Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
10-07-2024 10:35
Static task
static1
General
-
Target
2024-07-10_930df551acf3c024d52fd7cb892dc6da_ryuk.exe
-
Size
1.9MB
-
MD5
930df551acf3c024d52fd7cb892dc6da
-
SHA1
ded4786a5af4ed9230d5eadf51a77dbac85c4000
-
SHA256
0941951b140d006a71fb2c50219f66119341dbf9352b58b39fd30815153a9295
-
SHA512
041f3e7c305904dda245baf6352ef6e67aa14fad959fbb98a12955762e23d7e4c95bdacd5c02f190a2d865ffbf1164707badf79ddf975115fa2d4975d2c79def
-
SSDEEP
24576:W78r8FfC3F32nUnCdAaKu++nO2Hofe3y1sInB2COzRq8DvFqt:W/fQF37CGaPhP4suIRbDv
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 3016 alg.exe 4044 DiagnosticsHub.StandardCollector.Service.exe 4460 fxssvc.exe 5040 elevation_service.exe 2952 elevation_service.exe 4860 maintenanceservice.exe 1040 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-07-10_930df551acf3c024d52fd7cb892dc6da_ryuk.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\83d20c9d6003136b.bin alg.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-07-10_930df551acf3c024d52fd7cb892dc6da_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-07-10_930df551acf3c024d52fd7cb892dc6da_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-07-10_930df551acf3c024d52fd7cb892dc6da_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-07-10_930df551acf3c024d52fd7cb892dc6da_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler64.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdate.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_80203\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.106\Installer\setup.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateComRegisterShell64.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\123.0.6312.106\chrome_installer.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe alg.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2024-07-10_930df551acf3c024d52fd7cb892dc6da_ryuk.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4044 DiagnosticsHub.StandardCollector.Service.exe 4044 DiagnosticsHub.StandardCollector.Service.exe 4044 DiagnosticsHub.StandardCollector.Service.exe 4044 DiagnosticsHub.StandardCollector.Service.exe 4044 DiagnosticsHub.StandardCollector.Service.exe 4044 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 660 Process not Found 660 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4408 2024-07-10_930df551acf3c024d52fd7cb892dc6da_ryuk.exe Token: SeAuditPrivilege 4460 fxssvc.exe Token: SeDebugPrivilege 3016 alg.exe Token: SeDebugPrivilege 3016 alg.exe Token: SeDebugPrivilege 3016 alg.exe Token: SeDebugPrivilege 4044 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-10_930df551acf3c024d52fd7cb892dc6da_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-10_930df551acf3c024d52fd7cb892dc6da_ryuk.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4408
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3016
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4044
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:8
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4460
-
C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"1⤵
- Executes dropped EXE
PID:5040
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2952
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4860
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:1040
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5d6d1a2f39c34edb3b94e13caff257757
SHA1aa670e52630302789ee786cab4fc6e9f7eb9f61f
SHA256fa347e64dc6d6adfc21ab5b14a11bace5422fc82320d5de3bb37e22958e317ce
SHA51293e957cf3368a2f139c07c526c517cc341fde968b75d35493747b1021e9e9e17b3b2672658844e1e3f0ba2086d99e78d30bd66043af1e2063b63a56fd9c9e580
-
Filesize
789KB
MD53e43b69a0fc1c96e4f1ec794b8b4ac86
SHA1666a5d202d397becab5e8f19b989e2bf8292b34c
SHA256d00551a0fa85192d916aa214d8f1a0a05080cf5ffcb01dad2e3bbd680cf4f31a
SHA51266157542ac43b5c1a5e88e6dfbc0d1aff8261119356981cda426574cd13ec2b44c5017b05f70fc88c4688fa9605dee88348b46bc1a4bfbcc677c064ac0daa23e
-
Filesize
1.1MB
MD5878b140fb4f697495c8164733b6863ac
SHA1c4474bcd3cf659fdf44f00b91f8954df439bd555
SHA2561369c7af0dceb723e90e24aca7e70f1b3a95062f9112a04a89ef6578caf69eb3
SHA5125a7e9fad8b06fb68e912f35f8d052d95c56486f3b914da152842c5d7e27af1163dff2e33e1c804b9da671d331ed61859d697037061078144ebb9d08a6b26d422
-
Filesize
1.5MB
MD5c994566e655f2214dfa0133ba0590af4
SHA11bf89ec0963b28e113b12d076da5bbff42c8a9a6
SHA25696a37276d0e3374329f5955286e7d59a67fbc5ec30f61ea4ff34fbadab2d6051
SHA512854a8f2dd388441d23feabb01e5195b42f7a002eabf3d261025e93c71337a5d44b7d68020063eb02a4d27f0a790ac378925105a8b8592541f9c104587b785607
-
Filesize
1.2MB
MD51e086838a99b8ab266bbb99055863ea6
SHA13ca460ef09803770f92a928fae74d562a1012f7f
SHA256a5db7b22de7efe5d764e049fefc1db77cb75dcc2eb26c66da4f5747a76768871
SHA512256f2fb2a14b7e25aa6e2fece6cdb9026cdc927d079e234afb4af25a78cc7a4dca4ff5aa880311637a9a10b9663291b6758062c82aef4c1aedd7247dd9466e7f
-
Filesize
582KB
MD5f3fd94a4c3895155199441338d2b8271
SHA1bb20ed23b4e91f867b5e5eb2e182f831cad1a2ca
SHA2566f134f857767dd38617e014e47df617fcfd388216b84baa7fe818f7db378c429
SHA512dd2fb5372e9295e5c3acf262a90cb531a686d02f51af455cbe212c59ccb1b0a2fa6e6b85796d7e166b43d5a7b364c6a1066222ce5003d7b63280f4e2469d3eb3
-
Filesize
840KB
MD5ef9b3cfb876a1e5191d8376e0186041a
SHA196492b2388852effe28ade660bca5b66e46d233e
SHA256960f4f1c8731f249f5bf5b3f6dad28c8842aab88998fdea84087315be01711d3
SHA5120c2a21b7ffddf25c77bbd7b1ad2a2a220d1e0172521c4a8c26a8ae4b259cbccade9b08cb22295430083f477fc63c256a79c5467262845adfedf56d20365161f4
-
Filesize
4.6MB
MD5a8de2e49456ed61de808ac74f30acf31
SHA1b0402aff8e8b3836e0f6984b4a0f3babd70cb278
SHA2569affe7090c0d3f3fdfe02befd5f7e29c79a402ce9731c02843909e8941e7400c
SHA512bf98a40155cbc9f135644588338980b4bc506f32470ae048a8a684b1358db28b3dac3af012892ef23629ad463d97467c56242dd9764bc23185cda7d2b043011b
-
Filesize
910KB
MD5fa5b16aa3543ad9c4f73f81d3382bd45
SHA17889fed86ebfd569555162d5cb7dbd0c004c4585
SHA256399bbc67965b87f2ac599685ab4ecf39daf1df8f63035ec4021e4183ae225e9b
SHA5127d0b3f489ea26d2f44622768f335cf4181b1278058d605fb79439fbd6e2a216664113dca4a2461c3caca444117cdf0e04d3c506b0a79fc9300909790f16bed25
-
Filesize
24.0MB
MD5acaee019fcbe4f9ee9eea0c722e0516e
SHA10a9a99463dd368b67b19f221ae97cd071034e479
SHA2565020ae5b00d69f770b5ee0416e6530290e45f869a8f097b8afa1254c5381c1a0
SHA5127fd6743fdabff9083d2b18e93bedfaa446406a975d46c9d4514a9c6ea74fd18a7bc6cb4512adf10f0b54a09ad3253e0c2faa8df36fa6575379930cb70accae13
-
Filesize
2.7MB
MD5bc198c0fc94d6a2f5a1ab0e43281693a
SHA11293ba53edff3814c4a7b131cdfa73e9b4edea3a
SHA256c26266a866799d2e431081a6475ece2a2102f287e3043d70228f0057343c8861
SHA5123cfae50e1ce6e42dc0962fa44d802d07161f23f991b9ce0b6c4926013702882535b2fb25fddd3b23183c2568da0801be28bb127d74794b09d85399e879e67e3f
-
Filesize
1.1MB
MD51fd3f6fef2a0602ed490f44e7727adb2
SHA12470a12a1788e1b5212cf32d75f51971e0a2f221
SHA256e998187c70e720e1a18d64f908d8e9da9eaa87b2bda868331e072d1d0d6baa18
SHA5120a953577b8716e9b82d11048d185320fc63a33bf5823d6ae229aee6a9e9a1f97e5d326f6ada9358721a6eec9ee0d4cc8b30c7862269a1fb7e6d5732ce62241a6
-
Filesize
805KB
MD5ad12ce433c91c746df2e47aa7c65c9a6
SHA145c062d2aeb641b2e511b34b321129e57ca86593
SHA256ed03a7746e05df0b5ae06a37a52e72f4498e88cd6fe97313fd9912199a2341fb
SHA51270dfad32d4fca8cf831a048ea174bf3a58fccc692d311b3e7bda4d96324e976d76c1aa195139cb8d25ecb7035f7d37851a717687458887782bc6902debdfe1ab
-
Filesize
656KB
MD5ed087786e1681cff780ca80207ac1967
SHA10bd483d4010b8646ab5eafc59b092f7eac2c6037
SHA2561780fe47a6b7e65a92efc0d56ed96b4ceec06fcbed561036252fb75b162fbaf3
SHA512dda4c9558d26bcd5ce29ec3f0ed08218236d614f7990e61f460b3248bd0a09ce82db6623d8f55b64eb180ac142fcd609c4750ba5943133b52ff561b604891116
-
Filesize
4.6MB
MD561b9b2251472e2d358ed2b5170feb532
SHA158f8ceabee0e1ed20fa313fab8624fd50aaeb790
SHA2566f62e01383c5ba0c5618ca5d27314500610914fe44a23898d083d52c41735fcc
SHA512991f61a0abf5e510878ed4e1f1ffc49d4bc4a35f19934c00d690288e5f0810d79518bd9350d1f7302a9e3e7108aa42b7c37be35f29d5224f876b652663d7f7d9
-
Filesize
4.6MB
MD568f5edc7bfd8dbe33d3f8862154c0117
SHA193aad03a24dbe29715667e8cf029324cf4854d95
SHA25642196d39eda99837380a4127fc9e512979cdd318600a0dec80afcf7754e7e0b2
SHA5123c233d735b7ab379e4639bad0adc044f53c95298f116ffaa30e21dfbc4701c4ab197004d855c2d5ea8df3ba4349a20646d2dcfc7d61a6143c5b5ba1ba6fb7839
-
Filesize
1.9MB
MD5b3cf2ccc979f4026b2a131690f298880
SHA190e71892adc460ad2a865830ff75d9dbaf5d084a
SHA25685ea96544cccb75abd6060dbbdbddbc831b61c128c9ad0ff8b1ad2ca57e0bab7
SHA5121e5620d919ae390c4e19a1f822dc9508e50291fc3f7fafd9194f2cfbdeb65eb26dc533f4361595b8c79a95f903988844d74658c0a39aa8a16960792c1a2a4ed8
-
Filesize
2.1MB
MD584881aedf5595c59ca718fe0196dc934
SHA1541d5c9b574a66e0be264404be079a5bda3177a6
SHA25634359209ef955431e1fda8fed8a3aed2a8f98a0d4414a992fb233fa7fd7d03b8
SHA512eeca405a30488536e00ad75b6f13b584995685dec0dd40cbb111a678eb350733d769733a22229113686a5fd7fe8b59f072e6f63c170c1aa60f3805a541ab56e0
-
Filesize
1.8MB
MD5f9f8000543b921b002abfa6394c31d83
SHA12b6dad627d80a4efe986c5e67a19aa101de113d7
SHA256e7ba90bb63c1bf78766b5a21d3376bb34c116f74befcd8c00bb2683b8abc0512
SHA5128d11a8a6d5bf48b02a89d0219ac168d794dec67535b69b8ece4c6f72a7e8df075cf50135c96bbae308567b1454ec9b3af6bb8f065c4ff07c1909fa42b693a5fe
-
Filesize
1.6MB
MD5ddee0a16efb427e114cb75842f4b6c1b
SHA1e680606a868499a3077106c96fce7f00969f7b64
SHA256846699db92d2a8a35d854baae457c73974c7d6bdf083f5fbbf1ef666964453ff
SHA512450ea3fb3731d262c6c012f6db03bd3ae3c7dd40d05a5074e59a3a772cf8580fb4d2e43645cdad2ee94a0cb7107b3984d1ecae9b1f188b3d87e7384c7e25f62b
-
Filesize
581KB
MD52eeacb671c6a7f09015ef5781ba9259e
SHA1e2e0e72cc37e5f7395535fe1391b9588efce7c52
SHA256d8ca1e3870f64d37c48f1c0594cde01c85c19a2e3c0bad284f83e96d7e331fcc
SHA5123a263cd03e87dd1d0d57f1cc54b9a16f7bfac87b88ebdb8694896cbcda870b808eef0586ca82e52c062d2c6b9ba38d9736115183e33e0ee23270c988726512fe
-
Filesize
581KB
MD577f9b5318d4cbbe55f8a3f991b423456
SHA1518dfd2c8ec002e44084858960ed0b92a95c6565
SHA25600c29f3d38fc6317a80a76579a740ef04a8918562f2cff9ef955cbff158e4779
SHA5121914382f21b675d3146dc5f8ac8524f307b616a6da70195f546015411b4e237d285668f6c45f24fd1602694514d2f94b3d81b95ff22a587b21810f5b46b0bc45
-
Filesize
581KB
MD560484ba6e8a82b6cba2d56c2885620a3
SHA1a6a29fded78a46c3db2cf6580ec0575a2a8857cd
SHA2564c15082c30d714eff26af04b45cafb834a3abec32e5eb6bf7905a1ab1e4206f2
SHA5123dfb413b0b2c0069dd8b9212d0af061187dccd2672b1ce236797924bde2834692a612b22eea630ec0921340080af036451a63dc322b1a18118bc61986d0cc3f3
-
Filesize
601KB
MD57229646ad3a7ca9b6509d7568fb43f05
SHA10cb4b87e9815c727af55c9e7248b477835281ea4
SHA256793469f91879801451a5a4bc0d6b448deb9b7979eb1e64f6edecc27d94052ebe
SHA512756e2170ed46210306595308396f9f85e247f433b77a0a877314e746ff448ef3686090ccf6ca307ad2c60c38ba08947c499ac7db16ef7f1fb17daa292957f85d
-
Filesize
581KB
MD5b842cec74600015541859df6bf80d69c
SHA17caa3728a26ee93e47b2191e3e8439c5406fc0f4
SHA256456448792cecf1a7666e0cb698b997b2bd9648a57084f5cd99128f84c07a3b92
SHA512207aba353356ea490c0d3262549c92c590631f540625faf3747a5c41c485d968e8d70198ada20b541bc02e93c8fb798d81cd93884c4da1ad8ac7912cb7530064
-
Filesize
581KB
MD558a7b0316e0453ed43e7432fbeda7f10
SHA18b83e86278d8611be6f215a37f67e147646b5a0d
SHA25658322dcbb2802a769b20e768e84fe9f436553a00924af36edf98ee8e3c10dfe0
SHA512ad76665cdf415a685b31e8779a6200fc1307e21c683a347295bf2735074751384ed7434b73aa74083f7f1aa28d8fbe7ce404e281d4f136b69e7e4cb8ae6a9712
-
Filesize
581KB
MD5e6d878aab6a1343a985471d768b4f7ac
SHA191ec9763e64c7a430bbf86f683925ba8a2ec4c25
SHA256aa106850e6860d5c10af6d269760b4ba5ab0bb698281e085ff363da43fc5a850
SHA512bb759b3dde1c32f11a8ffb06dc4d7c8d124ee4057c515aeba504ca0dec3594e8a3a6fdfd38bace1f994e23547109d423bd48ba8044b385da54f65e98a1bd056d
-
Filesize
841KB
MD5d5cc4c0d12d81488075cbb57bb634b4d
SHA184bfeac5604d31161928de01d093ad8932c49bcd
SHA256a054510ebcec480726e1598a74f3d1aec17fd68f7191d42c5ad7a26d9cff795f
SHA51209ecba4c4388acf6ac6fee10b3da0bf6a6123f9a3da771561ffff54b023c73179b7570e5a271447d4ba08c324cee0876168482905023843d5476445893d2549f
-
Filesize
581KB
MD5d3a4ad507b33aee2496d27f892ed9d1e
SHA176fdc62127c10a516c6bed5a5bd0ecb0ecdddcc7
SHA256281c500e198dcb53514192df47505de07d0932384725b28f7a30987bcd0d0ad6
SHA512684f67ee7713fa59fb5efca1b77a583e950fce1c688285ae43aa4dfea1e0925e8bb000b3826e770d16bcf1c53bac0d1369ffa8dfb30308b1cc51141d3cb3e4d6
-
Filesize
581KB
MD5787b01db1b88ce81d3508cc6de1eedda
SHA105e5d23a4645542bfb4c4f0b85cf88887d4dda98
SHA256d427998e44a60c79e227abd82bb401f2a9b3968bfe9c33ee5061c16eab0171eb
SHA512abb2871d7858a9cdb37dbcde3f0f8fca19dbfcb27223159cf7f161d4b96126c5883e40e2244882ac12301ddb0f516afd4960600ed545344f9592bd813d789a14
-
Filesize
717KB
MD598a7e9cfc5be7ebb4c63e9be631d1677
SHA13977951288c2a12b908ba6d75bb140c12e3e8b4b
SHA2568663405e463cec1545944dbda8f804549f252e2be55d07f65edc66565a20be17
SHA512a3f833aeb9bf727a221aba62942be76d0bcfa866a6d7d42073c156e10ab9acb527c9aaa4639b3bbaf4e66bdde81a2f93b8133f4fdafc95138a447da0db16b0e1
-
Filesize
581KB
MD594e36a64a1893c0d2edf0c6d0357c814
SHA1d2101a197847bdd95e570f8a8d6d071161edcfbd
SHA2560bf1acac814752cf6ff1f3de559d3083b143d04a3597aadbe17430e5a8506138
SHA51282df465e3832d2200c857e39f83cd7a2104f2ed9ff45e7e612593dd62c9bc11a9be64baa0d915fe9ffc979d6408e575e210bab4d04665bf515555f0f8f31b6cc
-
Filesize
581KB
MD5284ae809e556eebffa58e43cd39ad312
SHA17e440c9ac6a6f9c8b15a7441b372e74c73bf8d50
SHA2564f974fdbc87c03c9d629b8e9cdeaf237dd2d5cab4291ca24cebe28968b0e0ddd
SHA51271396268f4adfd5adaf3e0a4f2e47f40019fa0368adc8e08ec33fc0fdc3701309779e333ac8557bb37ee2c0edfcf1a7ec5061d92510cde4041a6696d785ce75a
-
Filesize
717KB
MD503ce362bef67eed4203a7265c30e74e0
SHA190fd34d1cfb5202d5f0ce7d32e615a75d2a1e3dc
SHA256b2d05a60d9df08f60ebf00118ee0c110cadd7eee88be9dee89fb1fc542b8f4a4
SHA51285f5819f10d18dff292855b4f323fc0c25f741a1093740b181bacbf9ea135f964d7c500f3d93eff4bd1118bf6567f6e3aa76c1b92f6e43f9aeeef4aca37c7d82
-
Filesize
841KB
MD51f088a4e3b3bc48bc4a717f4074e8a55
SHA11ebb6b2beda66a3c593f78ca17f164b15ab6d868
SHA256bfd67febae59342b89e62086931b7ca75d92f401caaee25cea664bca51c457a7
SHA512f1a11a62c24c0eb1938d2cab5a268e0dd765f7f39af86bdb5157b9b47787e9df69f872cadc142b422510738079fff3238fd7acce2b9c9817d4755d2ffcb41aa9
-
Filesize
1020KB
MD58ffd6ed86cfe379088586d715d7901b3
SHA1fb7f9464f9ddbca1d305f9bef674abcbbb41ba85
SHA2568f965ba892ca6dc73bff68bc914b7ec54a6a00913768a7cc183da424d42c8ee6
SHA5124036dc016bbd5f0b343b9c7a75b393eb4ece59e0e0322516708ffd2ddecb58b2e01a765b6fb69cc25acb1e3bfe1c6660cc0fb353f8b879ffab87ba2ff09a7f50
-
Filesize
581KB
MD53510d348b2a1492dc0e7a829caa1aca6
SHA1a6ba00c4c3ff8af90bf69e8b5a59a40a979e844d
SHA2564aec59beca87050dee964f61f1632e2d71833248d8debd70b666d90f269aaacd
SHA51288f2f69bc1d223069f9131e90cf395981dfc3638a2a98b7eff8cf3639058a6af5c2ecc7691f3ad9b6ee45bee94232b7858ab37a2aabad86adde87605303ffadf
-
Filesize
581KB
MD5d9c937199ccb295ce3938a01664b3375
SHA1b4199ddf95f9645beae2508714e8934351413d6f
SHA2565c69384e375692689a96f92adea13cc6763827945513f6e97358428012efae60
SHA512592d3be84ff8af1a702251f2418147143a7fe520b93695deb70fdbfc07ff51f78160a6da3b7953efc4a5d288d8308b508f227d3fec55a098c59c1121173a007e
-
Filesize
581KB
MD5c095e29e6b68076f141c9ee8a02b09f6
SHA14e5ffd84e56ccff2a717677375a7ec69a3fc65b3
SHA256a009e78c922c1755bb50a86953c470c110ebcd0a1a431817c633bb5ecfa5e790
SHA512b6c330eb253dbf5ae4201271e13ab6da156e9e159584f9224a430341ef814e7bcc0239b6ad6f7d93fc0090e4bccb0d95417dbf3ccd162158211d6630e2e831e4
-
Filesize
581KB
MD5a5404c711cb4a15298cc233a8858a408
SHA19d4a696eb539566e44c6dd5141d4ed76bb278004
SHA2565169ab4a980907a95a9448c7e1ff40801a698f981d08fc6e6e59b2f7a245994e
SHA512ea5e421989c32ab390f2b1ea335aaf4f25110e7998f9d8b499512002adf1c3a15e6c988b3b4b4c7883d50a560bc278cd1fd7105ddd48c553309a30adf8ab701c
-
Filesize
581KB
MD517da44364fe9b6a354c744d94d82a5bf
SHA197a2697f842f605869e859f087e031358fbc1484
SHA256e3de99c1939a7212a3ef35b92c4bc3ebec40e3ce00a23032e910388836feb155
SHA512af9940df133d4cb76cc77d5be432fbbef84ca8e4fa9f17bfc73307d4d572cbdf31e63d0f149f3ce4b0b29403a1792ce06e4a2885b8101e2ee391c40334bc6dc5
-
Filesize
581KB
MD582e59ba73753c84fb66f52ea0beb2ed5
SHA1221f1c154e568207b9a895810c8a9f631c58f01f
SHA2561ac1b165d069767edbf46b2f04758d7b75a52c6eb58776dcf70e7ce702cd76f5
SHA512b9fa31edfeda82f5f2ce6b41717a679b9e59206e25c24e45741ff7bae93010d1cbfa9e5ec921a5bd3815d26f44da06a7bec64abdcfb74ae292916134256f140e
-
Filesize
581KB
MD50f90704a6931913bc69999ad184bb4b1
SHA1f6f33e2fc7ed5ebec79e45239d3438e0b410055e
SHA2565ae8acb43ecb475d79e85523902fe8685415890fa19b6ccc9dc6b88cf314b6b9
SHA51210e5d7a2d51effa35c6b11815d0cc48ec6428a98dfd49578163852be79d03a93c518433d70a7eb678dbfc7a51e809b0abf7355d3be7123a9561b298d7967c15b
-
Filesize
581KB
MD58e436fce843095dab2e84e060abd6fdb
SHA18a7a617f897393053e8a196929b5b54ce6358b58
SHA256252484ca8c0b9e69d9a83b0795f4ecfb55c788d9d67086b5a6063d7225de1666
SHA5122e30739b3d98806b83292f74c660207f700f5d9c4d4e3b82159319237f133d64f393c5e4fe2862535b2cd6cc4d57fbc3b8816fb2f957091c1522d1032ae2caa2
-
Filesize
581KB
MD5d9bbdf067b7b6e3fde64b2dd49af9ca2
SHA15d7026bc9b9d5fdd810afc1342a24c9b9f5ee03f
SHA25680b659e1fb8bd4c79f9ce4aea9c76c95e8787181401a6dcbf2938091a488b06c
SHA51235cc8334a18b11f2d55ebf50c169a08b266908f4d2ec984fc94e1af15a4868f5921aa8691158596bf467e8dd894992eec6db09ae74328a79bb191b566858961f
-
Filesize
581KB
MD56dd6f047f661adb05301a2aa0412559e
SHA1481028c5b90bfac1cde556c0058700105c096d13
SHA25623e85a008792adcb1233bf262e9b2e0d3399967a9b5a034106008e1572fee427
SHA512a9d35efc67d6223d7ae005cb767a21a05786ecb5b4e0e234434ef5315abe8b3672d87bc5495801dfc53f907f6addccfac50a62a818a0820142be73fa7e0aadbb
-
Filesize
581KB
MD5b8da087e1d662e3a7e20cd401604e6fe
SHA1cadcd6b4df63cc996042e51f71282fa9f5133367
SHA256b7f2b6bf0622c52208a99643bfeb2d0e92ce0964bbd96c2a50c16c74e562c737
SHA512f10536250e43b27f1383fce3ed6d8d338dd744ff16ca5400c6ce841d567e4e4aecd0e7dc4ce7b600f8ef8ba6a446aa38ec7147ec7c6335a258b546a3a63c3de3
-
Filesize
581KB
MD5cbdd76c11c7318915a727d2a7b25542c
SHA17f6196c27c8cf66397fe1ceddac192acc4cead09
SHA256314693ad6a65cfd857049f591d905ddda6c36030fe5ffd0e55b902293f81eb60
SHA5120cd62528229fe049b52d07362158d7b38f5a8bc88035fb69a3ac3653cc58da62b9790efcd5aec8c451c62a3a10c647f92b2db5bd5473789bb3d764e4c5b7a65c
-
Filesize
581KB
MD517da507a58290994fc80702d42748a80
SHA110da20bc82a0533adb499bb4687910a2333efb94
SHA256287a508beff963131da5bf6d7efd465acb37fd1ed51ff920c1268cbfbf3eca9d
SHA5120a9a7debcb4b41a80e4b6f43dc1a91542023a9f62796b4507d2b18e6412e1851173ad8162298c2ffa574f63d1f870d4bc56bb4f4cfc697ae07faf25476fb96f6
-
Filesize
581KB
MD5dabdd2f45cf028df84f46cca4cd88b8c
SHA178fbc766e5bb3e100102caa9aaeff813d8b26064
SHA2566d40130c544400021f827ff1bccce4e8b8ffa74484a74c5a7c984c3bdebefa67
SHA512446756aaa60884931dd8e255f46b163387ccc2b579fc4b8c22f3067b80191c91853f1a2443f06d1bb41417111b6a747b3eff48747a8cd4d6e04d8e105b893d70
-
Filesize
581KB
MD567d05aa08aba01beafcdaccab2a2af17
SHA1df205b4b9a6d19ea5e744415240e47b2b4c2b17f
SHA2567a02c0f1069af45e98ce07970bdcb887efa2973edf7ec362b518ba604894f506
SHA5121d02af74ce25b14c3af603f668469a6acc189e257055c2e0191340e2890ca9136a4d1c12a1a0b79d343bac0b187646037806ac7e0cbd801adf47041f8d201109
-
Filesize
581KB
MD5cf5cf1dde644310aa93da2e61d99d6e7
SHA149b4d63d3e66cf6644b60e4c71dc676602575e87
SHA256b4920d170db4d957fffa15209c4167c497fc6643ea587fa5d6e00c34953d6488
SHA5128b44ad773f6a9f2213c30adc145dea57a5a7336b1ccffe06b21b982033a920f892ede2edc9040ee7c795db22b1834e036ab40db787ff07ec647b8db51dae2364
-
Filesize
581KB
MD53ddca279ea4524e20c239d07eec363de
SHA11174aaee5bc4fa9e91968c8249677162fc9a37e3
SHA256f7916f2712fd58f025b86dc4e0c3b6ae833ef234fec17a1c5586718b372e029f
SHA5123d2f80c3624b5b5f00d3d2b5e5fb565c67320e6c38ec7923eec32479eb49e96e4c1bcf390caa67d70c262b347038c9125bce2b80417a7eb86b79251920d905ca
-
Filesize
581KB
MD50cd04b56c92f362adfe8ddd04ad9229d
SHA1dd6d060ba03445238524c2f9a4624052f10a37ae
SHA2561a8422aa16e7d4c3835ad7f9ed3ff86b3e6deb351d4a2447263607123bec6724
SHA512d66b1df62ba8306a1dbd0b9aa3d3e2ca0c7afd354e5fc80bd46a032ab6e2e0bcb5f379e092d2f017d4bb0752fdb211811a690d43d390786260d1b496a25536bd
-
Filesize
581KB
MD54224e30f5c92a583debc40ac3c55fe70
SHA1abe07bd997e38d3b4ddc5952fe715d3f6ba57365
SHA25644ce0a842d0d28eaafc1d7ea14dff5b56f5f1bf3341bb1127b203bfc0133a6c4
SHA5127db36a31bdbe6db2723d600c7cdc58d31942f11063e8a25fed94f10c29e6e1108a903eb0de4725dad76446dbd2d74d877272de7e1c7da49ad453e6a4812aa7eb
-
Filesize
581KB
MD57f0bf2fec17ad78ff352413a1b29943a
SHA1bfb9e8e745b6b5583f60eb73e68dbac75024cd95
SHA256f57a941e9454426420360d1475fe3766d60ffaa641df55a84add7da3aab1b61d
SHA512c8f6e5e437911da53fd9a3455522cfaed384cdc5c8aefbf933957a9764574a3448328ac3360de68debb4762a96bd190b2fd91add17a02d83523ee976517fe076
-
Filesize
581KB
MD56011e891e0fe47aaa5f994ca03ad7264
SHA19ce69ccaf759f9a87feda463dc247fcca8aa80f4
SHA256ce9cc3ccb01237dcbe27e60880a7a9a30a614fb07ebfc56c6598960b2de4681c
SHA512e2fe63d8f91fe38493569e21e1c808b69c2f4086b1803679a0122930fe512cedcce659413dfd5960af927ea29a878ba191a53e25c74cb88381b1a5cceaea20c5
-
Filesize
701KB
MD536e1aaca12cb44260f5e6968d3e108a7
SHA151b7533271899f3030c719730be07663eb5361b1
SHA256afdd5527c192654d6177e25e43428732e206adfa2c38eaec1717d2518b5c819c
SHA51293acf17d5c7ee188b35f014dd9d8314489f1239ba46f586d61452b33adf2f171c726c516b18f169ff87825c030e79de501b367acdd13904d770a36d436cf8bb7
-
Filesize
659KB
MD5195d839c7f855ce80469a26f71c0945a
SHA138c1e4007ee5fa5d9114e41e800c2df15086f503
SHA256f9b5932008b30c208fc6435659cae3242e82028494aed8447822f8526decfbfa
SHA512bcf3294a8085c5645ee22ef06e61f0b0158ed44a2c045db732eec6cd9abeebc0a14c49e0fe2fcea4f84583c4aef8829430167ed0b0679ea571af9ea471793d35
-
Filesize
1.2MB
MD528674344bf0ab88803b7c0f867087464
SHA1aeb7c1f81048381dba9847e1b5f8b553217e326f
SHA256b7decf1c81a912ed10c0876975fc04de3b29d5870c86d288a9ac555dd05a9b1f
SHA5123fa25d416b4d39292bc4ab08e74295d448d8d3b8b62ce3856cf9757062d4a856348e10262fe32de33dd2221836f12fed5929f6c14ae6f22a0b43c66dbfb7e179
-
Filesize
661KB
MD5efba247b27a8c8a2df97aaa931d2d5ee
SHA14834bc682a84af132e4730094149d3221eec7171
SHA256e5334b6fc2c107be382782f3475431af1ae260a46229700a09eb0fe4a56aab22
SHA512e48f4736b759dbf24d9c3c0e9b79c6611519aaf4c520921f9f5a7e952fdfd625e6cbbe2c85399e8b265d0a3c95a9c334c2691e8876d47bc77c6bb82ce1985404
-
Filesize
1.3MB
MD5896e9c72a03c7c3ba234af1c6b90fcac
SHA110a8cb8a8a99ed75ba0012579a04cf2160ed129d
SHA256bdfe9ab2b7a2cf91bd7cc6f262f529b75f2efafab282a6d74db7f7a914d31d95
SHA5128e7859a1bd19ec1b55f57d63e122331744de80bcd992ab5b5a039daefbac676624cf9c9b414bb6de048b980582a5bfcd72d30635d9f74b00c21e0ddef001a91d