Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
26-04-2024 20:43
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-26_3d86b6aaeaa72d67339ee9e6297ceae7_ryuk.exe
Resource
win7-20240221-en
General
-
Target
2024-04-26_3d86b6aaeaa72d67339ee9e6297ceae7_ryuk.exe
-
Size
2.2MB
-
MD5
3d86b6aaeaa72d67339ee9e6297ceae7
-
SHA1
7298b3e04a42a0346fbd8e724050e1451381a845
-
SHA256
df403033012a7d0e90a09dc702018e68b3b639371b78f5bf46b975b7c9910edc
-
SHA512
716bb66bb228712b0de19db20e009efbfd1a8b7bae65a3b950d3547b9e1e63ae2c2b16359f1cda6fe199802b40caea227e39b1b1077c1d573ccf85836c9fd645
-
SSDEEP
24576:jOObVw4TaN1wdkukCba4oXtgLhU3wEdmh583SkQ/7Gb8NLEbeZ:jOOh3aN4kuLbegmtGvkQ/qoLEw
Malware Config
Signatures
-
Executes dropped EXE 8 IoCs
pid Process 2560 alg.exe 4860 DiagnosticsHub.StandardCollector.Service.exe 2656 fxssvc.exe 4768 elevation_service.exe 2008 elevation_service.exe 3552 maintenanceservice.exe 4056 OSE.EXE 1440 msdtc.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 16 IoCs
description ioc Process File opened for modification C:\Windows\System32\alg.exe 2024-04-26_3d86b6aaeaa72d67339ee9e6297ceae7_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-04-26_3d86b6aaeaa72d67339ee9e6297ceae7_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-04-26_3d86b6aaeaa72d67339ee9e6297ceae7_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\System32\msdtc.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\msdtc.exe 2024-04-26_3d86b6aaeaa72d67339ee9e6297ceae7_ryuk.exe File opened for modification C:\Windows\System32\msdtc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-04-26_3d86b6aaeaa72d67339ee9e6297ceae7_ryuk.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-04-26_3d86b6aaeaa72d67339ee9e6297ceae7_ryuk.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\5c8a0caead45b396.bin alg.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_99140\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe alg.exe File opened for modification C:\Program Files\7-Zip\7z.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.106\chrome_pwa_launcher.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe alg.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe alg.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2024-04-26_3d86b6aaeaa72d67339ee9e6297ceae7_ryuk.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4860 DiagnosticsHub.StandardCollector.Service.exe 4860 DiagnosticsHub.StandardCollector.Service.exe 4860 DiagnosticsHub.StandardCollector.Service.exe 4860 DiagnosticsHub.StandardCollector.Service.exe 4860 DiagnosticsHub.StandardCollector.Service.exe 4860 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 656 Process not Found 656 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2716 2024-04-26_3d86b6aaeaa72d67339ee9e6297ceae7_ryuk.exe Token: SeAuditPrivilege 2656 fxssvc.exe Token: SeDebugPrivilege 2560 alg.exe Token: SeDebugPrivilege 2560 alg.exe Token: SeDebugPrivilege 2560 alg.exe Token: SeDebugPrivilege 4860 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-26_3d86b6aaeaa72d67339ee9e6297ceae7_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-26_3d86b6aaeaa72d67339ee9e6297ceae7_ryuk.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2716
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2560
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4860
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:548
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2656
-
C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4768
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2008
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:3552
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4056
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1440
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5f65c1bdc9067a3e8d7ebe7e162e33111
SHA15d7d354b3a5acbf979d5b081b036ec28b8e361ab
SHA25612c22ecb430d5b2259e4544c5a2c477e41a4bea910239389afe06b7be885ea6d
SHA5128687d46f1d0501f44d6024cd9a1a7d8931a841de3e7c0eb31f42f4fb05aa4ebbe6b4f6d5ad833015e5abce586eef4968eebe48da45c9eb0c4bdd00865f078f4a
-
Filesize
789KB
MD55c5aa6e352cb7cc16a541c81e03db8a6
SHA1bb47de451aaa7ae1fdab312686a6d40f9aec1ece
SHA2563bfa3258bbd29639ab4aba167dc82e4d28a0b751194b6bec955ee648ad864872
SHA512dc47010ded14354c250bc14a775af259c6705e3d99e0b34e7b6c96a6bc25b575cbbc1f81f817fc1de60cebe8d1ff2cd39cf86176208955e70e860f0fcbc1fa2a
-
Filesize
1.1MB
MD527d5d21c3965af5819dc98cbb6c9b595
SHA11d63581d6a9d2a6ae1e062c9091362316cab49b4
SHA256b8c83fd1d442c6ef0c2d0722b97593b7be5515ca61a189e76d1a7fe5e1fda320
SHA5121f90cc577518c7e4aa7a2f3560dd181fbfb81095367201e7e27595faa85df0a7f7a8c250581ee94b4671e9ee0ff2c78090f46ce2bf08ad82ca8630f0c0e7472f
-
Filesize
1.5MB
MD5381ae76d11af910c5e98fdec02702eb2
SHA1e0a60c5d87349db7a872338ce336f9fe2fd13d4a
SHA256469b62536539a95a30b6ad38436ce83d0a740e187c48f33f7b0abaf09a99907f
SHA512545ca1da12f4825edb7754617b3810aee87321b30115d7b5aeff21808a310d191d1c537388f3a38f807b74a7e087728722f0d195af21ec163eeeb12bf095acd6
-
Filesize
1.2MB
MD5bc4e061342c36add39cec725569750a0
SHA1908114cfbdfc494ada86a2caf81337c80508c303
SHA256b3ee5561cdebd637f1abbdfb1c6056eecb339867378daf39430c2591876055d9
SHA512d7dcd1d0c952c24ddd9ad7a3eb070379d85172b43e2ce25cadad5645768a4b5a11f38738895c4eb9f0e3e44d85273f5f0e4f8601e03eaf3ae610879c069b8d2e
-
Filesize
582KB
MD51e9557c7e412b82011e47215a8d0082c
SHA102cc2e7f65c2916fddfd58d72e31995e27440db4
SHA256f5fb21903e2d02f7a14708a7d4a1f33f8623e5957d62966a447427be6150a0b5
SHA512d1040b5cce685fdcf29b6e1efdee4cc39a8f501d2bf1e1e4eaf5e32e1b8f116d179cf967087544b97ebcdadab8f24a2d07b32da60bfe6f00845081c4cc9020e8
-
Filesize
840KB
MD598f7d92f2b06312ab70463e0ab9130f1
SHA1fe7ac3c46c52294b247d00841f794b1265e36c54
SHA256eb508a4bcb21b30935240dd540693a3f59e45b92b924d77bbcca7a5fd2956a2e
SHA5121109f8c0fbdbb360e98306891ad0c59cf2eec451738d80abc5d29988882e78e9cfe5bb9cbaa2844ec9c24f534f25a1ea324dfd0930eff8294b7514f0d8996b86
-
Filesize
4.6MB
MD5e5aadedc240d06ffd616947778aa4d3a
SHA1dc9063f01cd05774a89c9deea812059eb3c1ea56
SHA256a8d2692da7b9cd930a3436a72ea6819394e63ae613b342e1b7a44e8ee7f9ab7b
SHA5127a520a3b91292f490d71e084f40e77ea5bc8227efa20c26bf5cf0e66807c27fc374903347021b06afbafa737851cfa711cd746e2b2a6938f862d8a5c856b9628
-
Filesize
910KB
MD52d13132f117e03fd25dc7b5e0de36e88
SHA17cb0bd12fcf340decb03cefeb6e2d0c67cea63b4
SHA2560c5c9c1554b19c0418fb035483238389f71c26cf2787600926054d2125099af0
SHA5120fc77c3738305b313e9b308ca8576933f90529bdcf4fceeeac2fd52c4166bad46c882748fdfade3c9383abd5b5d4e66a8255fa4c202c47f1b1a365ff3c6801c1
-
Filesize
24.0MB
MD5e9730a2154c2a7a7bc90f8484a454e9f
SHA1dadd120d5bd79aa4e716671a54165c83e0393d46
SHA2560a6d714abc445f59f3d5b6e1cb61988d4db59db631dbf110dc23fe79782b6364
SHA512822061f3005a8f2e25451245b2f267bd4792e73e1188090cb35e2e0d7c49c13aa0e53cf158840a65c422f776f0484f0e430ba7805d4c94166ee9b99325c1a650
-
Filesize
2.7MB
MD57e493b31a8a59444bab867bc33eb2259
SHA1791f7ae96108ada70b391ff889566de67327a1c3
SHA256bcba26a9ef2ba129fa3f3efc5972e66a0b62d3c528b45862722f743c17d45213
SHA512790632417527650a642d8879440a1d2b7e070cefca3fec866b11a8cd2b2e042bd7bba4dd563ff51fad17aaec628c897151e4822389e1e1f2b0375f9cc375481c
-
Filesize
1.1MB
MD5a95caacbdcbef4ad69906839ba9073cc
SHA1f5c234766f81e8e43ec88774aaa1cb5bfc622199
SHA256cad082175a98db5da61a1665f77d22e272ced2d3caf3458a0ddf2a4ef7444e1a
SHA512587889cd382c1380e67eea34e850a985e021be93ad1576e11c229c022e5d09e2537c906344377dd15885a8cf1f011ebeb36aff829ebb4287d17e4c27b27fa8fd
-
Filesize
805KB
MD57bcc57b8401ecb663629d0f1aa3494ac
SHA160b4f1bd876d2c0a190a24488b22428500decf56
SHA2560285c453e4a39652f523e4aa12468946571e7f4b192821a331b54953931a89d8
SHA512f1d7ac9f062c9abe77bbc292205989bf9867862564c788ea9ebb5285e5ce7cdccfcdc82c0e01dd08e5a2f837ee44cfb550d2e8783bc98ee60cb4988fe8f07ff5
-
Filesize
656KB
MD5271c56922975a1ae2d438adae6ede838
SHA1e00a591a88854c1fef0205cdd96669b5b872e305
SHA256f7997d67a03590726e363712ff810cced363aa8986f4a595d2717ab4579436b4
SHA5128d5c16f154ab485a75e8c5ab692938c5349c51f743068007eb64789242e1b9fe07e33888c072c0320cb7b8f6dd14a514b9dc6c6ccb321315580b56a44058a93e
-
Filesize
4.6MB
MD5d15011c21a2519e23b8bc560fcbd83e2
SHA1f130ab601e8fd952aaf00f8d430340f7ad87c034
SHA25645dd19008563f77d0bcfb70a6d7911d87a5fd04a71c94af03fcc425dc73b2dfc
SHA512e862894bfbc5664663ce9081010bf4e204621d99d79795ef23a105617770e34f367acc73d6e63a2664593e3dade2b0e967633c9fc2fb04058a35afe26afb591e
-
Filesize
4.6MB
MD5b005e774347f1e65f89dbc2632d69212
SHA12c2b3177d3ba5e1520d1d5f8cf7e0dddd5711cee
SHA2560368942fac5165f887d993893cdb69d1c4511fd7dde841c802f18002ab9b4e62
SHA5123587945d87e8fbe1e23c4e9f18bdb57cdb71e44ec4e437f5b101ab54a37d512e35d4b0af21f3e8330151f1d180583092e938d6c58605175de52cd8760d33df4e
-
Filesize
1.9MB
MD515d90253533127d43626d49692d99ada
SHA1bd899ca87f83e12db34d5e074a8993085be97d66
SHA25672e8b5c46b529b0935155209f155c8590435b9662f2484980243287b150366eb
SHA512c2c6e05c62a4d11b4d308e3254ee1b5491d7db585009f3ea7aa3d2d57d250482f4cd7fa5781c99ae1bc78c2900ff7e202ee134f7561e48fcf3ba7a4abc70d2ce
-
Filesize
2.1MB
MD520b633e0d23299765c26aec179961bb5
SHA14586eb69dae0ab4d48b3777754ba2546f9f05267
SHA2566f577c07012fd7b730560b47919d8dd0f10c23842d5ccd63a4de62179781873e
SHA512d99a2c32d8581b6f9603920393314d57be44d028ec819c8e77441085e3f29d42f477c8961368fcee86f31f6031596cb84fb2e913c72193368f17a2cc72e2ffe3
-
Filesize
1.8MB
MD5df9d61dae5783f4c94b028c7aef0af64
SHA1e5536fe1dbd83082d16b0f14b5bdc0a20190b37e
SHA256e3d8faf6e9b7380f6717feba026e9387496b6b1faee762ba1a75d6ad7a4c35b9
SHA5122ba4905604d32dbfd03d4bbf75d6196c4b55faaa0f4fb03ad09b748c72af66a40a75e5d93b5463915e8dda313d8653ccce36baa0420633682046d552f9379233
-
Filesize
1.6MB
MD513ef0e9e86fb1d9284d3154c931450e2
SHA14565424fa052ddf68a883a854373c901044f4d5c
SHA2563773c2e0cd3721d97f8a3df345425cb117a5c4898aaa642977514e3c9fd0c917
SHA51221142ecbf8f5a24cb1b25a4c399d66dec128fac428eb56bab0cec9bf1ba2b12d3a6a73c8d4db426635a945c5233c288908cad7fda1fdc10f02ad47a9ae878387
-
Filesize
581KB
MD52ebd599b3337ff401059172ac9dd1bf5
SHA1d68430fbeebdc88d898a1468ef9ef6dffd6712bc
SHA256623a50e55746d14553434cb17062a83b503035f5d7f14e3d3c4f4e50d0f3865b
SHA5121dbbebf86ead799dc63a7d3828d5fc51a20391e834d555d829100caf948062f482c02568c13fc7fd9a2362b12ea6790037ee673b17be71e07a8ab0322ff727ee
-
Filesize
581KB
MD56d15cef02a6c82e46bf7cd52fd348157
SHA1362e7be27a0a46ae54b85d5d77651344107eba9e
SHA256324f83b96b406e266f1367d8afcd50141c955e85d90d2e1b7f9fee8f82cd8f1d
SHA5124931ed071b84f9e69d712ac8ef54b3c6bf7fc1b83307309e03846b808cc13020fd84679bec389adec4073e705b389976fc9b10f3c7b60c599e1a0831eb84fad7
-
Filesize
581KB
MD5f25bc0d16823c7f78ed1b60b7316cfb9
SHA1d4ea82b983c0a374bbfd8ef222b47b802bb7e731
SHA2565763e534a0362b4aa554114b4aa52679e42339ad12868f998a34424f6e8d32e9
SHA5120f17770a5417200c699af8c977a01dd6871f3b26aaa51f2bf517581559327f4f544a9c740448eb19ed98f73c2c4728b5d01bff588c0280db6a9e158708544b69
-
Filesize
601KB
MD52fb3f2d57fc073da48cff5ed88d63222
SHA12da8f01958661c95097b4d75f3547329d275d734
SHA256b0e7ae598b1bf533707e9ef797ad420633afe2d2bf8d7757b1b85c3a7b740e7b
SHA512bf2e265e75aaf5d2527f3ebb20048962e895bdc77198b2346ce5fc6650c6bf07799d94477465c0be8681fa7158304b3f4fda08f3f837b7310e7d19ec81e0292a
-
Filesize
581KB
MD59da91a21ea27e4dd1c1897a69b23ea13
SHA1adfa5ee635cc58b1dea080114822aa7662c19844
SHA256efac322bd1087350c7cd4e0d262ff4b197a0e191158d317167eb6193ef9f1b25
SHA5126647ef650deb10739529cec715abd4cf281ae1fe830a5de0012808ccebe14beacd9f80127049790ebcd84426ce636fc7b651868f1bef96740840933f86e5930f
-
Filesize
581KB
MD5af619c3b36c7e7f1da0b1cd5c1ba2b9a
SHA16eb4eef49a9269e1d1d41ea454f36f7497a9fc7d
SHA25693d8ad5614085ac44a4ce468ad30c450d4ca68f3bfeff4d17596fd67484ba0ae
SHA5122e7d94db540389e33ad052472b0eca612f177e5a8ddb40dfde4b1822bb1676398cf051f2cdda9f07d8c59865f3fa5af7a0d2b18a14bdeaf9bfd563767adb64df
-
Filesize
581KB
MD5cea7cfe209f782d88fa4a612ebfa6eb0
SHA19358f666f6508e5eb7aee01c43ca243ea21f85f2
SHA256afb68b078abfbc7956b79157f83bfec93a94cf84996ce2962ad8854382227edc
SHA512b897d11f6a75dde6b3fc923b5584dc2c330813db5fb26ff01f9e71ea2b3e12b69d87b7eb91511f7e1c27aedc916eba4192cd2755a96897eb7fa8974d7268790a
-
Filesize
841KB
MD5571efa15baee43b56788c3241c8340d7
SHA1b2f9d851775fb1a2eb0f6ff82de8ad721bfde461
SHA256ff5ad75f01efd4de9becdc2399d4a393b85deded50d1f616e9e8c5f9e066a5fd
SHA51201c94fbd7ad58870b2801b6a321c31a1ccdde4456e91bd87aed19e1e8602f1c3af2dcff18cb1d430e1a1f4433314f3220896dbe29a03f93c758fb2d7daaac679
-
Filesize
581KB
MD5dea53b6a88bc3d7129f45f439e572c3e
SHA1050e6fc1b00c107689e3933c9e61cb8e136f462c
SHA2563cdddf6d7768d1706b47fdca151f20cca6671a4fdda7712e73ad940eec273537
SHA5128bcf518b529060cca4e0a4b57e55c67cde50b16317a1cbd101d681121c32f00cb4d45db07aad3d14629975afb46690ad9a4c9a62378431e56b1c447a2c98d7cc
-
Filesize
581KB
MD59577bed6a49055abb7633edd4fee9ffc
SHA1588796f40b3c2b2ae0d0cb451ad2cafe1ca1865b
SHA2563926181d01f5dbb2c082524923b82374853507182b3a80c932a30c18320466d1
SHA512fb53dedc8e63690521c4215b599b466adedd5ce4ed60334b4d14af205ccac43cd8679e7505a3322bf2733568fdced1a30e765c7aa19ccfac289536372a6f938a
-
Filesize
717KB
MD579fe8d4cd5309ce965d18ad2b81f90a2
SHA18b875d663a7d904dd7c17c2a66f89e1fd71833f9
SHA256b9ffe6094987a2a8dca3dfa3979385baf1ce1640c04a2313dac1471a0993324d
SHA51263fb9f19e7d6a199fc16c3343cfa6c31efb3ae8bdc1b4ab7b2db69e0c9a5f11ae713e2ffd72064e3ff0ad849452191452d0179b29b8c34bb3de4c25e156402cf
-
Filesize
581KB
MD5469d3dac79496677587a3b00f602dc3e
SHA1d6a6ae2557fbc39942a2b38bfb0150fdd7604723
SHA2569aec2b331cafe8cfdad0c6c1bd4b95ce6535233b8601a419a4526e6a2652822e
SHA512756b9f31c48f9fbe85b6b90becab53a388758d3bf8a412ba4860aad80a9fa456401b0a5ddaf4be5406605dfd66fed276b44c5aa2a36305099f4a96938f110fe2
-
Filesize
581KB
MD5b0fe4b6d8e637e4047fe5719244b3c96
SHA1bbeacfb33d8092a7a2bc5131d600d4e7a0cb5a7b
SHA256db87ac14fd112361c828fd7288e4224888620afef4909d862dd35a32992d84ff
SHA5121f9f0e790fdbb205321adf8a6272718e9b7bbba14272d220d3b5822614725a5d522e6050fd3724c62113f266a5c307f2e4586ccf408b20802c2d95b0add4afa2
-
Filesize
717KB
MD553f36af3a88475fda93b3552c3d7a11e
SHA1a9c4552b42056c61a846682d89c0af5caef0a2a8
SHA256e240f889821dea78a31634fb9ae380567bcce71cfd4f50578990c188aa16843e
SHA5121d14cf461eec51d3d260ae2d11e9d2268d2fbca55886e39d2d20f69cc1755e52b4fed0d59e48a79dbc4b6cb58a46307ec671d640650df432c2da18625cf5c30e
-
Filesize
841KB
MD5e9071b85ca12e90ed4f6685889643d89
SHA1299424e25f87fa2cb017e03cdf61669680c6772b
SHA256894d3b7d5ff51bc805fd9dd6117e11426a8282963680cc61d39fddfe2d986227
SHA5123595cc623b074167b1b9f39ab56c51bcbe26d373e017fd1331ed8a64a2f49474f88d2f5d99af46bf4d8709383c91a004fca67616374cfe86ac343720e21cc2fd
-
Filesize
1020KB
MD590d712f7fcc62e399d3a5ec4e7395638
SHA1e176c76e9121339366422d329076f34a36170fca
SHA256d8847b7851886428ac020bac99bf14c365568f2e8afd001796f04f1bdc2fc13c
SHA5125fb68f72739acfa3d4b3033502c6e7b11a5129d11c39c9bd80a375e79cfb94284b5c47608a3ce32b3530953d08e7bdccbca639b3722cf9fd78645cf1f0265e2e
-
Filesize
581KB
MD5ddda8e1d265c0a6f9d6318a8cb9ba4eb
SHA11d63fb1e4d1a448b4cff49fa01464cc1f3c61f6d
SHA256cabd892da34f402a0b7161c5132f80a821ff5232468cd764a23b39e572a31543
SHA512daa2c8e5ca9e5ecec54126861dba18bc2ccd7ec5d020bfc776d4f37a498c4752718b9fb0a41757c4c202d6a197e23314ba1cc48312505ef14c2028074f1a66fe
-
Filesize
581KB
MD57f578201cddce1e4c22b08f1070f192b
SHA188950dfea43de0a99349ac6e33e2b5c5594095a3
SHA2564306867f95f2a341452cd5b274abc1a62bd2a19a7f48a5a0b3f7e204dab67f66
SHA5124444bfc4b38ca180132a41464a0ff9f6f425c78aa3f5eb36167431cbda2b45d83c32d8baba2dd80fba2d2d40d0356639adf486fca1226b5bac381bc58bf676f0
-
Filesize
581KB
MD53ddd34d775122d73db31ab3cab587289
SHA1f9fa03e5879de41ad541f0893f9d441c5ae18bc7
SHA256ee2c9f1993cd78748b8935b071b5b7285c12d2fd982d0d7b28347317ec5d2f92
SHA51200d919e6a813e9850dd145a732262a16a675f5505386b6f0ece36d7fd24be38abb43c1b65704fc4e89698a9547b5fafbd438c8111098346f0f8b3e354c698c76
-
Filesize
581KB
MD56f70d4bdd5062a94aa9886b0397acc90
SHA1f1450569052d845d7fcbf2ae054a1eb91ac341b1
SHA256a93e2886e3ca58b2afd76f2cd7c6bc16c788809da5dbc14aad564f8249b565ec
SHA512cdf71bdef02d6d60cdc0ce30bf54d87c56430282878502afb4b87718cfaf122fcdf8c88d77627fdc4f145cc6b448fec601577e7eec70fc63225d142ec1cb4823
-
Filesize
581KB
MD55f3655ccaced2cc0f3e2cc034d81a0a7
SHA1009f275bcf71bc55f77b6b5b995040ea7e090f34
SHA256bd635fdedccef75f12fb197db147f6e76ec508fdfef98d84d61e6a1bf4802a3b
SHA512ecb4607602e029ebe48409bd27fdeda7b3cf7697e28c5d11fcb29094163f1a33d1d2c1eb0663e2510ee8a6124fb44a72b655223384d71e066288d4faf1228f5b
-
Filesize
581KB
MD59b2aa0540819c491ecb939200f5875e2
SHA1ca49f59b28045687326b6b7e9f18d359ec449d7f
SHA25695e9a0ef7cc5a71950ed6281d7698cfa345334cc719de8fa4df82d50b7f0323c
SHA51221d7f3a3d4584d3736e9c9f585d38d0435404c361aafa41cf9f2eb635e773947945e570e8e2719d2404350a1d0a274ab5711a912c888b06c3434370a563a3d5e
-
Filesize
581KB
MD5efe228a769446c74fcebf5b83dc39804
SHA1f14f8ab02aeea92db1d499c80bbe77443abf0518
SHA256bb8f4739d650e1ad63fcd004232a0461aa457b9e51c6b6d400e78dd079a3a1ac
SHA5126faccf3bd519ef1650d302ca34fe2803a413f68d6cb3c46ed801d4ef3c8077c8a72fb4a837cdedf43959d51a10d53c59ac837ec0b6abe205abae17931a976179
-
Filesize
581KB
MD570e85e47b0211fd43b824fd36e838eba
SHA191ea85627263fce6be6533055b70c1b9d26c7359
SHA25648c44cc6068731329ff6ba7696f53f2ee467ccc5a558d2b20e8d136cae4ceb84
SHA51290fb3908c28c7d195101f3775987e9b2b3bf4ed1bd8df5c3e01332c5b29f9c8079fa20bef211cf471688642587b98c768bdde2a35c930a0ee155d31f4ef98bc2
-
Filesize
581KB
MD521f22749843c8ddac7b1eb8b8d9c8466
SHA126f24297ec1a8b53c08ef052e4ba0efea8cedc87
SHA2563a4030e12b1efd775fa1b10b79d8af74fbb6f1ac026320f60afe7126125c1203
SHA5126094ae0f775895df00560ba219253cdba4c2d3f9c873c3d8858828d470ab24db93cf3c18c9206d42e7ce05788efba5d5e9bfc4434f491adadf817bb11736a551
-
Filesize
581KB
MD533d4703ce5de2f345d7796349ff56470
SHA1de73d0a2de5781ea29f1f6950c32b786c31342fe
SHA25619f71bfbe8222ae8b8841d788d8546ca0d22474ac1742232b2c373c906e01e63
SHA512f4150d034514f6788e80f6b0e498e8c99c753b7bef4218d8b6edfa565fc140041908ba8226e6cb698fb80f66d656590b1cd7b0845018aa1fcb42ff2805a93351
-
Filesize
581KB
MD54db1379ed12443a4b028a3d1b12a6e25
SHA1793fa06c9687b56381fd385c5e1897af41bfad2b
SHA25693544f5df6b0f8db233e7d643beed217a17a466c875fa8f738eb944aae9958e5
SHA5129a33f9cbc431fc54e560a9acceb13c8704da3e1a17a483d1294c293ef97758be30fdbe74e5dfc2d12bb709ece1248fb3dd184ca5f4ce04d01aec28abf93874d1
-
Filesize
581KB
MD527bf7e31c8d5a7f7e541b929113d367b
SHA1ac8fb4b2e2623d21c108c65326fa1d2adb694abb
SHA25613e7b3b80b39845408f5efe09812963d94d818323c8cc1f4fcafc4eb42a5db1e
SHA512cc3a109c5ba663d9178725187eee2c83dc7bdb10ec5a10e7cf3af04dd884c20679735c1ed973c9cf684b4af5f00fc93b3d61db0a6912f8a5069172d8cbc143d5
-
Filesize
581KB
MD5cdbcc21c0a61098ab66e53ee12be2e82
SHA1995bd1a3daa2f56ee2d274735ca5fb14daacd80a
SHA2563d17cdabbd34dfefb0517890bc300b067a261efe0bab366682bfbe6f32be6d8b
SHA512bd43837dadbc98da7f95a2e3c06271e88a9a0a50f2c8f4dd2736ac8c23890c41a1000a05370bc885562ddf9d74a39d3fa5a9205456cf06c6c6af6fe30af4c86f
-
Filesize
581KB
MD5a50809f172bacc1f0717f190bf0563ea
SHA1f99ffc90e4d1517f4c758fc1153874ad5230f03c
SHA256bb68afa37e168edc7dce5b08d72d022f1cec6c774fc9a68e51bdb13b658f6081
SHA51226dad9f1ca8bf46781df1d6453576de7ca1b64da4b6f825147601a18f52b3ba41ad848b567a918b5effe805f4750dcefcaa78764c434294cd855e49aa650ee1e
-
Filesize
581KB
MD5cd46081d7c280f2555938acc540511df
SHA1784f25e7ab7b33cbf3ec1efebd74e94e3e5dbdeb
SHA25602362a62f2cc906c6012af4666f03affe8908a47eee89ca206bd66ca4994b357
SHA5120d4d1da9d9d96a6696cf9b25c9674457e5d8f0d5106c58a5ae7ba70b288eb63bd3d81dd6a770137753396af4b78adbba3a32f428f762e3581a3012b9acdf051e
-
Filesize
581KB
MD5e1ee571e53307f51eea61a3c84148867
SHA1dcf5789171ad48bdfaa5435d6ae6f5d654d573ed
SHA256a09dbc7d7589a8df08e442e2c03175cffce95d557ce45d13d2536a394522a04d
SHA5125f57939bc10b2d6c283829880e6d3388d4dd2d80b5160b6546b62700ad98fc2f8fbb778e4c8d43133baf882971428df1db079d75877638bdc1c93a1aac674080
-
Filesize
581KB
MD5e615185ad84313cf04b7bd755327b1a3
SHA1153e26998f35b7c129ece0652adc126fcdb0749f
SHA256148cd2dd533a55a8d40f6be283554f2c361b36ba2bfbd6602d1b78ffab109a79
SHA5126c1b963ed0bf549543bb7dbbdbaba689ee86a2f6af3adcd37af0cd53aa771e3f7f151a450a07d2962b8f3ab9641ad44a6d0ff8a1bbeadc59124c7189cbbb1be5
-
Filesize
581KB
MD5aa33fe3d6737cb4d4da742131df14ad8
SHA1cd0f45427d382f9da10063fd19dbe4ba1b6775ea
SHA2566ab5fa2593a2d6644521fc57a53d8470bec94ca8430e8fab50b513adc66680cc
SHA51224f0ff3bc225b379e805555c54f587127491c7be80d8bfe829f2513d06c76d377ee240691ed6b219b8e587766896cb820aff294e9182a492b25e3cd01b425ff5
-
Filesize
581KB
MD5367730869efe343b98c20ad85536c050
SHA19dba275c75774459e4af553e12ad4c1aa0ddf619
SHA2565b60cb6e4e277fc1f74795d8b304dcdd571639b1256d98d0a350192448b0029a
SHA51261ba40b92ad3ed579acfdb2f06f05ba4d108f348d36cbe883549296d1c2d273308ecedd8c8bce3020886eb283fca217a64be0921f73c0822cd08fc4f45ce7743
-
Filesize
581KB
MD5350ec774ff314f8b850b3ee9d4d16c6a
SHA17d8dc7741114098821b98d1197a3cfa91c810e6e
SHA2568f324e841f4301bd2a2e245beba30b7118f86be6fd3cb5f38dc1a6c65be2cf6a
SHA512da1569542c45433bac0187a35d00d52507c76b96e14242ca464efa49460702e710207a9ae1da9dedf190c3159995931789c3019bb92b63eea1dc52ecb721b386
-
Filesize
701KB
MD55df66fa1cf158e621c9143af72560ca2
SHA116cea80b2c2575304f17d96352e2d00c39ab9a63
SHA256c553669286b1e225b53d410ec1f92f966353680e959d961a135cbd8647456e1f
SHA512fe9a6f454c448cbbaabbdfc6fe6f5f66d958abd04808596bebfcb8c4e8e6c6e5735b704d2c82db6fb6e73c3ecb48e7077ad9ba14e35f0698c13e076ae53e14e0
-
Filesize
659KB
MD55190758acb125608148d7f06d8fc5f4f
SHA16e5939880346d30b3185ed33ac4d260a5a5e3413
SHA256759c3b47a88287f67547e3ebf11fb901fbc451e2f0ccef3d0501fe4aa3f639c7
SHA512788c3018f94b5f261252ec806e8bb4e19cbd915c05a1568e09498374fa2383593ff28dca8db3e10f7e3b86551bc4527fa93a29fe6eb68fb78d91204faab042e2
-
Filesize
661KB
MD55000c37e5e7912206d8a3e1c7cdb684c
SHA1b3314dcda5ca43c8d7643a52d01789a65f241362
SHA256378bc41b8037b3f0500e08adb55015eac0fe31a70c231b94ebc4e7427cba56ec
SHA512343ccb4b91821d04651b8d91a5c3462aed4070122b007ab46ef6d90da4a6b46254e6359bd7bf4c51ec585f1e13be06981c57a27d19708916b209d6677071e58a
-
Filesize
712KB
MD579cb029dc4f8306bf703773fef6b0028
SHA11c1e7df8d965f2fdec8697c6895b51dcf50c687e
SHA256724a1f8736cc1492c9dc7aef62cfa28a0ce506cd0f5c220cb318c722147a2ce7
SHA5123d50ce835069b67e617435da86d6cececce3ce999664d1563c04e749b53e5988f0d8b8c40b5081033c372bb62bb880c12cce500c4667b604bd717ce03e8db095
-
Filesize
1.3MB
MD502b5462011d52a37161bfcfe589ae806
SHA12c4e5716e32f5e2cc0d1f4854d2f0a0734740c56
SHA2564e32f399d97e6acbcba320dc6af1e22c2a4a201d52fed44d66ffa99aadde7c26
SHA5124b8bb65a6813b965518efb651b46f04698ac4cb8f9bcd9db3688fd0bf8f8d0a1a6d8aaa534d362286a1f0c34deb2b1013d979c5d6c7d7de22b1fe630f11a0e32
-
Filesize
1.2MB
MD5b88e532f249ddef4cef7af0041ce6f1e
SHA178c2c761229009e3b8875a082c2c1557d3b6822e
SHA25674946c72c63d44f53b9f5fa262ab3670105ec2702eec026e5cacd612634948d4
SHA512e56597bb67fcde1d07992411d7ad5e8790fd686443fec99fe65a3fd734dac1a85072cbf824e4b2054a88b4516d6fac8b341f45b3f0f0b2d40b4bf5ce7495afa3