Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
11/06/2024, 04:49
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-11_78d9c9b272365bbb96b3c615f434b8a8_ryuk.exe
Resource
win7-20240221-en
General
-
Target
2024-06-11_78d9c9b272365bbb96b3c615f434b8a8_ryuk.exe
-
Size
2.2MB
-
MD5
78d9c9b272365bbb96b3c615f434b8a8
-
SHA1
580a5003a40eebb2a1e1001f2c1ac946284c263a
-
SHA256
2db93acf3e7d00bc6363f8317d85ebc49c2e4bb3d8e2fc25671b20f36918e05a
-
SHA512
08476f982a6e81f1060a333b101d96b912e3dbe182927c3ba8243cc4f6b5df45840b80cc81f51557c60da40b1a0881b8e8dfeb38b544a5409a5fca0f525f6552
-
SSDEEP
24576:COObVw4TaN1wdhukCba4oXtgLhU3wEdmh58xMdIuwe3zfIe7xmvH/:COOh3aN4huLbegmtGyMdFrIe78vH/
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 4928 alg.exe 3604 DiagnosticsHub.StandardCollector.Service.exe 2848 fxssvc.exe 1040 elevation_service.exe 4952 elevation_service.exe 1532 maintenanceservice.exe 4380 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\system32\dllhost.exe 2024-06-11_78d9c9b272365bbb96b3c615f434b8a8_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-06-11_78d9c9b272365bbb96b3c615f434b8a8_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-06-11_78d9c9b272365bbb96b3c615f434b8a8_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-06-11_78d9c9b272365bbb96b3c615f434b8a8_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\9a8ea363d590e271.bin alg.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-06-11_78d9c9b272365bbb96b3c615f434b8a8_ryuk.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_95296\java.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_95296\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe DiagnosticsHub.StandardCollector.Service.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3604 DiagnosticsHub.StandardCollector.Service.exe 3604 DiagnosticsHub.StandardCollector.Service.exe 3604 DiagnosticsHub.StandardCollector.Service.exe 3604 DiagnosticsHub.StandardCollector.Service.exe 3604 DiagnosticsHub.StandardCollector.Service.exe 3604 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 652 Process not Found 652 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3444 2024-06-11_78d9c9b272365bbb96b3c615f434b8a8_ryuk.exe Token: SeAuditPrivilege 2848 fxssvc.exe Token: SeDebugPrivilege 4928 alg.exe Token: SeDebugPrivilege 4928 alg.exe Token: SeDebugPrivilege 4928 alg.exe Token: SeDebugPrivilege 3604 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_78d9c9b272365bbb96b3c615f434b8a8_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-11_78d9c9b272365bbb96b3c615f434b8a8_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3444
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4928
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3604
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:2932
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2848
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1040
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4952
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:1532
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4380
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5cea59737861a0c9f3be901c510a4012e
SHA1867f511a3507051859596176086d882637de8b5e
SHA256ac20de88c6e333becacad5b9bff603cec20522c9ba21bca4463de69a717ef987
SHA5127d076d8e4c0cc3d93dba71c3a72a00c43e4d7687b199bfdc90db8a53d8a520336f47efd0ac836dcb3e505eab8b301628aa183cdce045591c55e9ca33b665ee2a
-
Filesize
797KB
MD50b9c1aab0b88294c21baf7066aaed1cb
SHA18d31059bb335ad2b63aaa7beb25a5fcfb0ba12b3
SHA256c5ddd7dc370fac92893d94d84a66ffc0fa19a3e06335a8c7f6a468ec49c8459a
SHA512fe99f7f0f9187cfd6ddd7d9a9d7c1ea63867f5d19d29c8a5de220e341491856d2fb58bc8dbcbb4ea4a53d255e7d85199c69011c1ed0acef09ee469459aa19051
-
Filesize
1.1MB
MD54f385eef8e54a44f9b725029cbe9b27c
SHA187a4b04bd02f7fbbc4c55e24243f80a5e33c7fa1
SHA256bef7925d50889639eac55dbb090a3f15bac1b29b80c4e7164d4e25323c5439b9
SHA512d4003aafd78ca32336087f3672cd4cee9d350319d3c83dab4fc36be550a109623ff9bbce42e106f9bc9ee96b0098f0ef98e78a108e41e7a5a058ac25a582e859
-
Filesize
1.5MB
MD53b08f1ebc951f8f84b3f93c01b2325d8
SHA18eb6810d09d7c826e88408824c774ba24fc4aaac
SHA2565def30a073cebda3ead95be30ee8d3052e53ffc68b1b2b300b7259108736b37d
SHA512f953ca4cfc9e5cd1fc037b97af1b9054ef04fbe0c102d432f43ed7e954b5431672debe5008b8806a1634f4a878b7fe39c13e5dbf13182ccc915a07bfb49f57f7
-
Filesize
1.2MB
MD5dcf031a79afd9fd36f511fa6ada3ad4c
SHA1bd070bc1594f9a0c71ee3e8cf27fbcee8758f5df
SHA256fab302c82d115209e339b4842e190e81de4bc8ad6fec6de000151d9cc4a8c64a
SHA5128fe561109e75d628c8da3d8799109e370d0b648475775ca1c93420744b0f73881122ef93e043368af51af97fc7ac513b037995f2d66e4a48b21cc72f2cc95248
-
Filesize
582KB
MD55c7a9832d61e33f76e4e979b966d928b
SHA1413f4ba2ea8a3816ae424d3d1cfdfa1b2f092345
SHA256f43adf41e994230d709adc5e395ba42ecebf7cfcdb95126832db186942849a51
SHA512aecff12f662e6a272ee7dce7aa6db44f59da9653ee5c0c9734e93b6f05283aa77c97eb7466425cc0c884cb0dbe5f2c091dc862499bd7c24778248efa282951c6
-
Filesize
840KB
MD50d9bb2e65e0dca1557a4b82fc3cb9a08
SHA1ceb1efffc06e28ef9a44ea580397929d3f0a8c60
SHA256bb294f15983be1946933e862c5e0b22aa59075c9d1ff4a8a5233139ad7cbb5b0
SHA5127dbaa755b7ca18a5684a28496087f874b1cecf94fc098a490d44821fc0282d4fa8d0edf2e610c694c8e48f4095196c64377b02156588c052164f70aa45e15d03
-
Filesize
4.6MB
MD529f82ac8dc0fe9b95e425338d974c0c5
SHA1ea98dcffb53ed1fb0ff7271b6f7af46e37af4a56
SHA2563f04e4e507952418abb1cbd5645c8fffdbadac66f7ed975eb1a03b1c7ba5127b
SHA51215e1cba6d12e694eee28d71e1ddf2bb1eac68b533fd0c573c5545cfa545f1834fe8669d7a79e0f894d3fe474aacf5cab8af6f7e1b3b54b131022b46e92d4fd65
-
Filesize
910KB
MD5624df6f0c0cca53200ed92377dc1b622
SHA1ba028e88e4bcc9e25a96fcab7437a98dcd6ad4b3
SHA25697b1ca6c4d792255ea3596fbc4e00f8eba579609b3dd230f076a90459b7d99ba
SHA5122c73679b2ff70ab16a7f4f83808503cd4d9f1ad53e5fb549e028101e5422f206af4d4247e32afb3fff161900b237943a609d3c6faba356dcff151649eb93d426
-
Filesize
24.0MB
MD5eb4be6c7ef418f61d4a16f4a8b3f2b7e
SHA167d6b8642665392c1997dce4d167f6fb31b39795
SHA256ec1945b6f121a885e610c7e688c3bafcd627b572de27e4425f2da63549e3b60d
SHA51238840fd677b05d59dfeb2efed096e659e60551c577c613d30437d2890d144dc3770fc9f19e07fd11b3b20764a14454733a25a49a7a9ad5353f3ca65e967e9cc8
-
Filesize
2.7MB
MD57bbeca5a9ce75b602e3b62d4a01a10af
SHA1a11e6ed78865aeae95f6b0ad332ff6e53af86653
SHA2560cce038b06233f4e2e5906a8cf1cce6bf491aa6de96691fc5ad67629d098e938
SHA512abb0a0f1fef85284436a797949b19b1d6508885a0fef89049d01246f3eb1b291e79aa3a95c39ceb4040e89b9772aa36f15956752f78b2c36f876da0672f5a62c
-
Filesize
1.1MB
MD550320d1510e693825691b32ed46bd850
SHA1cbfef0010053f58a4612a54f37b42c49d9c7c59d
SHA2567a49f6f428a8094a83b8e84b06c78dc4d8e68e0c3da9eb7315d5d3ed910b9179
SHA5126d55fb5858081a0a31dd7070dfb84a58c7cd05abfccf25acf7e191ec0f7b259561519cebfe3cc5a93650a48c9b4803ebbb1957b1db0e244459c6f07fb5bbe221
-
Filesize
805KB
MD53ef901b043719556c0d9ad995cdb7bf5
SHA19f5bdce84a8bb7eb72f55b190a7a36798a267565
SHA256e7a602959b5de7211848c6503d44114ca263099c25e074bc32bb719768fdf5ad
SHA512d17ed9fd7499d6ca5048be89ca335c9ba43225333deea5ebcd0a8e02facec7b67a70a0fb6770c6c0af755f81376ba8c5c0ce218d42a64afeeacd3dab42234bf3
-
Filesize
656KB
MD557a4a18f2ad94f53f743a86f3169c6d5
SHA1fba69eadc617f902a5df0d53835dc79d3e998774
SHA25618c7742beeea14914482bd3f32afda93378592475b482afd47a34eaf7d955f03
SHA512acd49d348badc238bc510258378f6b89f5e0118aa7290030ab30317920f9d55ce73cb7f4663ac40a95220e63e02964995bb38bd6bee63292a23889b3c8af335f
-
Filesize
5.4MB
MD52aab37f8e799d46301589d80b070685a
SHA13421344e6859d0cc7e105a554abbffa55309b278
SHA256f50ff805622802cf47f96bcc7549a628e8c5c23efd070161f3f0675e5c64d929
SHA5129f9a42cbb667d5d19d3ed0ec0505aa3ad67fb41fa0916e5c023e010183b7e85e9e1281de5d10011bba1af2ce4550da0b23cb6f77a1e963278e111057f5d49fc5
-
Filesize
5.4MB
MD5cde853c28e2f12617c8ff6e78f6a83bd
SHA1eca9b550631669cd78bddd658eb31d501256215a
SHA2563d3f0b339e000081a83a7055bf97fd57f3408476d64e9b005625f0a5fbf767db
SHA512b556e8b38b8a00652081d57c4058d0c340ac250fe1f1e286feb8e77ceb4a217cb02b4d3002bd4d56ee2cac931755d2ded336396b1e81d70106d1e100173d757b
-
Filesize
2.0MB
MD58fdfe601654dc1e0c7f592a0c2cfbe88
SHA1714d6b552f4850afb32a461c523405dc0d6b5035
SHA256c37871c947853a1ac71c09233d88b51cac56a5ae783550ed239428177111c6b1
SHA512c07e93ba8319280ca51c067c6caa6c51bae6cd6cf8360fc1e189adb901e440b68d62e6f200f33bfb174cceb7ac45b7dd38f39832313930b119d6f0f8eac9fd80
-
Filesize
2.2MB
MD508078945bea547c5a11010ad1c480a7a
SHA148dcfc5bd6f9c941aaa969a864be5f67f143d4e4
SHA256afd8f5c3a16c4a6a426cc258b7e2e10b4232563afea046e1845c850c2802ee7f
SHA512ed222762e1d5e111ca41c4841294f9fe31c8569971485c1c0c1307f5e667c50430c9893dadc7239f951e7c1d2f2c8175bc4542a94b2e0ed641f8b2ae0d745ef7
-
Filesize
1.8MB
MD5d3954f5f59139ce21dc29e24339c8fee
SHA1878b8bf795a3511bc7cbc9fc976b2e85314e5666
SHA25631b1ff1db9948b5ff1b7c809bab3aac3dddd077809260bbf320312b5671fdbf5
SHA512d954bef0ded9216aeb5086ad6536d1ed347e172ce2a5195c58772a67aebd300568a445e0c644bec9e6ef3ff256b1c20d65d732a229152bef9135a780d68d490f
-
Filesize
1.7MB
MD58c2c22b5997a2d2723521e4b8f3a9cc9
SHA132c05b9cb7c51d1194f73bd145f44175f0e61180
SHA2568dc8856b700b7167e442c615e22950f3c0d6bf2d7c016b7b979c9743edd805f2
SHA51280481e78927d242392267ef2dc351eb0d90a687cfaf7ed49d0c34cd46ba30cedc0ee4ce74bf088c2ebb26c4aa19d4b9d15bd76ae9e7509e0605fd153706dc090
-
Filesize
581KB
MD52ad50e2009d65b21a41a6719d811e59d
SHA194465a81819be9d120b57ea644f5cf64d1a34a60
SHA256a2319ef388109c820ccc701e49495ad631bcec95fd8a4e67e4a86b6e865dcc8f
SHA51225c697fbbf54f9b58b6ca063d4b4f5481a441914c3050c3ee7b706a230e1d3e5deeb40734bdccb3880855113cd259640e4e6e104f9f840dda0832d09f51e07f5
-
Filesize
581KB
MD5e049244299fffb205d3ac7f75113884b
SHA1bceb16d635da6ced83f7845c203d2e95cdefea12
SHA2560dcf6745ed637e26abcde252f673b93c2f171638af8bf1e0051a6f97eff8829a
SHA5121f7895dca96f507e90feba71d47451ed4a3101cd1dc9a565891cb63ee9c0e8123cfe9e04576d2b7f57e094227ea9e9348b600f33d292d99c36439a54ec732f69
-
Filesize
581KB
MD517d30eb367a4e490f838be8eca3b5e67
SHA19404adb7d60efa8633e55dfe3c7dfad18c1f2fe6
SHA2562c528878f05b5aaa10779aa41f15941b453aca1055b8494ae284072310e9a7b5
SHA51258403abff7184e2a1c560ed13e07ac26a599b21bc1b2776e4cb503679da57c6b80cadd4d4863d77f42d1f106f82c12db141e7aa56fc655d29e9fe3a4e06d9183
-
Filesize
601KB
MD5e1d36f598d162c5bc711dc58a1a1bf4e
SHA1d436467db7f046305d4bf92cce962d334fc1599d
SHA2569a7d232ce1e25936d868e747f1ddb7da3ed87556dde5454bdc634349d2cb73b6
SHA5121ab139831db91b2eb292745dc46d4683b076ac7b8e615ede7424b31faa516799b12e10f9fef3225b8d4c6ea8c890e2cb12f82a023bf6e46fbf3839862e89c225
-
Filesize
581KB
MD53d29118a81891265023cd83a3567a548
SHA1fd5e2555c53ad48a3262ec90c6c60715cb948fcd
SHA256460897bf8ada760083e60415f82d9e0bd5d01fea969905c73e0d5e393ff96b68
SHA5129894880935e9f1950dc0b527921921137dcda5e20f9020ed6ab108e48603390481af6143aa974cd1d0404dd49bce71a49b8795f5ceb9f0a1704103cf38bd899d
-
Filesize
581KB
MD5dd26197c20dc4ee12aeb084461d5d02f
SHA1b7a874edaa097c7f96467e2148aa82df558a1fca
SHA25654679478a47e72094d86165a59a0a5a5d384e1b95a26b6bfb2bdfb28dd6af0ca
SHA512fecee48b1508b12650b91b12249ded1ef38f21b0eb122196cda00bd4fe277a286de2dcbd55eb7156d02c50409f02eef8299a1591c08db676a3b0b39be708d0e6
-
Filesize
581KB
MD57719a3aedddec4bd2779b4f21bb34e15
SHA1df510c7f8e64df2b42ae8facf8351b9421396065
SHA2565c86dc87a296dee94fa2e34439a59c92007844bee547c5603f57aaf71e958184
SHA512697ad1bc586e0041a09839d9c841d0de19bfae3a5b1b3b85289973918ec87ef8d892fdfd15322aca94c50e9c6a8de9b4fdce7b05751f427a26582ca8a251eae9
-
Filesize
841KB
MD5a4350eaab66fff7520e6b94c47a235c1
SHA18b5c01ead217bfbbf4d25bf63de367e2bda01f61
SHA25604160bfd373abb6c8c9dedf4c72896a37f1434e4572897fb4bd08c6c1648462f
SHA512f1967910c240995ab05e1afd3e88da58ed22e01ee62d38a5528c7469cbc3d556605b9602d1416242b7d7bec6ee20172f11e842fcbb3321df9cc72e8c91a1f9d9
-
Filesize
581KB
MD57381b4f34a1b7e3e5feb712f9306d3e4
SHA14f2c636227168cb5c47bac58c3706328f9a814e5
SHA25645d4e074612b2e7b1676c682fe048fa5a965c10bc7dc2b4a33db13074f2a7ae7
SHA512130e140df193b1261e486af2bb05187cbb700a1b0d5804a3a0f7a0814eb5dd1531bbe58fd6eee2456460aadf226faf301bd737b3d7a56881307338284a6a9149
-
Filesize
581KB
MD5eba9f7a910cbdd83d26cce8dd1702b7a
SHA14533ec70f8bf96e2b519c381fc92d3960a0be8d7
SHA2565beabf214f3eb0473617b424ddaec13c906a5ee5ba27b9420705da0b1473adcd
SHA51227dd9536b933104705a013af464dcf0afb9aac963e3e63cb8c1d85a42a99fa187d1278e30e3a17975c84d4a04f561adfa2ceced55050f557d871577825835fb3
-
Filesize
581KB
MD506db53940576d485e82f256bf05c18ba
SHA1588e6f0ac859b37fe34b5b5f6eeb5019b1bf374d
SHA2562f5eeb64baaa09698874d2fbea65b57d452097198e00317a3e1a6e977888ef81
SHA512f41fb97e6e17a1bccd60f9d7f121dcc3e4f6aa7824d226f529268da3058bc0c35bcfb39001b9c3a1dc022ca05bc48de3f2e442569dbca01b2ae229b81dd56025
-
Filesize
581KB
MD569d63c8b94f46c5ed7adc68e75c04532
SHA1bc20620bf036fee1f4c17e2dc9394346e9625030
SHA256e43c9377a61aa474a24a48b2c6fb979841d4b5b2b9616bc3102b782ca3b41293
SHA512e87e89cf51771b647fa47d0587b71e6c3d78bdc78059cffb122b1c048af6a49cb83db7c69c9c174696ea87f2685661bbb22ca6e73466670393af33826300a24a
-
Filesize
717KB
MD5977f405dd5d6d72e048bcbfc1871396e
SHA123131261612a2325b69cff6e0a6798a47724b1cc
SHA2564355e6f6b82e8a06a3dc6d28ca3d01f3b0bc43446b94ee05937d107b9cb9a936
SHA5125abc020c44733f9fee8548cf114f04c7666f9d9188ad7c566c492cfb16dfb46b43fac4729ecb16d285eabf9775078d34b2cc479456424a83ceb1372adcd1e1da
-
Filesize
841KB
MD5cd7a9b4a70d9030495eec3734dfd45e7
SHA134e5cdedc82e375dfc4ef15f58345178988b3c79
SHA2563280732cb3214e1f6e896c66d95f07f5a36f4004f274b8222b364636bccf4b00
SHA51287513a1a94f0dfbc00620ca4e9567ea8d199d92b9460613bd24588eb150239c150acc96894a4159090aadf5643e9d8b4696f1ecc249036a8ed49e2dfbe67cdf6
-
Filesize
1020KB
MD50235a1802618616093bd6745914ce950
SHA10350ccb926f500975cceb395f21c9a021f648fed
SHA256d000c8a1f33d3d73f36950e6106153eac48b1584c070ffd02f4b4f9461eac58e
SHA5128bb5480e2f9a083718d8e631bce2db7814da573184eef012f191e32428055cf029fe7367752d9f3cfe7bde43ae40085d56e5a8c0287f1345a0bf09a18fe8686b
-
Filesize
581KB
MD522f4a93d0c79884d0fa125a937555957
SHA15f8d807be19617d364ebed353763841ea781a0ba
SHA256dfcf510614e0902f49b3674182013a0b3ea78232f8b2341ff83137106e80c53f
SHA512ede3745e25587fee9c27a63d2dcc5205a7b31a57b49fe15ed439d4c93556a783ae243c9ee2ec3e37f09b34506154aea6392772638b44b3fcac65417daa906fe9
-
Filesize
581KB
MD547ba66ef29f4514b0eb845bbe0641b42
SHA1b5b23ba865eda699574d099e41890c02fcb8af02
SHA2561a08bb94d5d807a81a6dac9b7c6fc5d0ee1d6397ccece707211bf9dee61eaafe
SHA5124d8ef40570a406b435d20669448cfb44efa071bdb11b855cb3c7c4c636436553a188d2ea36fffbe88b476f6d6cc2c955a31cf7de77894dc3ed48c8f21313184a
-
Filesize
581KB
MD52bae526d0c3d190ecb252a93f4bb62b2
SHA1f777c4e2b0c621a6467a643d9daaa582981ab578
SHA256241bbfe4690dcde29b8f996081e05a8eeffd3bfb2f00191b8afced98c653a942
SHA512ff3d13201bd30c6678a0dc66c825d9c1b0747b06c94ed0046abc0b5f0a869247ce5b1f9267312cad5bdd7bb39474e794c6340ed03e903a6c76d252cff785702f
-
Filesize
581KB
MD5550c85303885ba60a653f4ee105dec99
SHA1f96ed89925eb4e4519a881b2b958f3c4a9b75f82
SHA256c521d2f37eb5a5c499a3326e2b419b3bc19b4c2f099d6b98dca468b85e4e6785
SHA5126627a97f49d1c9a5a3202a29167d85e5689844f1e6567a222768c53422407371fa48bdb8ef5868bc7462d80c854a609b24340bc5c93dc614a166da4bbee79ebd
-
Filesize
581KB
MD57e8a66d3b17b044e6033c11c05801a73
SHA14a2284ba13800dde81fad0f782ba1030cf392733
SHA256de5c351b7bb78db0776a1c80ec9fc8f8cb75067c3e07d213736d67981a4e08d8
SHA512506900f91fbe2d0d9c759eeef82db285535200c151e9cc8282ba3aa4eed871acb9c1890ff92b1b36f8a3fdc72fc47324992de301d6de9ad782c02876469c47f8
-
Filesize
581KB
MD577f30c7f50f8c19493b18d9ad2b1506a
SHA12c67563386867e140a20699f8670f9d7afadc1dd
SHA256d772851f568f55a961ac67c3ac96d60ebcca3a9d0e19bbcb2b59125808d1849d
SHA5122d8c0f2de91458277606c2be25ab9f2013d1beab98239ff4142859bc25f3f46fbeaa4bfb9902b74c411da917c3ebdacda263f3e71879da2415d3d26f11c978e9
-
Filesize
581KB
MD5b499da98e07bf221af545b05bb4bd23f
SHA196788cf6f039993beb0ea2b63d71bf3fe1c27f0e
SHA2560579e8efa76d8b9e611ccc076300091aff562a3ce3205374b881d5e3106c72d0
SHA512e9912629827a32431f51062d05ca382df70972e14d4c7e9136823401a4e80139628fe8264290551f8c50a91f51f2625dba602f9b4cb40717070f9670200cfc8f
-
Filesize
581KB
MD59980c53d2b7426f776c8e3a1762e65a6
SHA14489f3336d3c8662a2ed3ba880ae3c477d6b5d25
SHA256b76fb63b7a6f3929741116097700074f54be53e63e27cc3563635c3d5df2dde1
SHA512f4f0ca60dd3f46349a4b4c389b29894fc52d659a856c1f7ab06a4469f50ec9a529ea65352373c71dddc241ecf88a9864f3ef6efbf1fc254693d6826a09b9401b
-
Filesize
581KB
MD5dbfc897400b0a011208488da0dc5559a
SHA1487a48320e82e996995a70b72e707616f36074ca
SHA256c8c02d75b91238dd410051b28781e674e8f7e088615156fe8ff31c8efd1eca37
SHA512c7e9a05b5d5676ef2cbb87b07b5c828da7c8c06fe10fbd36bb1c913064f71f55a92c47e81e932fd4753b6bf551c5f5db678ea38632649f7193b4385add3abaa7
-
Filesize
581KB
MD5e13f8bd8ead24f5a86627de584ec071c
SHA1b67193e768e5c75e7426727a3cc80ad20d578e66
SHA256d565a8c0c3574bb5b3129aed3d63ed2660501f8e6b840fd0be0eeab1ab6d710f
SHA512f34a5e02a431a2dd42e06447511b51d77c108d9c3fa2f323a4c58ad63e83475466f8ae273c48e5bc715cb2bf5a8f04426ce395969139df5ee28a7c7cf87005f9
-
Filesize
581KB
MD5f84d7e8644f489db0dda67895a4f34fd
SHA10d45ebe703dad4adba8dd772404f659fa2786149
SHA25600777c1b7f25d7faf7b96a142cc7d8226b226278a23958bb58e04b796a55f010
SHA5125a0432b7705930ff3ae87c2b718d2c2737abd8ee0289b23b7f2d81d4ed0ec4a4e2444236674c332f03d85af53809cdc421a376100117c58d67817732a1e94c35
-
Filesize
581KB
MD50dbd6695acce685ddfad14694dec82d1
SHA18e78cf558f38dcc8ff4e07f4a5d989ffc6d22ebc
SHA2564364f3754d3239a69e24d486070d31fe812627a93c1b8247b5492827584b9266
SHA5127f320505d1101fc60b1d835308c4e6f8a429ef112410ef0943b752732d03c84521e8d8eb6393134840e1302911a89a756fcbd3ee21dee60ce5d5cfa36a1cda88
-
Filesize
581KB
MD5242988731aadc6d64b58591866187c29
SHA1f7ba14d4006010e90825ebe8ce4f0130afcbd4ab
SHA2565f8785e49239d153ffd05170a3526afac758d12eb75cf3001515f4b6a30d4df5
SHA5122e8d42985fb0b00347173b156c0bdd68791b9480d69fe07ffa5b4bdf9bb36141323c67afe5606760fea713aac3def936d52292f8fb855a70cc1548b3f9e1d878
-
Filesize
581KB
MD55d6d2aaefddd4b8a28c466eb202999e2
SHA18012d6559895643bb25b71efc193fed2ee00c262
SHA256153da8c2ea7dcc87176eafa16c5dfbac5ea021192805308f10268bf2fd203302
SHA512a39fe1bbb5204b5ac1cfcd01bb756354691d40aeb162576777ef4a7da620a1ba8676c330751ee8928e21194f8b4e22ae3d526beb0c562261f97177de76bb113a
-
Filesize
581KB
MD5daa0ea085875213274797a863bcb5df2
SHA1872c2b9d675ac4c66735713ad60c1c3e6b7a3d5d
SHA2562b783db8c83148b915133fb13fc8e0eadfe6faf41fd18bcd5e1170db157fbf95
SHA512f205b3841ca28f4f0a28df624630eb9d62193c8ffa3b677081ee4f794daf2dc58673b35454cdca5715efca1fbaaf6d8b689e45a1970d675d9003e9ff1f73067b
-
Filesize
581KB
MD5f5bb32e3425721a00f39d6ae9e9a6b56
SHA17650ec76b5cb18eab164c4768e4da665404df7d9
SHA256965722271b7a6ff3ecb97d6e3a4c74154e3b034ae77970c5b81ba7d6ce6d0d78
SHA512accecc360d6ce192518c5b34330cacd6958ede5081c06661ed162eddaa5fb86dd72c8c8836343cfd71b8d696c7507689e89bf457ec61a0c201a3ba5532e0fb96
-
Filesize
581KB
MD54b7936f00d3f1ac7b452f3f38edb7543
SHA12cd13799de0e14dd8cdf3fe2269c01e2255c239d
SHA256f3082103f2135b97238cf2834e0d1d230d0a567d9ba47c73bc623d18647a9e4a
SHA5120e1f39121c317c6aedd11a0ab2a0dc0a05267270888d5048599d992d9458b3130dbde684dab7f69f8365d37890a4f5a8769cf6b56f1dd813fa12a8f705025ac9
-
Filesize
581KB
MD5935de0bffcd7a35efd5db54fdbc89bb5
SHA1a47171ff7c6828809e7b6df8ffccaba322aec9fb
SHA25636278d89dea8f1a1110ee5a096de5bef9891a6df69831d144b8cbf402eb3a528
SHA5124ebf84c41794c97ba87b8c379f66309c2846d135e00ba21d128c190d53c375dc7b168929cd87abee63a8a1fa1c0a1c5fde2847e401ef901c5b8f401ace05f100
-
Filesize
581KB
MD56c8022848d9c34f6e5be2a87d62e0019
SHA16b7da3808043c2c2598f4b4fec9d5adc5662de0c
SHA256112fdc0980a50a029e2a2484541f9e4d040ce26047e66d48dba9d3422822cc4a
SHA512940c581160dbccbc0b79ee7bb2485b5a039d396729982e1bad51fbfe38eb33b9e14e0f998dba0fb2f66e1a1adaf0762be4b4a3bbff89681e1706666a4355b5ab
-
Filesize
581KB
MD5babefe9c76a639ca45c0b3b0a5d7ae4b
SHA111276d7ea0af594f8f079100eaeaf786566443dd
SHA256984de39913d0cd9140bbe2d860a3d2edc5171157bf588f19da4f478be9f4ec10
SHA512b1d9e6052e9b44c96ad68008590107b7b044d2dd8bdd0e26cbf5259112a83757008d634d06fa5a7c15989b909f6f9eed0dc6f7acbee920e769fabd4fd84b0438
-
Filesize
581KB
MD5b11f3a775daea045c7090295e775f2a5
SHA16fef6f174e8dda55931c690af9b4a5cf03f22a84
SHA256079d8e3f08f33a5e0beed4c5e5e8f3e23e1d5fe93fce2c6a077b6fc8af506608
SHA51215c18c22666acced9ce6a1e5715a1f58ba8931f34829f083d64c83bb3a9f8e125e6b341c1d45239626a0fffc995d36911f3ace479c7bea68093e4b01fa267cad
-
Filesize
701KB
MD571a36e2fe4ffbfd74f717d0e048aa35f
SHA12e9cfbd01639670545b81fdad217e120d169090f
SHA2561ad785901f897b2981c9d143778865eff6198f66e8fb0371342dedb026944ac6
SHA512b5959b6c55b10c18258469908fe164f9c4d5f7cf8fb2ed276f29f7fc8924ece01bbcfe826fbc80930c0fc181fc6a30b18c25ed81c905c2a354e4b3c77cc67305
-
Filesize
659KB
MD55b0a2ce31508c39ae0a7214d10e664f4
SHA16e009c3bc876504e25847f7675af99d650b5c982
SHA256a57a51ba5c74dbf3b87bda44847a86b281009dc992f7ef8457b8428135c88d50
SHA5129fa73fd8c4e7581383f2355fa066748585ec8bf0f12c5cda11311ea38a244cfb830662f85fefdce6cda049036f4457cc7aacb01b910888ae302ef8eeabeb75a7
-
Filesize
1.2MB
MD56c4801bd1f32526001c3135b3a40746f
SHA1571f4f1c397b693e35f9b16b08b911e71d0888a1
SHA2564f5755a431a96b370282b8b3b93693c28076a1642841d0f50c76373518655090
SHA512ea60b1e975d4b058030e8c791b62a5218fd3230055980e6b76fea8ecc62629790fdfe89b9871ba8de7365a76e28daa029ad94d3cdd0b567ee05972f2a0e1c76e
-
Filesize
661KB
MD542e4a042bf75074694028fd1a92c6d98
SHA104bf9b3b55c0228e352778d1bc6c037bce92d83a
SHA2569a59d842908436f8c62d19daa919dd24e64c83f4b3c50156ced91efed07a067a
SHA512636fe519c5803631a029fe4d81dd09583b34ec8ceff32e0d990ad5518786cb0d5a5d5579b6d9af5a0b9667e86e25d1019fb52d2a99f49c3ffc8420022cabed7e
-
Filesize
1.3MB
MD56e617a7700e0712dd098559f86958789
SHA1482dc20fbf9b647c639dc581715d0ce82b28ff84
SHA2561e2ba1fe859441817dab81685e3eae8031fd55b13dbe084c8bd5090348873d74
SHA5126964c2c27d1d557581e4b72d36edca8bba4b1329f57bb6c1c7a1fd64f96916155eca75c21fb4fd2e7f74f247ebdb463644e5f8ad42b837f5a2ae8c9d9874be77