Analysis
-
max time kernel
134s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
30/06/2024, 17:33
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-30_bd7c8fbdbbb213318e385e2b60b5f80f_ryuk.exe
Resource
win7-20240221-en
General
-
Target
2024-06-30_bd7c8fbdbbb213318e385e2b60b5f80f_ryuk.exe
-
Size
2.2MB
-
MD5
bd7c8fbdbbb213318e385e2b60b5f80f
-
SHA1
b4f8847d6758c0da9b03a4432c1be87fa4961782
-
SHA256
b56456a1287252406ec07d3f9feb4ae3ac56ee03f0b9755c765d9698bfcd559f
-
SHA512
765358f5f7b3bfe19471ef849143ccae5a24e721ee18253970ef3c6c2dbbe578adeb02741ee5e9019d1fee1d091d3d886f111ca969840218a2fb4e0d65c6a995
-
SSDEEP
24576:WOObVw4TaN1wdkukCba4oXtgLhU3wEdmh58Vet/HU9zPjeidP1Yi/dGyA:WOOh3aN4kuLbegmtGPUpLei7dGy
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 3948 alg.exe 3932 DiagnosticsHub.StandardCollector.Service.exe 2700 fxssvc.exe 4172 elevation_service.exe 1384 elevation_service.exe 2548 maintenanceservice.exe 3332 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 11 IoCs
description ioc Process File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-06-30_bd7c8fbdbbb213318e385e2b60b5f80f_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-06-30_bd7c8fbdbbb213318e385e2b60b5f80f_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-06-30_bd7c8fbdbbb213318e385e2b60b5f80f_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-06-30_bd7c8fbdbbb213318e385e2b60b5f80f_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-06-30_bd7c8fbdbbb213318e385e2b60b5f80f_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\4fa4ec7dd2f4b9.bin alg.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe alg.exe File opened for modification C:\Program Files\7-Zip\7z.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_99406\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe alg.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3932 DiagnosticsHub.StandardCollector.Service.exe 3932 DiagnosticsHub.StandardCollector.Service.exe 3932 DiagnosticsHub.StandardCollector.Service.exe 3932 DiagnosticsHub.StandardCollector.Service.exe 3932 DiagnosticsHub.StandardCollector.Service.exe 3932 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 664 Process not Found 664 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1744 2024-06-30_bd7c8fbdbbb213318e385e2b60b5f80f_ryuk.exe Token: SeAuditPrivilege 2700 fxssvc.exe Token: SeDebugPrivilege 3948 alg.exe Token: SeDebugPrivilege 3948 alg.exe Token: SeDebugPrivilege 3948 alg.exe Token: SeDebugPrivilege 3932 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-30_bd7c8fbdbbb213318e385e2b60b5f80f_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-30_bd7c8fbdbbb213318e385e2b60b5f80f_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1744
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3948
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3932
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:1128
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2700
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4172
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1384
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:2548
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:3332
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD59bbad3db0ae24bd060891a14ed6a9d89
SHA12fd67821bfa7a15da0d1ddb14549e0a8dc3d9393
SHA256a1bcc256c5db5ed233adb2f93812a63773120fd3781a87c9c87964df2d03cdd8
SHA51279aa5f68c0710cbf27baec809bfece718bb071d1a07fd9d16a4979728c17df7d9a5690afe5ad98ac3caeeea1a0583a6628b4f62a3bd3a2628b396ad417c136a2
-
Filesize
797KB
MD595265839209784406338147000f72699
SHA1740a007d6b222ba3b962b2c43260db3201096adc
SHA256c4428709a5e14bd6f2ec2f698fbe2d4adc495b42f5c94c7e881e022ad37ed370
SHA5127b17715a2a809c9e4255d0d5230007c76bee61ee75e00f8125a968748fdf5c29d62165d0dcf9d403ccadd1306cde5b3d8268686b82863bca8f8f9f05132d2dd9
-
Filesize
1.1MB
MD59c5da6bbe20f0e3186fbe0a350c43288
SHA12d1fc65f2ee7b953ad7b6675434dbd40225e3ff7
SHA25639883d5067dd982310e4404f006c0918bb4b7bb1bfc2ec29546a60a4709f7221
SHA512b8eeee192a8819b1109205414f7cebc254e4670efa3267e07fc206afe4acf179225211a7e228cf7953c2531bb561b2c4c884c115ae7108aede28ee371aea8eb4
-
Filesize
1.5MB
MD55f07149017005874517c044a8fa3d3df
SHA172a5f633f1dbe83a51d5316a94fe934dec2a8dcd
SHA256c68ca4d6764b866c0080f49f5aaab46a4c3a933c5a82e90641c908a0e5aa1f2f
SHA512b8ce27291cd185e6364c802cb096e15a49896245a748d71ee1e3ea2c30247b81e356cf93380abb862ad014d89f576260a452f67c4583cfb0812551fae5cf0cab
-
Filesize
1.2MB
MD51b514ed5a151701d415f85d7c996fcea
SHA14c221495fd03ec6eb9023f3128dc0763b4d2bb7c
SHA2568f0004f2140722c824ce223d18cc0f9bb1d04b2c96104db211553745c9a91d9c
SHA512756b88a0ed285f2f92117ec2b1bedc0dbbba2dc7b64373d55e4c00226e95b88a56dc05c3f1e6ba64a2bfd15ff499f9226270717a56f29ac177433f0947c4c170
-
Filesize
582KB
MD55eb65714fd544715e290fdd13add3c6c
SHA16b0d9a710f183877485ea141ca7eb872171e2111
SHA256ab95d114f86e6c60d4825751323f28f98d8efc4dbd78d19c93358f4a5e6c481f
SHA512400bc4f2749d1e24d0160aa8d2373cb6177fb95d61871b8bcd7b2b89b0fba491d1f515d9d1ce300fea2679d4ca6bc0910c94fb9096053cf94f5413a95b4af5e7
-
Filesize
840KB
MD5611883b3551d831e2aa6fb113b2dcb8a
SHA1ea341156d9c6f54d762421c7df027c915779ef7f
SHA256250bb515f2b096682bd22dfc66b9d610f6ebc4feccd009e9c4c7a3be30fd6f98
SHA512b28b6d1b281c84e97968a7678d65bbba8edbfe5b52d1d24cb41e59c0b4db9c20b7df4d737598be0107050527ab2973cce52448d0493e7b1ceea4fe2c0f430b28
-
Filesize
4.6MB
MD5b00e6314195951bddf459763b5bad2ba
SHA184f576aa49812ecbfa8ab6eef46403e9cae16970
SHA256e39a9e391c4e6edf16cb6535ec42bdbc9069a56b170b2a488b87ca7820d1542e
SHA51235aa6c539a1f4d461e339a15015f654ae9dae3d89ba158c245a0411fb229900981c6ab8f7dd04f544cd8ab255896446c3f7f0259726793b070ac505f63f28e1c
-
Filesize
910KB
MD52037afb636d080e47d56e9965953c9ff
SHA176b29559b2d424b90de76b8061a561390a41b5db
SHA2565523761ea2c9e051621da575dd2457a49a4b6fdbfb955f1c185a4875c8f16fdc
SHA51267304446e60a8e56291dde14b62b536b2ba416db4f1c448da6d3d2a979909f17594a936c09ec553b90066d16d2daae2e5fef448d007248f3de61c3eb6f8c25ac
-
Filesize
24.0MB
MD52f1abec925dfdf8c3e58625589756ef5
SHA13eae70e5e5cbeb35747312caa2161cc1ec8875c9
SHA2569f8c71963f0b66a3fb602e960138af3f6d670d6f0321b4b3532ef5155c5d5f0c
SHA5123a1168cad8ab8f602abd844514310a3c8428135827f261c9219198a304573ae45c4eb0193a03297cb6194c5950a3a2d36887ca77e3451275df0dd25fe07d3576
-
Filesize
2.7MB
MD59a8b6d778bea3b65b281eca5fff4936e
SHA11bd2ff9316152f6a40bb3a6095a2b209d65adbd2
SHA256d5a8e90521f2c71f2f91b8be72269c63c6b00846e3887f56c755c2c8a5a04a17
SHA512523dfa97233bdeced667d5788fa065c88c18ff335d7f6c33aeafa21b31806c61bc108c811f2349fcb2e64f36bfe7d29a685907077b79c0bd0476a35c1a3cff81
-
Filesize
1.1MB
MD5dfa53a0ab512a0e042302f795a19f7dd
SHA1ef36e7c852f3a075eeb517d32bdd8407b7c3a590
SHA2565478619f889a6e90901f4301dc6b60bbf5bcca7605188eb95843240357971aa2
SHA51221501b237e5e2dc385b2512fde8fd489f373f6875fdfb6511fbcf9dfe2a5c17658217984794f4f391a361aa5be4f087f2fcc7fd9905b31fa78944355adf162fc
-
Filesize
805KB
MD5e681b350ac9804f2c13fa604af9653a7
SHA18f3e7ce426eb4e00e482c3ed690e41b51fb5bdb8
SHA2568fe146a612615d110a33aa77e925189d02b57e17d3c98cce8bf05124bdd7001b
SHA51208c4c5a7fb266b4235042219610d60409f16d8854598d6fa2e690a3845f381ddc9096de2a3d60d279c0712e367eff3c4d7b2de85e25bf77fdf43f4e8f293524f
-
Filesize
656KB
MD5b5876861208de247dc7d605637101fd2
SHA14863ba8a3e64e2f32aabe6a265de46906db6a0ac
SHA256c084657a7c5d328e62ba94b936e609a07fa858cca3eb76bc43ca3019642a9968
SHA512c972c834c3dc62ed741f63c09b3470c3cc85ea7953470377d75a50add6869ad6b28658515a522a816b5a65477075b34f5cf2b86c754b8c05ace0f9169f677a19
-
Filesize
5.4MB
MD5e35cd05cc4e9e1af408e6412e7201cd4
SHA1ce5db38255acb33aafad1e5a2ccaaa3390118ce4
SHA25601b285cef7af635c82b0cde6a8695816780080c1bb4610badc2ab330b2db941f
SHA51271ea2f755f27a1eac0c369ee6ab00883c70ce9cb4d03a9d45e68eb9114556a694396ffb7c79846f5c27eb280aa517e4617d7cff01024611954661414f097fb3f
-
Filesize
5.4MB
MD56817960e0359a6e72aac26c570534f55
SHA12564256306e83d40e43edc86a3b1f381a33bb5ac
SHA2562c08ef1d2175cd354edc4cc5011f80bae4383031812c03dd076f8d22571a29d2
SHA5127d787dbcb1630f3e8e87c832db6a0aa4ad958ee410113df263ef3493f373b490da3fc32e6c0efbdd12c50a3dc0b480832cd5d50e24533cd0462b9e51d4ceee76
-
Filesize
2.0MB
MD5017c711be35568d790a2719007421a2f
SHA10d57c88db0bded5fbe355ffd31671c1ec81d47f7
SHA256fcff046a1e83894b37e8fa2063b5ddb76f9547410c99639f89b505f8737230f2
SHA5123fc34ee897876e9790bca12c87b21f0a919ea89837e9a3380a124d0b02231db683bec64e7c2ad45de6bd6eff6cbb200b5a7a36cf0dca6458a6944945ce2cbdb6
-
Filesize
2.2MB
MD5c6e6e68473e86231e0781dbfdc8c048c
SHA1fb4e872cbb614d5a55d9a9020863a4810dba8667
SHA256286904549663f94943e84f11e414ac98125bc40489bfbee429d87e6e99680cf4
SHA51272dcf13d9469ac105c07f2d41e79e82001d287d0addd15b17048286f5f91ce72de905eeb573d175c64dbc62531e40a6448c07418f8784c7a4f5905879db9a737
-
Filesize
1.8MB
MD5ba384f29b3696cfa3b6f08da6dac9e7f
SHA19ffb1fe4ef308420b518f051e6199b19a7965b56
SHA2562bd43086cad13946a160dca22031dea654e2f1e654d3e2ae74477345fb6acd53
SHA51242d1ff41372ec196a9a3fb0d71fc51ea6c519b369305f9d25cb624ea65b1be667eba31e70b5b4fd6aa3e6b8d531d6757e5d400f4a1c88b0f96f536f221bbdc46
-
Filesize
1.7MB
MD518034175afe0660bb70ac74be07bc133
SHA1377ad6e80f08400f6296128bb09703f135deaa63
SHA2564f18f69d19b3d86815fd242a2d9300c4fa8718c08eaadf7818a72b60db031fdf
SHA51223043d8638f21a55c31cff3c9657b410a3dc1e1eb4a1f838cc11e7fdb5b3700701cb5cd5c8e1d18924deba0862b2f2fcb1879cb94c5ade0b2ce4b9d1f7a86c9a
-
Filesize
581KB
MD5ad36ce5de1340b8acf2ae4b4ecd4c10d
SHA1f03adbc9cce99415cbc377947d664cd682130637
SHA256fcd9208e86b20291f78d3450ccab73de7cacb2f88a60cca774a21dfadb489602
SHA512e7866a89f3c8e8fab7927670165ccf01bac56999b1958e60e63239f03b60457548c01ac53c520846b1d148c2c67441fc214e981515dbd52bd44d30d1c014a76f
-
Filesize
581KB
MD5a62ddfaabb253e0f16e63fbc79d2a01a
SHA1d228b19bb78ccd6b5f9f798e909af3dc9a7f11f2
SHA25685b539caca2d0ad24a97a9cca905f01a6bbfc92844bbfa2ffba4e647066ed42f
SHA512bb9d953f2971c36c071837773afea464cfe668266b5bc6eb849ff91e8965acce919dab6b3838cb17ef51aff583166661bcbc87a61ec45acf6b15f9ac8535a1c2
-
Filesize
581KB
MD54f62033df1da76e89d5587dc7434ab23
SHA12f21af3c98f31f8a6094739852d58275cd4ab431
SHA2564a6a48e10c59be3c0c0a407576aa3056b163a3076ecba5d6d1598e0a151720de
SHA51251306e61189da8a0fc73f23bebec46bc4581dedf7066d5c5abeab1918a6f2b30efda1389defb3bfc97c773369e0bbd85feb7d9514884b5db88e8d978b68c8127
-
Filesize
601KB
MD51190230fbfbe4bf710bc1dd6b298befb
SHA14ecee1d8785b39f878fe0ea520b10e5010b253ba
SHA2564f6a8d0840e7d7977c28b7d41adf82db223b43d979002293b5508ec1d3ece798
SHA5123b974a6a2f1494203396eae08395c0bf495046f06e14bc7ff08f063d9dbb77c256165537ea126f4f0e2f17d9df1bef11263a682461a109af3bcdb76102b68968
-
Filesize
581KB
MD5a991f7ab527af0c7c1c4e91df48d135e
SHA1dd2a16b8caeb7decc9ab60300fa0dc8e5de523fe
SHA256cad5dbd5ae087dbb5e3fdbb6b2e1336e23becef628c212e95765b43fbd4cc4a5
SHA512f7e5990005fe6919ad545abbbc96b6458f5d4ef35ba0aaa3bbab7b7e63fa0115af3608afc6cb7cd43f211cb372e2da2f5271f4b8d9ae5cfb93eeaacea669e0d9
-
Filesize
581KB
MD5bd17dc9f7119eb3a3737c981c856b155
SHA184ea0a7fc82611d7900a18a2b836a4d53d47a8c6
SHA2562c9621549b96f7569eef026b48cc356f90a24ea2640f0c2d6d9cf023eec43948
SHA512b3e46260837f2c74d76df2d7d8f86e89a09bbc95c18fcfe1ef73aea489de79be5c395c53a38e2f0488c89b8270e169a2bf5f837decb4ff07c24e7e89700b6aa1
-
Filesize
581KB
MD56e607422fba02467a1ceef6a0910baeb
SHA1ebd483f9fc4bcf9e4e0423f414ff18fd2946c761
SHA256cdc372b915d66e26a806abca61ce8399145f46df8442be260ffe407b36c05420
SHA51207eef5d855bb186b9da5c284221e65e6fa2a4bc6573019b2b594b8652e3d3d6d0ee5d0ae38196593c682d63fdfb35180fdc8ead678f009a03c6aefb7c7dbeb26
-
Filesize
841KB
MD5b074b4c81c2c55c7141c3fb20b78397e
SHA110300c3e5cf8feeee7a9853c2d73859224f89d21
SHA25664c3a25b1613793ea2a9d832f5bdb1bccc675ea51ec2c5a78726d7be2c409afe
SHA512c98a04edb82e592616ecc4fdd0807bcb5e4cbc0941e0e4a2bcfcc75a5634c969620be1e61b48d59550a138b7523157390d9621aa5fb1d8c9f5283c7b58752a89
-
Filesize
581KB
MD53315234cb94ea56c3de3bfa22a36411d
SHA176d0122bf90a98cf976211339edc609d013f82fc
SHA25691d40b6d6256e035332a094c695ea97dc3ac9076beffc8196a4ff3b339a4a7ca
SHA5123d277dcb876194d92c09d33f2f5ec3a3aa349c396e67ded4d274e0546b6daf9478eaf2501bc2f9e0d39a228141ff8f8445c20e0fc49c6748156da7fb08dac685
-
Filesize
581KB
MD50e9959ce8f51bf2c060b5327af8982d1
SHA1717f46b841e6c685cbb7a5139975538306d75850
SHA256ce80fb23d90e10083e27779aa80c688dd5e2935e8e0fe4287c393e8584bdc1db
SHA512f95bbf4708271b5bef05034cffd29bb73212a9b984029c32513c13c3270fcaa3c1ae9651c0c4f665f818195dbf5e1119989b459e8de1b64160766827388144c2
-
Filesize
717KB
MD51a2a85e73d3bf867d89eef73085182bc
SHA1b7ff4c1223f3192e58c121f5b5dd6c44e737426b
SHA256778eaefe0cc2d7818387a3c0ef809149ea2d9d1084e1b8a62dd4c2dfa610b59a
SHA512457b46c1774134f5b047467be2cd084558a212a477c0e309651121e05742068e357ee8a63f260c1f82b84fdfd8e054f9c2f0be86b7d8bcee90917f0cd067f9f2
-
Filesize
581KB
MD590d2f20e2cbb5b03a5e2e953e27ddb37
SHA10056c3cf5c96d55f30ac77fb45de72b3c2449fc3
SHA256b3d856f1633346d86c7dbedccfa6ac7b70e97485adc69b4f1dd4c18fb38ca54b
SHA512f4be40c7d0fe33018376fbc92c27e0c002db5b466e782c5a80f86f315b8b4aa8be139224ec63bc0c605c819946ba4d9621f31d0c7ef328a88435a84dc5f2ff52
-
Filesize
581KB
MD59cc376b14695938bad5d905e3860a29d
SHA18aafa27757472296624e50bde61119edf0bde192
SHA256396aefabb62fbb6f75e2e84fb3a330f994d0c6ce82ed44f51278ff3b2cf05e70
SHA5125f8f9bc2aa813cbf401958c31713afe8610bf49bf713e13171f4ca8b1afac6f258e5c4a6faf07f166f5704be1d1c2c7105e04e3d9e973bddc05edfe333f74cf4
-
Filesize
717KB
MD5cc44a8534af44d67cc3fd21b30bc0dac
SHA18cf9479779cbd24c619fe4bb339d8481d78adcf9
SHA256f46b51052ef72cae13ea6c8c6494a10a54b96b4a7260e0b7f848bf175d67387d
SHA512836f6b620edb27d454fc7f4fc605ac2312ec1b5cfd24bfdc7ef3809021b6da6161bfd59394a80bba2562e0db95ab376c55cc3914570395226d456eeb8d452ce5
-
Filesize
841KB
MD5ef244c93726559eaf6e7fc6a8e56bfce
SHA13410049194eb48e1ab40813fc0270f58e82a1ca0
SHA2566e66a098ce8cc1e3893cc7357ed0ce959259fc36accc04f7db91c8a2deaa4529
SHA512b37863d3803a50cc7dfeaa188f4160017544bef4c3edebc908a3a173afab6afdbfd2b906a341c518de09323ff4547a1132536c5e5f43574e74390b11eaf14e17
-
Filesize
1020KB
MD56e1ce69db1bf05bd200abc68d34d3b4b
SHA155b634e41f4beb19393d5bbb2b09e9964285542c
SHA2563490c7ededdb61e2a99e209c9d0e88c3bf38f90bfa19c6c454e110be0d490ec8
SHA512e5dcf3f2a52cc654edcca27600ef077dbdc870ae4724f3b733ce1d59c9fb00c2e4ee69b9114b1ec991eb9b4c32870a6183bc7b37200a1d9ae109716e656770c0
-
Filesize
581KB
MD516d7a0896ea9ccc0b3dbd3a9d72fff3f
SHA1f98493a1f2c5c364223d146c631afa29a0e8c4dd
SHA2563f5676454a2b2d1f10fec14d0c6b1eaa7fb89068e05adb951b0e8f0903a22930
SHA51259631cf694cabc88bf059f795c717ded20cb39300a2cb9b05f6716fd8d0cbf174e6d5b605b2757d6cff8927252050f1aeb0f20d74dea80517825731439a5c253
-
Filesize
581KB
MD5cc865845c2d908319935bbdea41874b5
SHA19a4d9ad6073fc591c28408e9f5fcb0c2f87847ee
SHA2561a0e30c61e6f20dbc01cb76dd26b8c73dfddf98e31919e5c5b328b08cb665472
SHA5122ef76100704a86251bc263ccfc3448a0f86828535a3c3914f9fe8bf9d5fca6f535236e49d9a7f4c9e638734a85c7cea9f6f8e85df4ff5f43d93a49456a397bfd
-
Filesize
581KB
MD5dda1e9559026b6e1e3b452bf6573cc33
SHA16cd9063530ecf9fa5ed6b658d7cf02655848a420
SHA25692247002ed4e4a8a4e4fa0497c9b308adc19d3de9876ddd0f54949621d18d47c
SHA512e730b87622f9e0676de29d0349e20b920dfad17770082d52b3f8e68a09a73eaea9a883a1d019c3426b5693e54ed1ae11018b2024d8559266eebbf9f2280c0091
-
Filesize
581KB
MD58984f97121c0c93070d950990a55046c
SHA17e2425773603bdb084a30dbd79d8c67e1195f78f
SHA256744eb162f2ccc5d8b0a07fd135e98d9847e9690aeff1d1e70c88219680443d4f
SHA5123f4aaa58898ad4e235bc54fd8fd5900844157e96affe0e14ad27a4f51771baa2441c941a524b847d0253df300884b14a6c2d5223792c6df58da9fb881865d5e8
-
Filesize
581KB
MD5e46f283006ba71d3d66e6a68f341a503
SHA161c0bfaf26fcf81570f3610e3bac7ca422c0f875
SHA256f89b4fbefe40f98cadc7fdd78e8093dcc3a684108041ea9bc3847fdef0a60b6c
SHA51241bbcccf4d9776ef9d463d75809144bdd4f89ff6db2af590b8edd395ffe89cbd805762114492b9f253dc7752e52a74a6eab462e3e04a0676d8d5bfad4b3428c0
-
Filesize
581KB
MD5766807acbcde061923c6e681ca9a55dc
SHA1505dcefdc28c73c037000b32f1d43f7df818f001
SHA256ea3e5fb05e1fb3616a0c42facadb769d066cd0f8eb40ed2f6e0a293558b87c2f
SHA512546aa21b15bff6b6999a9f730c9c46e454c394173fad91e1011490b915fbda63bf8a9bcafa0971c5cbb7aa5b24a53094308d3577f8e9821d7328039e7534b521
-
Filesize
581KB
MD5621b75501d84cb1c2c9d7a85a3eb9b45
SHA13ce10797b37c9f7f379f465d9a7f0f86fc8fca9f
SHA256cfc422dc4b02c86c36473977fe1632daab32c1032ea9af8d7146b02702f981dc
SHA51247e294073b26e6d1fc2aec18f1b182dc0a96b03c6aee57dbcaeed6180c202a5f1ba9473aa10c9cab7cdb887d1549bcefb83c84ce10e72e718202ef0352f2df27
-
Filesize
581KB
MD50cdfb6f61159753ed1b0b90fc238b351
SHA1a7a0e31adff051cf9dd9faaef533a088b46421e1
SHA256d565eecd8bf87d8c6e390fcfceb8e010d9a60d912b6c7ba05e6c3624e451bfdc
SHA51267c8141a89549446a314976565e5fa096387053aa72085e3905ff2cdcdf4f877c766d69bccd30cf6d427bf2ffc3bf99d362d5ff161331d77ce4948c22fd1e760
-
Filesize
581KB
MD5664e1a3741744cca3fc2839fc238c23c
SHA12b5602c02bcd2e1da74b06a50920c7a8c3ffc18d
SHA256b49a2fc3d8f36ca0e45f8324ae7129c526d140e96b4b25b836b1211e37a6458a
SHA512b015b94c8c95ed71f4d65cf0dee2cbb9bcbda40abadc85c21f53be939f9470a1e4c4f03e04cb58e31406a25d7967e18367ba0ee73e4e83c9d0bb21a9b1eba643
-
Filesize
581KB
MD59118f7b47af1b15b1c05b124806c8c42
SHA139b96ec5194652aa76d20439de5539eaa897c986
SHA256470d32bae35b45153b4a20563a6dbfe8cb890e2de64b587d9ef31059891ec490
SHA512f6262ed66879fa1d145903f32d11f205f9ad0429e0ea18106dbc8b09652bad9b9e1438558f92473f609181de029aca7b7a7e367b1d97646de772c1295b1a8613
-
Filesize
581KB
MD504f98b276778d60558091ffead0be9b4
SHA191fd2e96d303d166c941556e6d81ee289a463a47
SHA2561da5cbcfeccbefa344bcc5ebf8c8feb2456c2341ed3198e3c823db8d1bc8f870
SHA512f5ee763eb6499e18cba80278362561638d9fe25b1e113b908632635b3e64245fbe3095e1b9f159310f78dc145361261c4c516a80257eb2426b667dfab8728109
-
Filesize
581KB
MD5568b651191f0a849dec9d833c6cb94aa
SHA132a1ff4446c21e43a1875755b5e5feb7bd6d8653
SHA256a72296ee0398c5619e779d1526673ef5b002a21798a05513111357ab3e078ae8
SHA5127925275cb6fba3ea376418ad75208db37e50c0b7142cdf52033c9f9be94d5fae48e06713358758f12de64f8de609c0bf4280fe6d73d052a22e5accdb2121149e
-
Filesize
581KB
MD52451e2d3e17102894c777ea764c64ef6
SHA193620e41462cb3830d6ed5520abfc8c7b64477f4
SHA2568664809ef678b35064c8242ee9392a6ead11b364c0e3c746bc90dc13cfaba5e0
SHA51251246bf1b8ff2519fd890c2a4c44c50f26d710b8cddbb7483bc992cb76bc7716fe763daa25c4a42fbbb0fc97ea04572d4abfd99de8091030695c6bdb9a2ca798
-
Filesize
581KB
MD59685a86960f0adb3d9563a628f53e48e
SHA18635e51e72511e4e45228792122a670423832a29
SHA256710a9c72ab4c99ce303632ff182569592b947b2c916b0fde1dc2c05d89e2c162
SHA512f6953d4109b203ad9accf3ba3cc2abdc796d72daaa91e23ddbaa1111df5fd9e19ae18373b5e249c9080324dd4ec8a47d2a562472c63809ba5cd2e28ac97c993c
-
Filesize
581KB
MD50d6c84d5576f4b21c89d9ba0b214bf2d
SHA1a81876a4eeee417ffdb403965a99478ab284fcf2
SHA256d258a30a5c2b5b221615168cb6578f2e2ec603360729e59935bd58521aa60013
SHA512d4359c83fc9f5cd9a197aa70d5b2f2fa43c6570aeac3c1483920a1c7f62c694bc948b4095e5dd71252bd45642348a70b2666cd45f1debf10ed8654cb9c53db46
-
Filesize
581KB
MD53e42c257d89f143fe4a6c2a1717303ff
SHA15cdb2b4ac8d057c732659047f67ebd315b7bb5da
SHA2568f6e9761d19d856a91cfefc7569191431ada578bdcbbae6d05f0f57d48a65742
SHA5129c4c8e86bdfc335e594fcaddded5420d46f4c18edbfb5ccad0544ba6cb84ac6b4eb9bfed6e6fa8199e17018aa1d248db5895b20677d7f06653ac6c7b18f1075c
-
Filesize
581KB
MD590214a27c29cce9e48d6dc9390f9edb0
SHA122671c7af225cebf7bd619fb88e88d94aed69c07
SHA25687b4806de3ae54d52f0a4130dab44c000908eb4850356fa1e0ba1ae61d48a510
SHA51296fd319c1f3d6a628b95de164d0eed68fe38d6628ac2a7f140ef94c7dc244effb17b1185ba0002f2d2edd048a638c0b37bba96b81a62dc6d767c1c4f495fcb76
-
Filesize
581KB
MD5cf2c42ac1ec7d24644768d0d20aeca37
SHA1ff5d049909c5e660f1a3d1ba9fce4ae7153a4555
SHA2566d6f4b66177b021db1db50d13ce0dc36210e64a85e7a08b5936dc19c9b045d7d
SHA5126b1237aaa446aea98f58724ba5b66fa89ffb24e2b5d16cc9ce5f460e129318cbec9a9fc410c8c477cea7d038623a9c544a5ab420b7e370059f4eb16b69b3e419
-
Filesize
581KB
MD5a0dd6cd6ec1e1bd3891e008d3f6e3ed1
SHA1a538dcc90bfa5b409a278d790e9ffa1c68f49ad3
SHA256fac55d4da1f55300960470c3fabf5aa2bfc9c0a3a0fc22d56c62581615770120
SHA512de94c09c7a1c9b446e7c65a621ec05e669b24279e1163420793d5fb58ea9235758dee0a6055c13d30ab730a2f8b4a720d04f72e5efa7f3ab76c64722021b8d4f
-
Filesize
581KB
MD55714a62b2cb600fda376c4a00f3dd471
SHA147f9fb4e9abd5c29ba766194f9778088d07de99a
SHA2561c5e287651c2a64f47fb0be9c68ee29d1e3c299b2b6425fb3bb3c0724abfb6b6
SHA512fa555ec2c2d157cfdf74bc4316ca928f28f7440a0f6cf51fcea7fa37067e1de3d073787e4105f48647684a2684eefc70647f5ac9d41d641dcefb5a97205190c7
-
Filesize
581KB
MD5fe9e00202551668024ae92237317eec9
SHA194fee4c1a460240f2162e8183ae7dc8113983908
SHA2561f31719393a197d80053357a42f1141924990832df851903a33398fcbff75567
SHA5123130ce9b70f6b256b9fa1f6568a8111e0050fb03911aeae4b6718885e67e2dd1768fecc9f48c618dfff153e38d338cc48aef38e5142cab703701dcc1ad723eaa
-
Filesize
701KB
MD5902484b47921e2578447a64393344dac
SHA13fa006d11f9cd8ed92ba03c9982818e8e1ad1bf5
SHA256a12dd8546babcaf29ef166792df86be8565e85299d2d7a50c71830af5a1c1ccc
SHA5127ea731287fa5f4758f8257a9acb8e1bd9da0798688ca4f1ae472193008ca42fb955aba85e771b3a9e3fcd05b6863596954b007719a0f221d8243a8d617123940
-
Filesize
659KB
MD53371a5e1a1a631cb0bb84ff79dd51e5c
SHA1f817b38fbba568c06f08fd77fe8d95a945fb0bc0
SHA2561ac624361980baea06698de551de4463f646f7cb869230c3fee2d4eff7a58291
SHA5128425816a677098e48bbcad33320261a9b0de5bedcb2f341c1e779537aa75febb19fd88e0358f1ac91784eef43e81eeac3e9f0a11a048afbba0c9e6b326c8c41f
-
Filesize
1.2MB
MD50cff2da8d7573138369ea3d1b8e12736
SHA12eecff44a5f800d493add2c7f2a8bcb2ac0de318
SHA25641ac6e488715fb1b4a619579ba078c1d2eed031e1fc8383aa4011d2ccc053fcd
SHA5122fad88ea220faa476af8fe2758a527623b4cda107d39f0fe83d8a8edc465e2910f61e9010bc45ef7c73f499d7c40438d0888c38058175ae30a0da62656a70c7c
-
Filesize
661KB
MD54e0d3442de0ddf404f0ad978303184cf
SHA1a3570ed7faad4ef54eccdd76b8d8590df9deaad9
SHA2568a9f7a5c59e8120bdb5c6e50e6bda29c583ad743ca95b63692c04f8eef062f50
SHA512d5e40fa9768cb34c2d889580af6145f3ee008a47aca3cdc8f8fbe9f4e10d5dc7149566f4ddaf68257f5c415006bc17c3de76a30165b9f0846948938cbcb0fe97
-
Filesize
1.3MB
MD5abd442c62fabd8f30d012c0bdf8b1fb9
SHA11b723a61c9d698eadaebe7863f0ef3fac590fe1f
SHA256e925c5d87c54c79c1c6bef99fac98d987b89ea3abf4884a08455bb55f602871d
SHA51208a54335700e3b6b9c782dfddf6efe0ebe1224529a46454c125728d361bb5a08a1d483cb895de2e908521c35f533aa664a074d0d23216c710b7e64956249cd8e