e274431e5ee028e5544309d92483907f507e026181a2bfc59d9e23e50008360d7b2fd16fcdc1beb32
-
Filesize
576KB
MD5b022f6838cb87f48f632187cd16f8f69
SHA1b278a2a6911fc66fa2fb216e354ed64e825e98e5
SHA256d6b0f94f474e9766711528c0d22f41a567370949afa3228d1d22000ec1f6846e
SHA51296a74857cbd0d811d1eda86fa1b328fb67860d2d1c466bd07703f3775b13cd7516e6f30fed88a130d781707650a445da8c39d6316565cf88ba5236ca8b58a781
-
Filesize
448KB
MD5872fe7a861fa984a721122a3b4b14676
SHA152f7f6762a1648be3781800f06e0376d2b827d95
SHA2561c7306d207bafb7ab20f305d2a021683f0538c0bf794953b65948ea558fa446d
SHA5124f694998257053894a3da24c1dcb65cc4cdfc6b8d75c29e1469b04f5a49c49468d3d03b0f24b2aedcac959014c2f502dca89e7dc10a89c72becb4d20454f7cbe
-
Filesize
448KB
MD52a96c62fb5401261b352af4a516f75a2
SHA194364db48aa195124f9cb131f1e7520c6ae065c3
SHA2566f29b65a35baeae2003558206b74102f10002ee62573c492045966e6176b2715
SHA512edbb3c5510a4aba1fefc869ca8bdb71ae73cfbfaa5291775c0ba76ce2059fd1bfd581efb439ccfdebb7cde63c127375343205a26243e3aecba05b6d2126ade27
-
Filesize
581KB
MD5b10a729c547355559a5de42405346cbe
SHA19706a2e03c3638e4d31f5c3eb8d5eca89c09a5f7
SHA25680c13de1857dfcfb2badea8b241f18d0864fd2aa4676756bc2eb8b67e38ceb43
SHA512f229d87e33841d177cd9e33be9664a3c98ded765da2e3e1fdabe06e86e3367ae69f8a44f785fd67e48da9696bbdb84cc107e4a7cd6c6e0eea5429f43f4ac5f50
-
Filesize
448KB
MD5c2ee37f39aaaef9bcfb93b595b860627
SHA17059f657d6b6525f9d53514be373b7b5f4304277
SHA2569e51d23e6de8ff0fab29c709579e21d8a1390852a2056dfefb4c076e905151b9
SHA512862f7e7dd06e7a61b76245f8171ff9f4223cbfab346b502bd1c22533e525b14151ef92c26896de4e8dafd53d72613ff4952d084880d8537bf55c72a898d56934
-
Filesize
192KB
MD5b40ee944c3609def3b5887e4d941ba8c
SHA1a645a5cbdc29affab77692d8ba6448ede5d17e11
SHA256c67c6bae1bd2cf26964bd4a3cc2f5d9c5441ae3faf7214343d2488d4c2e1f03c
SHA512524af25d503769c71f8c68b38839060b577306c0bf3fe3eddf1cbfcdbbcc00f37feca3df73ff202f0d4c14544a2b594172a50a0c4d1e1fb599752c9afefbeb3d
-
Filesize
448KB
MD585aa349454c5f4e10d76e01bef197b30
SHA14bf24659479728036ed80159cb56511f6a04711d
SHA256163291b3e3de2e52c9e7f61f09a2a58a1f27a66957a3190c58afcd6fe8f2139f
SHA512143f31bc110da89f3b238d39bd39087cfb0f5cfe6eed4409cb21a05fd2f57a79249beaed67613a37f6be0b14c35974ceb2688f79365549bdbdadf0c9449493a2
-
Filesize
448KB
MD5cec18cfcc661dae14f26f28872acc66c
SHA1a8d4b092acaaec7e57288c9db927dac4b0a442b8
SHA25685abc8eeae8a10aa054bc74567c1226903c49c9c8765359f83cc35cfb2b8ca79
SHA512466936989233fb08d7f985c178bc26527bb96610d9e7a6473c2e64bea2bbe5e1d0fb374ed67d1e8ab50aad44f667f2ac45920468269460484f15ff5ef247211e
-
Filesize
448KB
MD52d9b6ec6c7e17f04c92dcb796e75a8a0
SHA17249df76ca57e71ff697420a408fa8b4cf9609d0
SHA25617640eb17a77845fc3d8522bc8225c73b45b9c125ca57b85684214969d5481e1
SHA5122ab923c858e03a649de6c74ff73e9da270e4cf94831b91319a24a20a3c42d3726e1f6eb5a51cda0cee5374a05555d35ac01e84931b4367727cae41d872ca6205
-
Filesize
448KB
MD5f10b4b1aea1bebb9a802ad5f4035a384
SHA1f9ed78a52b1b9e9667cfcf8828caa5d692e12f53
SHA256f28304ca1df2764987275b5ee7282bfeef234b490ff8a7f53d95145c66239ab3
SHA512e059ac3a861f1da33c768db8e1fe5e8b34edd5f34249673da195542c2d3cd58da516d10fd839a43037690dfbb96f8d5aa0ef7782a5c6041b5a6626d708025e6b
-
Filesize
448KB
MD593b5dc95ddb169d205a76866b10dcb4b
SHA1600a368c06b963d8ac03274f8c68d790c672216c
SHA256db54e06d5aff0b1a9386a663e75fc859a7ed71639aa040c8f416df2fc895371c
SHA5125920df7c43fe136b06e550de00c202e5ddddf5fc77993574dac6e5cbdffd3f08e5caaefd66c8d0e90d886a30f8261b3397a1492895160c9ae2da76113cdd1c8c
-
Filesize
128KB
MD5cebc1d166923b2433f82e547c6675441
SHA160a92e6d438a52a750f9e7e0561c3e827f3192d4
SHA25646ed32107b6a05e3bb3ccf181acced3cf163e07b0c0ee9d4db61b454247e41a9
SHA512e74d4488bc4a84c11c66401f51eaa6f07782a99182ef360b1822bb68cec95a91fbfaaca46c6339a29f66f429c229fbe6ec988933120edc61aefa33f9bd477d9e
-
Filesize
448KB
MD539872abac8a86b5a366fdf256d1b32a0
SHA1acd0a79e810457d192020564453963f2581e890a
SHA256b75dff7b136e8edb8b444514b0d06defad6f018ef822b3889feca98dd7c5fe13
SHA512921a332911cbb9885245c0c22ea91ec8abaa23214e5a1e72210d6ac7b286d81aa95c6e71fbf1f9729216d66a6002765b8cc9b9c4ee148547a45d16f0d320a669
-
Filesize
128KB
MD5eb37f81f6b5f16bde06d1d81f64064b7
SHA1d5e97a8f844d4ce5ca11d5e6a50644acb86c02f6
SHA256dd40a6fc08d8a1c696a6ffd4054b414595a1dd6fa345f994ba90fe5a0d7b2d00
SHA512327390697d92a40c9adfe95e1a34d7540172139acbdfedfb65cf1c08de024e1439c00b50131306d0713548affe65f65ea3fdfcdd62d987cb2057d3704c0e3c58
-
Filesize
448KB
MD5c2e4914b9121efca2bbd0c382578bc16
SHA1d23ce44351f3a9d2778441053fd1c463ebfce7e8
SHA25629a0b090132cb6688a8e9ba91c8d6e98ee3fe37579edb1986af6e797a0adeaf1
SHA5129eb88b422ed1f5a0825f628d167ad3d8df812d508c174ac64e61f78a98ad4cdef56306723a1e8d3dd303eca35773d6e00888495a41efb9c6ed66f92ef544e17f
-
Filesize
448KB
MD5a86260b664e41d8d74eda731317f45d0
SHA11902d5c336b5af5c005969d3d18bd90434443342
SHA2566ae98491abaf7969c33c06d253c15f49895f150a360754fae6dd8d318dba8d54
SHA512c39a391f4eaba7cd4cc181a9aedc137f9349e86f3118a403cea9962aa4183f4f410972eb3d1f927bd335dd352b618b5262a3dc82af55e35cb8588aa59743d84e
-
Filesize
448KB
MD572a32a32e087d3034403317444dcdf41
SHA1aaae8b0729432c112ca1c7fe733478f1e1610218
SHA256f1942df88f1904a693e4373e5a1679324ba27fe74238a32de4c971a22f570530
SHA512c75610dec1d6ae5a2a81a74e702875d58e4972f4b8ed3d5e428f830f8b4c32ed20dac8366081bd9b30194b353e5f15262462386865222cd47765e9b9441f23fa
-
Filesize
128KB
MD5fedd5a9e7151867ff5bff1f89c3af648
SHA13e7843eb5ac0d6794e0230f7d9973db5dd5c57b7
SHA256e1a3919edb8851ff9be67a987ac6e23055006a84c3e8bcd1567c11119791ec76
SHA5126802fd539e7157ca4d8411fc0cf1ef4a5825cf55e17852203d27d5364c8e5beddef9ce5b8420c18572b621849db68cd800b19682c21b13f8705a0448fd7dbd5d
-
Filesize
448KB
MD5d903fe646ed36ae76ff303d121215744
SHA1966a0db6a0f474b03bae677f2ed699d81a9c57a8
SHA25614fee2fc9c8cd5a39aa7628fe11626f25beda872e67dfda1fa353e0f92628cdc
SHA51264deffa08848c0bdbf428248e5a301fe3149e711e7653634702760fa85552efd0a881e29f7ee83c5e3804274e52c2c2195d94cc60cab42c858cb83b989ee3185
-
Filesize
448KB
MD51c84cd1bced205794c501a631af15eef
SHA114dd90c9ce50852f9db8dedc41a0f5e6ad6ac130
SHA256621946e638a875a2817d7eb877e635b23f832d91511bae9dda3f0428fc95096e
SHA51216e8ee6b5e4158f62924f1de2bd6b6b5ee5e67d295abd78e936957c27c6f75f5762605d00f78c20abd65464535a887c525404d1c81f6de94a18a8742f394cc17
-
Filesize
448KB
MD521c3f4fd2f429ecacd2f7f1c40af67d5
SHA1bcdd07aa84514faacfa90a5489d826a63a99afe0
SHA25631b6b0ea0895f65ab014c02b9cb7958bde0b43cddcd4de27017f0cc6bdf69f7f
SHA512a816b762e4fd74c1c65b4c914a308121153eb1c931d66fd594da4085c51cdbe36e3ffcd93253dd33facf61bcc3f494d64a36b05e7c2ee6275bd96a8e7cc6e466
-
Filesize
448KB
MD5d0bc51a38baea046da7b7e93ba3cd638
SHA1ec31035f88080d4fe28efdd645e30ecbc8862a33
SHA256a50706abc30d523f19dbc9e832a788820751ffdd959ff9994f0108f6e5d67fef
SHA51224a613894e04b054c0160aaeead9e9b43d3ceaa16679278fd2eacc7e1c267d75544b91a01f8ee0334970515daf28f89083a3037bf009e6fe7b5cf31d3a599847
-
Filesize
448KB
MD57cc19403a82cda9f1d5162de4fb006c6
SHA101bfe701160a94f45f0daa947fca9720d3dd53c9
SHA256c1bacaab1036602b8ff64f77b1d087850516cbeec76ee0f2df7020a385bd8d68
SHA512e74d7f3058245d69a3defe96c851c6a7cc1b7d4ebc75c0b89155503eb8f9990230e5cbe716a7b34eae65099b75cc8c48c580c2ea0acf1a1d8134f24babb57184
-
Filesize
448KB
MD5f3d445d711387437fa431a835f18120c
SHA1f4323e55a987c3cfc2460bccdf3e68ccad0167e7
SHA2569492ddce6c75724f2fb94197367b03feea7f20bd981b5a37d350ebecee3b5531
SHA51214ebd229d26e55d0ddb59c6c679d417f84d9ef8967f460ac9b34c55cd1d31440fa25730ab492222a02f983dedc61ce56ff1fb492205504000c4006176437fb14
-
Filesize
192KB
MD5a5ef3b363c01240ac41e65000b05f027
SHA1221255810d6dee84f7ade574c04d83cffd08cd9d
SHA25659f7805c0fbbd8c9122268e9b08cebdcf5774332fc4d52892aaaf3077921b32b
SHA512336f180d3aa581b03e95db6c0a6119b46b553553448903085c938ed598fc5b0c17a5f02d59b91f1a406a7f598603f557cfba10b22591dfe31293648e7ca1f92e
-
Filesize
192KB
MD5fa18a488d93f89b7a0e21335d467cf0f
SHA1ccbb8af4a6ae7c5dd8baf4b1f38392e9bbc51d6e
SHA256d25a18508dc6353a67ab650f29159d220af248a9a870169217b50161081b28f1
SHA512daa012bb51e8757a20c90ff30809300ca71a975ecc467cc3f2d2ac980a7db2c84585f0de9528c9511b78ab68f2b47e171d105d1dbc36e22943517a337dd9d293
-
Filesize
448KB
MD54f53ba731ca4288d2fb408323cae79b5
SHA11fd19995c3c961502a2fe31d8557fe753867f46d
SHA25676d36d04b6953d7cbf5977a7fb39cb5ee61356ce15e632b13f7180336b81d865
SHA512f9f7cc7d0395499892802f9e52703bb4ce8e5b17ebc868753314795b813b2ccfe27e08573db1f6a2278ee6e30943894cb9049334bacec08d28227874402fb805
-
Filesize
448KB
MD53ecad5a0fcddde7dff931eae53d1e251
SHA1d25ca0006c0b65fd1847ce8ea4efb0e26e96a538
SHA256656d3996f4db2a43809ba05f37414c71bfd30ecefe2e70cb7a896c18c3a22a51
SHA5121891ec127d0fd3e055e2cac5cece036bef6831ac5893dd9864e90c99b011ed7bc3a7a813908207dddc4060e6929b8f31c79587bc3f79b559dc51568771ca8b80
-
Filesize
448KB
MD501399fad314b7fc9ced9ce567b338944
SHA1a32e277c30c115c31be0317f8947dcdc84380f5c
SHA2562a2f7686bc8704b2610ad56efd51e192f07a13c0514138004ed7d0406ad9de00
SHA512d1bd60304724febacb816d76d8b4f14f4bbd5ab1c876e95f49fb99e9107860856049371fc614d9e3ee2cbe5c3c02781812d18fbe56a9369410024c8a73f6748e
-
Filesize
192KB
MD5f76c43c034a63eca91ec8d7574603a81
SHA198b49c08f151f41ecad78285019cc2080983c7cc
SHA2565e4118e5258e75dda4b12484b5284fb5d4756d4ed356f218745f79970a17c62c
SHA512452afbab39bee484a6171ac6224136b7380f6196f92887cafe2580ccc05e7ebfa8e6b8bfbfdc1bd85b52fddc06fa5ddcba04eed46e8dc3266159390c3940a2ca
-
Filesize
448KB
MD55b12291335298d160d571831111d789b
SHA1dae04df158cf0339dc89b0ed138e18d5f2999610
SHA256867e37ae54cae61704b1da7698555244ade12c3ee0c66488efc562fe1d9c6490
SHA512400880971505d5a5b875a8726b3647e6c64da063d21d3446b432a53ec922f758cf24bd4681eb76d170e96535f537789fe1c5ceefba9b6e858915893e55320ada
-
Filesize
512KB
MD5210779e5202c3d1bfa59d17dfe31a813
SHA1263a309f6183e39c6f5825a88f15465a17817541
SHA256bc83803370af36c6f6f3f6551354dbac45bb2d891c7809fc680dcf0d188c01cc
SHA5125c2c3b1aec6900a2faf8f5f4acb721ee0c829f71ae09ac3fcb2e8578f0f7dc8b87b07ec8d20660c55c8728473818983fa047796c6e39dece7a1cdd58a20d11b2
-
Filesize
659KB
MD5c41d45bdc647d95bfcdfcade252868f7
SHA11caa31a5b063fd2f6bc19abaf78c4f0c161e07b2
SHA25652097845a6f07c3e1989162d722530514fa108111df73e3e2bafed4756cc0806
SHA512b11040cae81f0de1b903af583d4f804566f64ccc5b87afe012e1dcefd9bd0afb90c27a9bfce43445a2cdef88faf68166b85a98eea83cce3dc5dea33abc0af3ee
-
Filesize
1.2MB
MD5c764dd8aef9b05dedac4b756033a9fa9
SHA12a8584c462f1b0e2676b3f18598356b0abb7e9b0
SHA256963d0886ef60681e037120cb1595870922623a8992fcad3c2e9299d0fd31a48b
SHA5126abd202a15f909383655c9d6306446d123da93eeb1db318049ca8aadd977acb8f09d4d87f974c1dc6b83941ba118492a211e35bb98414aab04ba91813c2bc7e9
-
Filesize
661KB
MD5bf51f1811d67c9dc237e3b6316f28f5b
SHA14c0e31d3407ed33d796bb99b7250a65926d264fa
SHA256502d04747140481113819bf795aec83a7f2d74fa9050dc3440095ce70c37f7a6
SHA512ea181feedc08c67a12494a4057ba33be75f33ec04527d45b27e13ebf06d2566a7a0f4faf345f47f23d188c224d9839cdc78243d404c8054f0a821a0153ca09ee
-
Filesize
1.3MB
MD55caea79e855873ec1a33ad31daec82fd
SHA123cddea8f1f560565b7bde89e42219f69fe023e1
SHA2562a2b71135fbd71a1b55d35d18729788724fc97b5f410305c60b49583cb927d3f
SHA5124550a3c1591c616938bb044652b0f035586f3a66895a025c9dc064a209fe8554437cf285e64eaaefd9ba284b8b60acbbee9d67d9f11a152a8ac356ba40059926