Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 12:29
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-28_34b32fcdbbdd31203481603a02f1b567_ryuk.exe
Resource
win7-20240221-en
General
-
Target
2024-04-28_34b32fcdbbdd31203481603a02f1b567_ryuk.exe
-
Size
2.2MB
-
MD5
34b32fcdbbdd31203481603a02f1b567
-
SHA1
cbc19859dffe0fdf39d4af75c36c189acc3d2210
-
SHA256
709cdb67d2c3b55a016b21773eed28316f7e9df37972e976f52a90404d8edcab
-
SHA512
d65496ed29630448b8d0262fa9c7f0a586ad90385354e6fbee9e037446cea46c734a347f1574384d488dc3c77d0d250053b5fdb4306a054ab6fb100b24992edd
-
SSDEEP
49152:zOOh3aN4kuLbegmtG/6ZU6CENlc7dpJLrQWd:jU4ku/cta69CEN6rV
Malware Config
Signatures
-
Executes dropped EXE 6 IoCs
Processes:
alg.exeDiagnosticsHub.StandardCollector.Service.exefxssvc.exeelevation_service.exemaintenanceservice.exeOSE.EXEpid process 2092 alg.exe 3864 DiagnosticsHub.StandardCollector.Service.exe 384 fxssvc.exe 4824 elevation_service.exe 1716 maintenanceservice.exe 2432 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
Processes:
2024-04-28_34b32fcdbbdd31203481603a02f1b567_ryuk.exealg.exeDiagnosticsHub.StandardCollector.Service.exedescription ioc process File opened for modification C:\Windows\System32\alg.exe 2024-04-28_34b32fcdbbdd31203481603a02f1b567_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-04-28_34b32fcdbbdd31203481603a02f1b567_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-04-28_34b32fcdbbdd31203481603a02f1b567_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\bb3152fcad45b396.bin alg.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-04-28_34b32fcdbbdd31203481603a02f1b567_ryuk.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-04-28_34b32fcdbbdd31203481603a02f1b567_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe -
Drops file in Program Files directory 64 IoCs
Processes:
DiagnosticsHub.StandardCollector.Service.exealg.exe2024-04-28_34b32fcdbbdd31203481603a02f1b567_ryuk.exedescription ioc process File opened for modification C:\Program Files\Internet Explorer\iexplore.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_99140\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe 2024-04-28_34b32fcdbbdd31203481603a02f1b567_ryuk.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateComRegisterShell64.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files\7-Zip\7zG.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7zG.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_99140\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler64.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe alg.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe 2024-04-28_34b32fcdbbdd31203481603a02f1b567_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.106\Installer\chrmstp.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe alg.exe -
Drops file in Windows directory 3 IoCs
Processes:
alg.exeDiagnosticsHub.StandardCollector.Service.exe2024-04-28_34b32fcdbbdd31203481603a02f1b567_ryuk.exedescription ioc process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2024-04-28_34b32fcdbbdd31203481603a02f1b567_ryuk.exe -
Modifies data under HKEY_USERS 5 IoCs
Processes:
fxssvc.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
DiagnosticsHub.StandardCollector.Service.exepid process 3864 DiagnosticsHub.StandardCollector.Service.exe 3864 DiagnosticsHub.StandardCollector.Service.exe 3864 DiagnosticsHub.StandardCollector.Service.exe 3864 DiagnosticsHub.StandardCollector.Service.exe 3864 DiagnosticsHub.StandardCollector.Service.exe 3864 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
Processes:
pid process 656 656 -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
2024-04-28_34b32fcdbbdd31203481603a02f1b567_ryuk.exefxssvc.exealg.exeDiagnosticsHub.StandardCollector.Service.exedescription pid process Token: SeTakeOwnershipPrivilege 2892 2024-04-28_34b32fcdbbdd31203481603a02f1b567_ryuk.exe Token: SeAuditPrivilege 384 fxssvc.exe Token: SeDebugPrivilege 2092 alg.exe Token: SeDebugPrivilege 2092 alg.exe Token: SeDebugPrivilege 2092 alg.exe Token: SeDebugPrivilege 3864 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_34b32fcdbbdd31203481603a02f1b567_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-28_34b32fcdbbdd31203481603a02f1b567_ryuk.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2892
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2092
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3864
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:2672
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:384
-
C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4824
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:1716
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2432
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD503d5b2cdd7ec01b887f3904d6aa7f5e4
SHA1ee36b20c7b61e79faae769954357a9f73c480dec
SHA256c40a6a924239451821903b79ba2c9ffea1a64155cde9b531da3e784fe5d6d275
SHA512d94d25dd47470d227b96154db17488df6583054dc5964b9c3cf7707b34d84f7dac9ad0801ea6eb28a6ce79a24991385992d78ac6722c45c3741561832abdda8f
-
Filesize
1.4MB
MD593e2626483895f7a7ced43f221f8f725
SHA1fb8e82135f2a5235f5b62a8a3fd8b2008ccaf167
SHA256950192eb3fe474aa4367c6d8c0feb029f16ab1fbe7aaf075aca7a654cc042d84
SHA5121d472dcadb0edb930f4fb072d7ca09f23c941fdfef5450e72217be0f50de7dd378ad9b1d300ce498deada5699dbf9aeb1e26cc30a937b65d5a72a982754ef8ea
-
Filesize
1.7MB
MD5a1181a58448e55df0c2ccdec0b11293e
SHA10b6161b18a1912de4dc892ecbb39277c34234101
SHA2565d38d0ffddc06ba2b1af625eb3eea91341a4b8452d7180aec070e93d93c5d769
SHA5122883d5a45378aa7c4b6d88244d13066db196e9b15b62e340b173534c38a7448e6be6e0aa2075d5451851f0aa138530312ee1afcfbab95b1f8ae4c01b1a749f0d
-
Filesize
1.5MB
MD5cf8df52476f480e9b998e942ce7be2b8
SHA1cb0a67fefcbd5e6f87c5ef3a7af3dc3302b68ec1
SHA256e0585cb86472ddd5e505b3058324c6b07ba7c920c8d1222df4be617062e9ebb9
SHA51247c9ee534633b8679308967a1eea2c6c81ff5fb635dd65784c440ead976c53afb58e873ba7e76cc3953f0382e73cf6a2109b781ecebe2e450018f159a426ae77
-
Filesize
1.2MB
MD5f4d41e440ebca0c60eaed6121b4ac901
SHA12e3a1c3546eae133ec16b932c12fe41a7cf451fb
SHA25628ffb7cfe58bb45d20ce978939d1f49a9a6565159639df4780ca1719afc16807
SHA512108a976356dc9f2e5d9fcd249a2dbdc6ce7a76799d81d242e1fd170f8c5f9868fbb0cbaeffe422707f2b086ea50a185c183b83e8650c3e2544fc094da035a2b7
-
Filesize
1.2MB
MD50a271924620cb2f01c0bf34b867ff02b
SHA1bd4a687af2a2d434bb0ac8e8887b1a82a717f10b
SHA25604874d2dcc786e90ed263ff515435437415bdfb9cef78f40310769c451d264ec
SHA5122558718b1df7c1da86bb893797c58abd97f478d0540160f8f7050c1a0faaf0043aed918483292075b8d7f33f7a46c0f2333d481fb64dbc19860f3fadad9bcbb9
-
Filesize
1.4MB
MD5735f1a3e66ed495795cf213ee03a566d
SHA1a2a2b8d1db7d03d30c2dc43984d03ed71b2c7e30
SHA256e6461c6e53e64e90cf97f58b8fedc4466d170d98bcf2d082adb2c0ebbeb33fce
SHA5129328a34e25e0946100ffcdab5955fcd8a416ab9d4fbd967301a89def450afdfe080cf2600c90947125f91ba57137d8dbd422d8a34ada52c98a2e04426c841ba7
-
Filesize
4.6MB
MD54382a46bda0217711a65e05f294904b9
SHA13afbdf89ab1c201d600443b8c7708ee9096565f7
SHA256c95b48d2c9b45ede2ded1f1cedbb5123443171195f680725dfac2a6fee225065
SHA51246ae42f5550fbdf2b7e716bf35ffbb17c8587d4762f053430116e07036f1cb60ce8300440fd4f8e2ff1f3c468a236f8b20aeed5eb4f3a21409c01efd0ce5243e
-
Filesize
1.5MB
MD5e5a4cc0c2bb5f6c3696d0c6065428078
SHA1e4f30c8232d05c17143668eefbab5783222c5342
SHA256e4771ef32f333b73e5c30049bb28d1001a57451fa96fbb05e34061e8f9edee06
SHA5128e510af3f9a0facda5af161721aa2af774ee06523938392145d998a1562f45026d73821a7a6f5d9e3669a19841af57edcea74672656fe5a28368ec9952b5450b
-
Filesize
24.0MB
MD5cd0e33e7abbd50af3521d6e6f9aa5eba
SHA1d17dd7b5f402e57ad64a66211a55b4ac938fd117
SHA25672b1aad590e4bae902704d426f1a59c73c09bd32d5a1cc99e3a99e7888dd23d4
SHA512bd554a7ab00ee9a7e05175722b44e350734c5cf17ac75b1caf410d4252fc04ccba48bd31170f7f59b1ef5b59c68492502ffac57f1295e4aff6ee7ce15b10cf1e
-
Filesize
2.7MB
MD576874049381b0d1c155df34e615b9990
SHA1b2ae0e2752921c55abaffd5845a44e008f79a5ff
SHA2567801eb0f63ed5f2b3604369c94256c20e8e706734367c44196460ab8be98044e
SHA512d45a4eb5d1f6efb9c0cba04ffb82462b8357a69f28700766810c309960f93a12b751f1a1f3a5975ddca83a0d2d5539ce3f6286c607b263c9581ae2b5b546bdaa
-
Filesize
1.1MB
MD54f00d2d6b92abb99c6dad1c0dd3d1b2d
SHA129db16628504488de5da1cee32a45211e46ecb70
SHA256b616762830085e046fac41b0f7ae8c69068532a264efc31ad0931d578b06fa39
SHA512df72a83fac1c4542a5cbb81849f767095920962753f709e231464603ca5b1e8c4b2748a7a101a31ea78fd3976a231fe86c14282d1449fe63ac4ee4e2dc1173a0
-
Filesize
1.4MB
MD5416004529b939d11c23e7d3d6a4be437
SHA10d31da3200920cf83a1c605849d2e79b717ceb38
SHA256d8885135eb758f9b83a19cbfb0475b144bd87c6d034d36fb1e9218aced4b7c90
SHA512613818df3400363ee83f8df7af111b1e52d854ac2e2daf60615c330af7db2f81a19ec57183d8edfad78bf39a6c3f7f51aa328a860becfc5450591121f1db48c7
-
Filesize
1.3MB
MD51dd3cad6b5347a81923d8f9069f5b3bd
SHA1356e79b3d366638e475c865fb0419a4f8663184d
SHA256928a603e1e383ff5ce576ac27e7f56edbfe476a82912dc06ad075b093767ffa2
SHA51236408da37cba9a762a08d9cb1d164c9fb8af11864c3ed485e50d02e4d19a4b2d85fcb01e85398c9753bf11cd7afb78d65a82e335ec78b24c98ba40b95940ba57
-
Filesize
4.6MB
MD5b8fd812705fcdf55a2f080ee798409c2
SHA1f08e3156b9e6315fe27616db0152bd2464a97ed8
SHA2563059e32dd5ccaf89db8371da1689db003d26bdfd9bda85a7e573ecb59f807fe1
SHA5123a573ad9c3e4ced4f43e1dc8acdfe53bcb81b82dfc1ef5aef2b78b2851da716f2416cd777798d9c802a589fd4ee31a368d4c3f62dbb5cfc3f9b3aaf62e272549
-
Filesize
4.6MB
MD593c2fbf3c0fcfb7030ee2fccbe3ebb07
SHA121f57c1237a84f08c8e1a431e9d1c39e8e4c4ad1
SHA2565fbc3b1d3403e3ad3720e134fd54a4cb4fc88b719c5d9cf083092682d4740394
SHA512ea9102154a2f3d1c35d737e6bed35a1ad5fa18d07ba6ab51f2d2efeacaa9b3805b8db03cf270126d917db4b10ce67c817318397c10b900418d51f1ac4e1724fa
-
Filesize
1.9MB
MD509a298ec6b5c6cc72163942e5629e4e0
SHA1e7eb82a38b0e11c036b290c400883181549d6f84
SHA256717cd4b7d50d6cc9f113ee4f95a8402f22a0ce254dd3641aa29216b55e8c9afd
SHA512e797c5a019b89600bf9c3896012b61d3de228ed68e92eecd2437a5fad5156584489e3979ac72c90e59514e6888210e7a89ac9fa7a04d8be2f7537110c6176884
-
Filesize
2.1MB
MD50e9b42e0846582fc4e72096d2c07de21
SHA16aa9831d516ca1331ca581ea0fc1964de2f2f69c
SHA25659fa39d4e48fccb8465ed33e0649ff4444ce1fe6e94e63f3097a1054e18e6e3d
SHA512ef4c97894b337a13425525128d8df99ae08b42acbb59f9b3f0154cb987c1f0b98fd1a251308ef5bd574075f76189127c074e21def454faffb21cd192af28401f
-
Filesize
1.8MB
MD5f1f7a951572ee254e7cf740dbbb6ba21
SHA175fc299edc715a0891d793384f4bd93f67c777a0
SHA256a0f23ba57553a575c5ee1832bf88632f8d1c3b0a79bd64d12ff3ed607689de08
SHA5128fac8ba4e8eb060547b5c05789967f60bdd941c6ed03d49ded8a06c19c9ee94f096b8ec22a51179541e75793b2c5f4e8ae55ea601841f16ec795c0b149d34f17
-
Filesize
1.6MB
MD533a5630ccf0b2f967f555b0078f2d2ec
SHA1f76dc6a0f4490b9f3fc1ee9b2770ce545aea3b2e
SHA256bda9fc9c4185d793ea7bb64b9109203415871b6589ab3a083a1faa8f29e10c0c
SHA512c69b380968f2aae92290b8b12fb2ece3b9a49d17ce2e849f06f8d498455a9538e8e39d6bcfb9668cb5c36b1f8d009c604937e98a0eec2bd5ae9f1b4e126fbd56
-
Filesize
1.2MB
MD56b84fbf66cda532ca110d30aa160a83c
SHA1aa5f11d695baadab94cea8b8e009fe71061f8de3
SHA256104886b67d51fcaf3aa19cdca5752d6d309b4924854a82af660c72316ca67174
SHA512b416f95a754ac48a2a6de029c3a66c07721fdf67ba450b3356ab5da0cecc12fbb82e5063b81023c29bdd1af9a992438f3b1a2054e2abdb4ddfd045297fdbfd05
-
Filesize
1.2MB
MD5899dff019d779dc19d628738f65a25d3
SHA1d463906fe967b68718dc218b44fc68a0b2e100e1
SHA256d61b29de5672418dcd13f1bb1474ae7e5e7640525b063c00f4b7eae851fb3c66
SHA512d43e714bbbd505d22ad6ee1bdbdfafe8ac8d7549ed28f059492664ae104a4b053ce5f9e70addc4750ba629fa000aabaf6d38322b27d52aaa3f63fd665381dc0c
-
Filesize
1.2MB
MD5b90a6b067d9686a753daa39c692cdb72
SHA14a65a34582cf641c24c566ea86cb2d6b5e125b1f
SHA256a39f1e3a70f86377ee8d350d50bc9f3125fc236d5b84be584dc51c565cd33802
SHA512fa14cd2970636168d9f8c03b8f2caf66d08b3a38039a6bac0843a02789968fd2dd9e83f3cefec43e19b1b06d6a32586b39b5aa453562520a5a68d1d908e46f07
-
Filesize
1.2MB
MD5e65e87809b8ce4239712e1ae046db447
SHA1aa065a75392e3f014126ed6e7baa215bf2c13218
SHA256e42d6d6a44ce40aa0f42f47eedc97a310e106394e9f420dc301603f3daada11e
SHA5129b7caa5615572c10b80e41f0a6da16b137eb0d3f66c1091e7f7bde762ae43f0d31eaa6549728e853b50116076c7964c2f00fe953583b472b57ed77842d847d3d
-
Filesize
1.2MB
MD588626497de2c096054c1f1c81861c5df
SHA176f15b1290cd9a7acacd9882019f45ba0eb70914
SHA2567cd24115a56ee24c4ec1650a9c4ce3d0e3710741faad4fdde099178c45b34fcd
SHA5125d28d3fb78207c3c7441ff1cde69e50b7b6f96223a9f13881e5e022192d0a1befec6c95416b0854756b2a49f971d0804e0c377aea5e75016e3ea3ca0c45e4f5f
-
Filesize
1.2MB
MD52cb6533931a258651f42ba43fcfdf19b
SHA121436cf00455b23f1af7e6f955e46d0e3d699673
SHA256c06e5c12e2ae368290e2c1837cd50acd264c25c2fcbb8f771421fec2ced85ef5
SHA512cc29e7bc6b0b1180e058da9a1bef8ec73a59408f3d4d0d66938a1ac8aa42481d387b1845b0437230bcdd20bdc2534b5b29b44ea697a28f61cc553cb89e9f11e2
-
Filesize
1.2MB
MD5cf7636cb80a0128b7419500fea1abc69
SHA1a5f5b8a6be604d2b8753a144da79183971cf008c
SHA256fe18e1466f24806cd0c8f9e3af7c6524a5d83b446e767d0d9613064ea73a0179
SHA51286232c27aca9c72263dd9efead4995e37dd8e374fb4ad7cf8b03a43b9627aed2ed0b6767ae9599b026bb74f8b58054b4dc76232eafdd9d836faaabd2628ffdd1
-
Filesize
1.4MB
MD55842b167e7766054a55d5abd4ff97b75
SHA1d7010b104f5725a23e7978bdfbac0f76dd8044e4
SHA25643d87543319942a6855c91b8d9c50b189b8689e44fb636e4b29b6df1f300a0e4
SHA5126ce2595960046f3c871aa5acce5d38f72b70b6e219a1173ad2147da7eac82a75b7711484ebf4e4dc1fc07b9565244f210946e2b0e5a10281913a4e7dde054ca0
-
Filesize
1.2MB
MD529effe036eca88da2aa00c6ffb4ba80d
SHA10c4eafc06780f7f7f69606a13e5949bf69850ad4
SHA25682768d2cf047bb2f2809f7ce127559f5482c97384d90842d4adaff10ac734469
SHA5128bfa166690e4b2438ec852554edf100682584d8ef5703a7ff7cc8c508721d090d8c3a58e32a78bc3c12f0b6c4065a22f89686494f893f7a76929741407abf481
-
Filesize
1.2MB
MD578a6762ae0b33d77d2d959427e03cc54
SHA1ce9a27064ed7aad7c2aa7b9164bee3eb44f4870d
SHA25647a7f3574c1d6a97bb4ba13888cdcc6b707f25dec38c479e55c2cce2d8207fba
SHA51281314146d8214ad85b50cf372c2cf9f405ca7176ea2a5919e506f9cf1535ecbf840545dd7f45a181458441d5477b8a08f73cdb2398769fb622f938bdd19710c9
-
Filesize
1.3MB
MD5295b7b9855b41e580d664ec705429ea5
SHA1cbc3c1e74492ed73422d0f82395bb7fdf9bb3bd6
SHA25614f531ddfbe62925bd357fd0563881d2f63916ccd6e43bccab4d9142a7e0c7ba
SHA51275b900544ddd4094994ea7adf33e6257d17267050ed9d0555fa846c8a40325478cdd0c928394e4d706c681263c572353961a471607588cc35722ff8f57940bef
-
Filesize
1.2MB
MD5c2f3dc2ef8d11675b23a887ff06e716d
SHA140d93cbcf6c90955896fb052eb1637af8b2828ad
SHA2569c2ab2fc1e2ebf799cbc9ca495f2622f82a433efee37eb933a7c94d7e458f4a2
SHA5126a5f30ce98a46692dd75bb9b860d4857ffb6f88a8334407cb9a55346f2b1182e1a81d7d7e4cfa69c228f2345e3df7d828a1d9916915ec6aa1425a5edff4ce97d
-
Filesize
1.2MB
MD58a9afef8e081bb5378a313fc338a6337
SHA12ab3090b219c8af2b84af1e39eeeb535c60216cc
SHA256002098843105d626f5772d8b679be3ce14588c397d9d4f3be8ea66fa5b3a3b04
SHA5126b421e70101328224cba4da79bc9bf3eb5d90ac12cdfa240e8453fa35af264917a3a0c14040848ee7bf02c5ca01afa2a44756ed2ed83389d5c71679a06e84340
-
Filesize
1.3MB
MD5c9819e1f07666348b5979a854c147a77
SHA19e58c573a3f37f008d980e6dcbee2733960930a4
SHA25675617d729ed3ff3d315660f6e3b21b373d5922a272793f22658ca5aac409e59e
SHA51274550d0acf91bb52ba0dae2a98df2889aa85117af2a4fdda7fe23d75c225d35a5a3024b32cc044d285da148f780809cf742e23fd057dab089943554f5d12db31
-
Filesize
1.4MB
MD533e49f7f1705894b99c50efbd93c9a82
SHA1984fdf3441d46bf06ed9595fd93a2c800aad7624
SHA25658a7a3f9ecffe274a2f267419d2ee804bc56ace686320cbc883d09a1bb84e327
SHA512040c67afa9993006b0e6cf49b6a04b0353348dae3fa4700b798c6a9802c78b11cc3e1623ad576eaa919a4c828906fd1635dd907ffbaf3dfe320997a21b3603b0
-
Filesize
1.6MB
MD5bfa6550d1c929886f4fdfba6c1aa4d38
SHA18a8e759c746c3f92f861f3c2a1348adac931a2b1
SHA25623dbb6168705a800e1f33cd9277a8a19fb4b80a3d651890716b5c16614c66c35
SHA512b39a834f6709035ae2a770c0dc66bb2f1555d99edda115b6cf1f6478fd0c1c9e1da68f555bddaaed796b91b045368b274cb707d65c2d31ed9b974a7990df725b
-
Filesize
1.2MB
MD5cc58350fd665a7752283750775421d25
SHA13fb04e11ce6bc3932a2c717727362c7c67063ab5
SHA256ec0d268105031feca4a48a12b1e79cbc0c01581eb6faa26a080f799181668ca9
SHA51209a2f00994d759053bdff9d16502a75ae52cbe1d96674c93f2158edc2b726e58aab24ae9f0774d2b844bb81bac490abd2384996754d9c37d3285baa5d691ba64
-
Filesize
1.2MB
MD5178d00b21f45e3548c089ef9aeb1a623
SHA136da80b7a07c9f12c7bf34ac2ba6b4f07c325205
SHA256e6e968e0687a6ec440e3044113d85cc583b1a20f24507806971a4b35f9720e00
SHA51222eac0c6695495b88475374174f833b7c27b91a58b9d87562956c120bc4b1d7789ba579ff69876505acde91a4ce8a706520a4e2e6f297d86ee53f893adcbcc98
-
Filesize
1.2MB
MD59c56b6d1923b3351fec342087b7323d6
SHA102bcdd66be254eb123f85cbddb6f455bffdef6ca
SHA25644eefe23b2a5df00fbf72c83d813458dd503e59d1e1e22fdce6fec6e07b4692d
SHA512106889c5122b972e7525c502f294fbcca931d62e4cb41c4b03bafac247d717ff91d404881dc6755c5f54f201dea9298dfb96eb41f52caf39a9444e137ba0d07a
-
Filesize
1.2MB
MD5b0a2ce6a71b61f0a5731f0ed78f49c23
SHA10183b6f703508e52d3e8d2d1ef44892fc12801c2
SHA256b4e439973345aed6e5c12b6b12609808c4960396e12733b0435280c8996e37b2
SHA512b1fca353d4862ec0b4d0738a4e5122d6ec0bce90ac3cb4ec897b72d56f51259235ee3873930a5ff4b4613387758a60280d7344954cff5b9161a8581e4c8afd04
-
Filesize
1.2MB
MD5caf03bfa0d75aaae55322d63a766b719
SHA1fd3e4abce47474f74f37c7bb1e138359184e0db2
SHA256bb8378c42dcf53352043270f1fd7245faddfbd2810323a2cacaa8575d9b2a005
SHA51263a0e1f29128a2893a25f6122f0e8616e0667052cacd447e1ec976285794905f77956c3bcfa700c42fb1d1aba5d267c4387daea8023339e4b13a718861f615a0
-
Filesize
1.2MB
MD5a39b8bf73d604e7092b04bfa60c677bb
SHA151bc62eb12ca42f81ae74d83c728ac658b271239
SHA256b736f7b8b83a4b149e17a4fb9bd03aef3fbb459ea2220adc691570e4254cab65
SHA512ae065b2583c21bdd026d2b894e2f971dce1844bd07209e383e9845fae690c5a4b1f7a11fc8e803207dd6f20572c3d6aaccd7b112cf658255a0b8de55d060ffd3
-
Filesize
1.2MB
MD5fa3f6d47ac12eac3bb0f89504219fbf7
SHA1843b1ef510845f9d6d42d8deecdc0867783560a7
SHA2561e3207a02377a73e2c2e10022fb95e30d90c9127f542dba477e62cb49736ce9b
SHA512fd8f1326b12015a6c05baf97ec7ad2b47cf5ad7fbdd12961e948341ea3e1fbbe1ffe3c054c14fadbc817e8cb5467daba67fa31f8cbec22cc528070e932d4b7ea
-
Filesize
1.2MB
MD52a98f9bc110a47b6b9be629d0d302087
SHA14e67838cfc7d9c66503d14c9fa38aa6b5d08dc6f
SHA2564de2d6c2db13f7be89367479e4ee2d885ac60f6edb3f6f46cee0de74ca5b296e
SHA51208b978f342bd3c2724fec5f1c1f0d855467ac59f1e6185c34bbf06de97733f488c0a0ed8aa0d86abfe5dde1c952600f92c8d0b2615c1db135529cf615f0bbafc
-
Filesize
1.2MB
MD51919c34e5269acaddc8d154e8395eb09
SHA198d72c6126f4446ea809fcec8c301963a95830e2
SHA256af64e5cf66df1657d66720469a93148d5a0349bbe4f794c4074dfd7b12fb8d9a
SHA512c4d255c0770e51be91ade5b9a3cd1c3b020c8c1aa10b66d07b988f4cd8c7b67fd6657f6197ccdbdd417847e29c9f6c8de1edece89e91b3c3f4a1252aa9c3bc4e
-
Filesize
1.2MB
MD5437b36dc27f4fe2d4c9541e0260e5c43
SHA1690a171e27e32bf3d385638e44c2bb0d46153b80
SHA2561c1e7045be8804a09f549861af439d8018273ce37ebcaaad4c47b65273ed49d1
SHA512b00230f007166e51856039e89e3da12016b39cfec46fd3f73735f2e3191246ea7e8cb86578bd57eef8d98ccc6c6c88e94957886a6552276b789e9cc9e8b0a8e6
-
Filesize
1.2MB
MD5babfe19c08c24d6952b9d55c78ddce7a
SHA17537a3f722290c550363fa3c662e6a15aa4f018a
SHA256389da64ab8c08c2f4b2fd56f52ecf7f7fac782e19c032435a1e51d0ecfbe5ff2
SHA512bc880245169afb3c907188dbb01295db52f5569b9597121108db9b7be2a8d753e476a80f1b3d24af7b42fdcfcd843e6d621b517611df669ff4148e86e46cc82e
-
Filesize
1.2MB
MD5ec33557c651eff697219d7ed999ee952
SHA10f1206baddb687b3bd872801a9caf4f11c3b988b
SHA256b885c534936cdeb2a44a7ea0bc360c87442909bfb6c8bcec7c7fb953ee61502e
SHA5126fcab430d4b97d87e8faebad8a99ac8571fe47835b089d44542aa94e67210b932cb1ed38a3b43f580150d0040dfc7875fcd5ea4830091e764b4c710d0d5e713f
-
Filesize
1.2MB
MD59644463104bf82e18feb5117670a6fc6
SHA1daaa5670f1350b399eb2cd42d4b1057b72f5591e
SHA25615b508885cabbe1bc7730516652496fb223c2dcd362c2338b4c278e88599898d
SHA5129f90ff40c5a3db4d7e8980ee364a45316f75e93d0b4ff4c1dda1d391ae4ec8038abfcaa2f6bb69eaff30e1c2d3e01d6e4df0c7db2b9ab99047bfcaa7daf7ce35
-
Filesize
1.2MB
MD56c185e2f2d7f22a58c3f285255a0f692
SHA1d43e2e48911e733cee92da23595b049870be71af
SHA2563fb50e942ca78ba64cba67d43aa33adfa15c7607f8e47d4b1f5584aa25bb8ad1
SHA5123968395d76c4bb36604304a45099fde9d59f46ed256db5503682b7a8d2a6e0d6e00dc2635803ebe28fda4496d2b35287edbd497f8f95de7da523ba03850d1e0d
-
Filesize
1.2MB
MD55d41b747322ac71f85484ec1dd81342b
SHA191e944df3f392aa29da4119a4a52ec83ed007ba3
SHA256727c6adfa7267e13f5536d994d207d0491a0b80a9c2f176c91cb68db41a04d2a
SHA5126103b57ac712a93a4b2ce80a46bf5d7d1af7365c19b3afdee585b1b82d9588a43f4460900721091ae5d9194abec73bf9ef671c6fb824053f82a3d94c2281cb77
-
Filesize
1.2MB
MD52a6a4af719ff3fa1e5803872eac037e3
SHA1f4e467c609c70a19d0c8cb8136d41737aa040067
SHA25674ec6099d7d0e9d40fc11d136053757c5c8c7df6a43c25545e0af3df3beeed3a
SHA512450cfcb856119bbc40d2c857161bc741ea050ef5c3774c9baa760c5338e996a0ed1f62268603fb771d3a98510b93e0fe97881509f98a5e6cfc8e2f43bf857027
-
Filesize
1.2MB
MD58da134b5e35962a3cb60d403eb178cff
SHA18189d77cb1bacd59838bf61c7fdc0fa54b56878b
SHA2560699948ea03fe26f5d8e48d8f100413c647271a04949b2115de659aff5a8ccec
SHA5128d3c49db4c82ed930c3f13e73427bd890ed8838d6583f759a33d8ecd36c82c8de645bbb6b5bb13299f5ab0dded7d5bc3b8350a7004675495b4cad6161ae3a6cd
-
Filesize
1.2MB
MD5bd259d3c8a41c05b0b85bc0dc0851fdb
SHA19758012b21e81eb3c1452c17d24e60d6f6aab31b
SHA256b4c1d8ba21d10d61786e5e0cf7716f70d9ba376a8334eeddd0fd74757984334d
SHA512143e7b28b7be0d1ae691a7ffc6303ffd80855b6083c92b72ec78a4da77ef598d984675365ae60d1a903af80d7d9b28d161ad90671f9c989263720666c8bdb1c6
-
Filesize
1.2MB
MD5ee128aa93e7a2ba52882b277e78aa72e
SHA123ba49d46f600d08c225d2b32de6a68ed3fb21c4
SHA256fa22dbab8abe4cf2377e4cd052325a092bb17cac145751d4d7664d5244d31269
SHA51223e97c923385816f9a10487239ad2c280abde5e7c2a1b8670307bf5ec4f5523bab05e55d4cbb0fa8924902e5583b43e880b6ccb2071e59040d107628c1a6a2ff
-
Filesize
1.2MB
MD51af3d9138f2af5686cd8961a6e079d4e
SHA127fd97284056c7118a93f78c60ee397c955f2c07
SHA256826a39d5c4c9e16733e433ca0b92aa6b8061f687627c6d998ab2d81e0c6f10db
SHA51285c9b31937ba866f8805009cc8e95b9894bbfad20d1c39decb253978b310aa0c6a9d7486053e1282bc6e2a19bb4a8af5373e4d055558b546e8fe52f42697225f
-
Filesize
1.2MB
MD5d787f9907462c14b23047db3431dd53d
SHA17d74200afc6452e6c47bf373b17ed1d7e40b4c41
SHA2565af882a17eaa9f8f97e8776f2ff5075c05c6f8a9909ba41ea97c9891b09e0d74
SHA51280f355d008dde4099f3b81db93ed2e6122fcd60f90241b8bde672ce8344a364826b69d54145dcb60c001b9ce2387ce1d0253143ea7f3bcd428c39adbd8c7b1e6
-
Filesize
1.3MB
MD5fc212c25cc49604301f6253e99d8f2c0
SHA10d4a5eeec7d7a6df72733d885e993a8d252bdee1
SHA25643c642750c905fecbdc8bc463610a33beb1634422691242a65f7f477207011ca
SHA512cf729e6fd6c8934c5d1d5b5a56bd3417bae7232c6bc35905f8a52e658a66552d99b605133318db70bdb71cf0d77060dfdb0ce729d66a610eaab67270f917e1d4
-
Filesize
1.3MB
MD56300001d5bc54a9c4356c86bc92fbba3
SHA12d5e11892345ccffed3d66008e9d9ac1fb397c22
SHA2565a4d9537dc2f3e2419e8599a5293e9a4f2333f6dd050439b6dbd96cf221c4600
SHA5120870f07e063c3920312baa048f7912137513daf717e1291e9c8e1941ce1dacf5cf0ff20622b3f522c3614b5bdc35a4af1b2411e61eefa868521d0437dccf63fe
-
Filesize
1.2MB
MD57f881bd445f41d028234c99a96451b33
SHA1ab4d06890edb9155f5b6cd74cc9ab8f361211fb1
SHA25654fa159fc6cf82b2203a0cd5f46f666c5baadf7a6a40d1d8536bb04b762f7dfc
SHA512c13ca75aa3db6f78527c7d39405c758c8774c8dd2a919b0d4f12deb038a1829ab3880167d6d61bdd3e15b90144ddca39c29ba31cca73a2a577a070d2ad2c5b61
-
Filesize
1.3MB
MD5f34174809e05559425c7ef077529c76b
SHA18b090d66d814d1d8d7097cb7387cc37420826164
SHA25656b50924e5de8d70caeb74b23681afa9f9abbe05ef4270f8f9537d9e88029b36
SHA512f0a0f3f2a781a64dcd94b6c527623014b6aff56c859d68f34f629e4ed195274df53cfbf202e9ce1bb1c1a4ebcd44609dcd5755ea79fe55e461821152489fe16a
-
Filesize
1.3MB
MD5ab6bb4a5f2ec442d2feed371fc49ec7f
SHA1e81b2eb97f2281ddfe2c15e01f22ee4dce7c839c
SHA256a002d92eed08110333438680d589fa37096013d114ec72dadbc0afd23603f245
SHA512cf912914a2fcc28dfa7303cbbd962f3cf4250a04aa9288fc32e6afce3ea77c09ed7e0e05d3bc5288e09f7f9f2a0aed082351c2ec821923145e1f1c838047c7a8