Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 12:00
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-21_d5e1a4bb40dceef9b17c46e770638841_ryuk.exe
Resource
win7-20240508-en
General
-
Target
2024-05-21_d5e1a4bb40dceef9b17c46e770638841_ryuk.exe
-
Size
2.2MB
-
MD5
d5e1a4bb40dceef9b17c46e770638841
-
SHA1
e7be42c8c80bc70749aea9961bb5931590296e39
-
SHA256
0d761918b20a4b96ef81ac759e1dac66833a101196c51ae423ec3873caa6de22
-
SHA512
01a31e1884ca4a50c7ae12902602cc57835f592f9f419180bf04200ebfe7715a4a11dcfd749e28a7a219ddd6e4927ecf3ee3c31a82a797fd703d4f0951b2842f
-
SSDEEP
24576:oOObVw4TaN1wdkukCba4oXtgLhU3wEdmh58T/i328ab4F+rM/aXq6bJfBUam6:oOOh3aN4kuLbegmtGo/i3da1YS6ozB
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 3900 alg.exe 3612 DiagnosticsHub.StandardCollector.Service.exe 4864 fxssvc.exe 1596 elevation_service.exe 3324 elevation_service.exe 4616 maintenanceservice.exe 3792 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\system32\dllhost.exe 2024-05-21_d5e1a4bb40dceef9b17c46e770638841_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-05-21_d5e1a4bb40dceef9b17c46e770638841_ryuk.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\5bb904da4a48edc7.bin alg.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-05-21_d5e1a4bb40dceef9b17c46e770638841_ryuk.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-05-21_d5e1a4bb40dceef9b17c46e770638841_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-05-21_d5e1a4bb40dceef9b17c46e770638841_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{72342474-B513-4DE5-9360-4F37AA503DB7}\chrome_installer.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe alg.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\dotnet\dotnet.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log maintenanceservice.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe 2024-05-21_d5e1a4bb40dceef9b17c46e770638841_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_95203\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe alg.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2024-05-21_d5e1a4bb40dceef9b17c46e770638841_ryuk.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3612 DiagnosticsHub.StandardCollector.Service.exe 3612 DiagnosticsHub.StandardCollector.Service.exe 3612 DiagnosticsHub.StandardCollector.Service.exe 3612 DiagnosticsHub.StandardCollector.Service.exe 3612 DiagnosticsHub.StandardCollector.Service.exe 3612 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 656 Process not Found 656 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2916 2024-05-21_d5e1a4bb40dceef9b17c46e770638841_ryuk.exe Token: SeAuditPrivilege 4864 fxssvc.exe Token: SeDebugPrivilege 3900 alg.exe Token: SeDebugPrivilege 3900 alg.exe Token: SeDebugPrivilege 3900 alg.exe Token: SeDebugPrivilege 3612 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_d5e1a4bb40dceef9b17c46e770638841_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-21_d5e1a4bb40dceef9b17c46e770638841_ryuk.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2916
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3900
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3612
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:2652
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4864
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1596
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3324
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4616
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:3792
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5273e70d6844faf78eb4154f50ddb73b5
SHA1e3d6d8c2b3ecae85572baae15e54ee90c07fb29c
SHA2560a45e823f2d833e9feecc7f4a9e7ac45354dd3315ffcd0629b03cd6d3e5d5285
SHA512692ccba82252b04ab45766ee5451364633a5e50200fe4142d0f0c9be539da5194a9f80d41f0059388420ed4daf4c2c70bea3f7ccae005397a83256c56276413d
-
Filesize
797KB
MD52e68dc9e48234091c1146545e5a13fbc
SHA13bcbbfafdd916e9a9684c2ec84f04686b40f2a19
SHA2562ded3f217fd0a2cd568e1f3f8cdebfffba0612300ffe298ae0c4e15ed2cf83d0
SHA5120b98055aaf2c2e709c43c264f9a2b513aee31678a767bd1129df1c9d5e2252d659e9ef5b6cd290b35c31483943020985c8a27941b7f2b6cdbca3eaf89aab3ec1
-
Filesize
1.1MB
MD59810732eeda1ae6ef6d6a64e93d58ee6
SHA1747d58bba1d758bd7ae19242be30cebc97d7257e
SHA2565da070ef9cc4549c6fc90e97b4a409b0bf8739344cc19f35826b9efa8416a457
SHA512e054c2ff25de4d3ae0482af6484fbd6badf17e0b41f2c72bd0d2728dcd9ee6b7d41d4d0f07b87747991e83904d3834359820b2e377c9feb3bdd2800bdbccd8aa
-
Filesize
1.5MB
MD5b00958e0c7536390bcadef54223c161c
SHA1582ca63f17c5dc642ab4961030803a306f54219b
SHA256541c753817a6fd25c8859c278deca9f7657d4d590d41abbabe6d94f653bf415d
SHA5120540e8604bbdd80e30010b2f2f70999fbe57d6739a7045533b988180d66c3aa7a90e241154b7bc7f4692ecc488008cd0f2bc7ac607452d6f99cf43d34a59ef5c
-
Filesize
1.2MB
MD5d9b9ba3b94d6cba88dac9804565d9db5
SHA18a3e9445a0b9ef467190e16658e946b1660d53b2
SHA256a23aa2018a9b7c8b51338e4d0d009767e899d3aa0069f95438da59a55eb7f8c4
SHA5124d69579919a012cfdfe117ae48861808e9f863f8a72bab95f9a0ab396b3f3896125d199fe40be9ed81ba51baea72c37d53d208bde1b7e227ae6df6fbb9478822
-
Filesize
582KB
MD50217750908b17a8d22bb58f6c21e1854
SHA196fb7f5878b3b54ad3003fe5b22270a6ea6b3f71
SHA256490b11b7b864e2ca70d26804b02891f95456df6c9a63ed15ffc7a03f782946ac
SHA512c47e8fbb8a19a6dd16700c1014dda345a6c56dae259e37acc052229734c69d786bbd0afa612ed124100db6438b52e50c24f5fc8f2065801bbdc6da34d424b04c
-
Filesize
840KB
MD519fc3dbb1887f84ab0033db03de69a4c
SHA1007513b2b28a5650b82b56e3f0d67361ad32cc2a
SHA256d3d0f6d3a3d5758f2d161d30436dc3526303988af3a37ace31ad17512d2f230f
SHA512d6867525bf17e1842be2d5192b5eb12797c281bc2d40c4c649644ac19e837efe832bacfaf2c41268159dc8109313838a2ce2fe7117851f3ae1a301f6769f864c
-
Filesize
4.6MB
MD54288aeb18b2050b1a11309e6328e7a9e
SHA17f0c6550171ff83d26cb0fdccdae2e0ebbe16332
SHA2568e56096d35c1ae65190e3110316e85bd0cd452cfec4d8f0904faa544be11b36a
SHA512c8be1f9bb443f2cfc845182439e38372f7aa55ffcdcf8a1566ef75f58000a565a492737614632b36f71b1a508e7ca064f7a7e5d61718262691b928220b2fecfd
-
Filesize
910KB
MD500f678f807ace86621e9e35eebd91e0e
SHA1b7f31ea26d6ce22328a8526ba043cd58498b725d
SHA2563762ea867f017da80f1ffbd11faecb8f108d66192463b981a211c5320aebaba8
SHA512c60542ae7291850cb89aacf663ea36d40022839a839e2f214517bea9f4b286c3f1b51154551c0f58f4b06c94ad940dec141e61988d99e9ee074c17eff152b757
-
Filesize
24.0MB
MD5103871af834dc7f34e887538c4a4189d
SHA15fe6f58ebd9fe6f5c8d15452200534d552ff011a
SHA256a1a7aab5ffe81c6c2039bbc630617c942c4ddf82569309aeecc5b5c09d7f5050
SHA5125b8ae544d9031461c39501d3ebe7bb73e72b9b6e9657f10d49d89984df588be788124497782767573f07922fb5d09e190e5fa5cdfd5f1f01bbff4e9f65cfc978
-
Filesize
2.7MB
MD51e92ac087094cb5969e51d7b02cd1a82
SHA1c442ac58bf2ec370e7dd96b88ebfc6f725a2ca04
SHA256852c639853a36b92c1d920003a4d4efeba3b53301765b5d73b915a85287bd5e0
SHA5125c8da9b25eec7632b345e2e512ee85fa39e907e23f2195be06aeb9e2b4c57da4fad224ca612baf7aa7dd3c982504f17853074ee45cef64c8b6f40a3c0ffbda20
-
Filesize
1.1MB
MD5e8b23bc4f2d6c99db965c9f1f29f3669
SHA114a0c0c70e90871c2fa77a895dbc8398740cea71
SHA256019698231e7dd5133cedc2753c61018948f17ca573256c396e98450e7562e1d4
SHA5127035771c5fc8dbe30e3fb2dacfc5f1707cc6545786645fb582b1681690f06e51d29b280ed2dd192edea4145446cb10dbd0c6e646d252e8d8a0760ea21a093f15
-
Filesize
805KB
MD565f213ae6cb2c9989a03e704eff68aaa
SHA15643bf7755c8475fd7a8d8d8a9ac52ba7f4bd8ce
SHA2560fef7c85e1b790872de4e49e4e370384cbccef22605c7d571c917efe5ba3cb2d
SHA51263d340e8ecc3761b5514de25f00c27a6f4e1ac17cf859583bda2af594ab77016e28969c55ea9b6342c297a6c88bdcb496c7625820143f85705a93a45526f9676
-
Filesize
656KB
MD5e2e1c99f69d7ce9b5f02be06d9f09703
SHA123bd852abd06ae8e83b35ae9f4cf4216b74c543d
SHA256e4cd88ccab890f84ef8efe6599632e7cff7661d807a33b9a094906f52f04d2b4
SHA51237096ab7672c5a5ea1a1b28d42301901b3efd2bacc3b9d316baac318ba5892595c189db35bc0aee842115647f7cf2a2576dbd7267ad979e46c42f058898bfb12
-
Filesize
5.4MB
MD5307fe285ba736da1c6abad8dd526aaf5
SHA1b3fba24e5c8fb8f72050bec5b69d27d8471e2c43
SHA2565b50650c0fc807a1c596e332270ff5c54df15163b639eca6b37616635b397569
SHA512f7cad52c2ed40ae1175f664a9c46019e06a00adf9863c7c2ad97c1409662f18a5f019cab98b551aa86d3c2dd3c7e895c3a483e87a60bc54d03ccbb282cf8e1c5
-
Filesize
5.4MB
MD53780c973dd4b0f00c6454634d819c030
SHA122b9b64e0100ef5bcb25a9f87c35c16fe7758936
SHA256221a741e12ce8c95bcdd12c1fcd48108129d5c4192433bd7e3d788ccd5070e39
SHA512056aa31c573d639666971892d1be92b1f20ef7db61e34917b5ee47a8d1a51e935e28d2e47137c3f609971029d69463a77f344d2e84e4cfb94b0c6fb78341b957
-
Filesize
2.0MB
MD589bf7a626a69b6cea49cb9cf44e1e49f
SHA11bacaa1728d6f7ff77c3f867844721cc8218d6e7
SHA25619a2077fa87522b4711a73e0ec70109d290902dd8a21b2cdd692f50dd2ad5e6a
SHA5122963b068992f6b97e5284b1c97b06547993cdaf3db0552e9ea7cf92a755a90dacd5b8d7b62adbbb1439813d74dd7b182c70598eab5fae9d41d3b08c77c28ced0
-
Filesize
2.2MB
MD5a0a4492345115115f0a85762c0a74fdf
SHA1ce30bca744680d065adcec19e0d2a33d1506c6b0
SHA25685720117ce2cfcc6ccfb4444214696f03f0955895012b059fcaeb162934fbf08
SHA512504d711badfc8944fc38a78b56b98c220a99e250ad2ad74f3903ce6ff38e5eea0a009272591d7ecc55139c691f724a29eb83cac302c0a0bcf645681ed1867c4c
-
Filesize
1.8MB
MD5afdbd5457fd528a53ff92e7f59be2502
SHA19e74e1d234e1eceaa7e5725db0f96d257198815c
SHA2561c271915d971934099b11d341bad0914c5948cd5bb1e1819432d22057deb2772
SHA51293bdff4cf8d6cad3bfa1da22d83285016f96a88e4b0fc8727b17dc36eff2c27c5e2a358848c11e906a520e2ec13779db33bec9f4766af80333e59aa94581d5ac
-
Filesize
1.7MB
MD5414010cd4e16503f18bb182021245159
SHA1becbbd8f2134ed3cb48533801139d210e2b5737d
SHA256f936d94d2e2c3281deb883d322f6a8d4f7a9b78853977a2298a618ccb2015874
SHA51274f97705e535c35e15b4d62e928495053c40e005b2095de8292a97ea93de773a2e4149b5920e718925c34c42d96c7ed7baf2aa3461837d5c17e0706be2737d43
-
Filesize
581KB
MD53a2da6bf2775ae0fe85e632725249cc5
SHA1de085535c7f5970798e208c670bc816e5d8af057
SHA2562fd6fff0240e8f9955ef1bb9ccf9b3db0865f7b25008154159b7a9395245ddf8
SHA5126aff8bc6df46a00717381c6c8c46be9c8df2abb312c030e2c827075e1c97b7ce001c2379f8d3726bb3ed2bb4cb56b46dc6d1fffb2054dc1e172e362b4523d091
-
Filesize
581KB
MD550d3b46c4b85fb2db0291c27e2021b3c
SHA1cc3d4315eaa5b83468b021ccd6c3e45f3d77ad68
SHA256f6d43bb5c5cb44af41f00a51c98d719ef72724d77096ec187c605b5f268a90e4
SHA5124cc7bbebc8d585ed86eab584985d59799adb0eea5fd7e7c4a4c64fd9936702bb1cc35dc649c6eb1c82c6e202e87080a7420d8295447ae257e9b74e7a2a6038b0
-
Filesize
581KB
MD580645ed29c657db816e30b461b50ad13
SHA1abf80e01fc354863cd2e32ad6b4e867534104887
SHA256de8595565b628b86239e01a4f8d23bc9598f45945ca514f9d0519e004fd111aa
SHA512959ef925a5d81b954a01cd83ef6be71b434a3a453966a20e02cd672cf5fb95550b19c0b2e1e964bd68c435d6b33fbf3a6dd86ce7d86dd149f5b31cea9bfb055a
-
Filesize
601KB
MD538a405ff1cdf2df4146f80d5eea06879
SHA1475faadd66723c0693a0e34e8769af95edaa6290
SHA256a1ced602fa7163dc28d690c26d5c6f5c92d6b787719cd981a75f08edf1dcdc08
SHA512acbd7791a6346c8ac1425d4ade387082054088c9139412c3b3a09ceacce23d66a501ba93d62bc6902b2f3aa44c08e8bfeda9ad86b65899aca1d9a3e5ffde117d
-
Filesize
581KB
MD514ba7a54c64c3b1939b0796b421b04dd
SHA144ac30b0630e0aa9b5124830553f9a9b94345575
SHA256ed7263f32d4ce28a42a2be973ae9aed78b21c478c18b9164de82c17ea3bbd3f6
SHA5123c92c74bb09defb3256030e2a2049d7aa5ff34692d804bdbb3dbb6289bdeecc41c7fd2e4ed3f86b18369f63096983d64e2003b80f823c1608e6bb4d635883ea9
-
Filesize
581KB
MD5f03fa06e10e75e9a3796320e9bbd9960
SHA1175779749a3b090e5f136f8154a59b84da40caa9
SHA25698b3c838ec1b8923e3cda4b6dc2285a55b596bad98785d1af5e283b0806138b0
SHA5122aaa4353274c0828c6c1df845da07058ac730786250b6e37530921bf0cedf89123701f3ad102fe56e6d288e1d8bd251108d7c8b64811348eb7b6134d2b7c5864
-
Filesize
581KB
MD5f41bda45c7c4fd5d9a7272b5fcc6d237
SHA182ac46e6fda0ce6b726745549d1ac9a8afe21d42
SHA2568213c509fd47a84f7ca06485d416b3d97d94e6e874f0e61b7b9d34e2478d3cb5
SHA512f9e045617298f3dd4ff0d3df59fe69af70ea792cb053ece07582952888a1911a778748d69f05aab06c4c3e862dd7415e5bdef21a5a0701bbd61e60fd5cc7b38f
-
Filesize
841KB
MD500749fd72571d65dced306cb40e9d087
SHA1d6de4a8de786a9263e0d49447825e6e929ce2c36
SHA256d8f6aa8437ee1134f99030df5fa55c7c2b1b913aa1817d0e64f1545a38a745b1
SHA512b994a987fc7e706784fc87e8b7279000929baafee47f7fb6772431f6c63289c514d248702821195f04387e8378ebba80f5ff16802e2734961f33fb1c251f2da8
-
Filesize
581KB
MD54112621a47637fff6c9e356de8e5602d
SHA1985836f6e158d3ac62ea8630cc00504aac5da3a5
SHA2565d55e5a00295b21865d80da52231f4463a8dbd445e95d5e7bd0acca4329d6330
SHA512f59e31e3ab7e33f8368a7ecd7c48d7b14eacd0cfaa4a6111ef38ed9fb633c4402f2a2d51607e84b84e41a2352864111f9a9fac2d36a43ed4bc57d7032dec4433
-
Filesize
581KB
MD5077a0de3b945a02b56ead0901a7c1286
SHA1c0d3611203e88e35f856d24d9f5230d22978c18a
SHA256c7a152c34e31659ed36773c9b80752a2dbc12db349e9f57821a925c68503520e
SHA512aa8abbe5d65d151131184134c7bd0de08ebf6310e5178e11cdbab691fad6ed8006b72bece27bc2d6247c1abffea741c04c66f2a8f8be70dfdda9ecdc64a4bf2c
-
Filesize
717KB
MD503f0b211580e60bfedd2734edfd24d2a
SHA1b06c0cd43c23978178ebec8069af8aa7e9083c78
SHA256fbe1998dcb10c0bae9a7e2dae20595747dbcb81ee07f3bcc1856947ff7afb1dd
SHA512f2461475496835e18f8ad1443fcb6df545c5a4d4b73c02d80be6eafe732cb4f8f9d53e350951ecd55b98910f022a5d28fbb9ba101730732c425056825157a8fb
-
Filesize
581KB
MD523612243bc833bdb12ebe963750aa5ba
SHA16051c28048c3e902d85d0c0553357dc83a7e5fbe
SHA2568197ce73cb42db4a3137cf0a7c4101ca725d28d87f1d9a056c330a382b7764ca
SHA5120c1098898558644a4a8837599c5a096db7ec579a421857f57b49f0b5e96663737742133400c5ca5f44a1a14e0f8dde50c0c7f5828b11a4539b1f98c79e625903
-
Filesize
581KB
MD5edc550a13ccb74ffe9114178bea8cb95
SHA1303ee35ea9e30ee8a9c29f5c10c4c8ae4ba317f5
SHA2565f0cafaa808dcd642bc6a4241384c16242a977b38a30b876bb57c6930c53789a
SHA51258e7b54bead2e0b38af8b7b13af02fd046eb1e3054ec0526d95017ad3d3f21f51336e74589da66af51e1e74f969755759e2dc35fc37f307380dd872bb8c1fbbd
-
Filesize
717KB
MD5a1f2de050f547f4432ffc572868b4258
SHA1f7ca7b6d941b08412b1acb5d36e9b3f6956a5b1a
SHA256cf15fa3ea7e9c9fa7cd107a4d35ae962c6fff9805715c9c626a1ad8964dbbb36
SHA51259e3190bfc213deb92eb586979e597be3295525346e9049fa5f0cdaabb3f396e99d4778dfeba0be8f1baaf8b6bc9a994283462578eaaa2956ed9f47c791ab838
-
Filesize
841KB
MD51ad7326558fef8a5718beb8384e8739e
SHA16f61ff80d8ad65f6ef72104a664d43636ef8f7e3
SHA2562c4891cfd56546270c4450e9f3f339ee0b892e31547894ce3bb790c188783a47
SHA512739acab5e1dbe71b668bff3d0d847ce9c3b219a20863bd3e24cba3ba4d0f80aeccf3ebf120bd043eb3e4c59c4caa7c5b02f639b8ae3901e4df377e7f850caa36
-
Filesize
1020KB
MD5c9236f770443ab5cf9166d85372a1937
SHA1c8d25ad35142136ecc0e7db7ca22eff8dff51372
SHA256a70a91e4a86ebb7bf5534ba76e7221d7d72ad31a1c4a3427425626c176d3508e
SHA512204ab14f3799450a95b2c97795c714389b6f5bb436babb63da4ea8f6003b14b73ecf14f87dcc04d8803cb3d8d8c6effad620803dc9208ccfecb45dd2ef8a6bd9
-
Filesize
581KB
MD56333d86c43cca8f220cfa842f60b294a
SHA1b3965a0630933c2b943ab7a434090a81d202735f
SHA25683b98ebb9939e668c35d8c87b6845cb45a0e2996c8c5c1b85d5b0d884149c4e4
SHA512c712fc2ef999510271363853ba256d9f96b1a665186962a011783959e1f7a15bd0c893ef753bd8e2e0b0b4fdd52320f29c0489052d4c235b29bf5cc5728dcf0f
-
Filesize
581KB
MD5361c7801521f5179a4fc85d7a4f79f63
SHA1c6d5a81fc0e695006516c3a9dca42a5328a29506
SHA25672bac82596eec1cccc18112dfefd4b5f87bdf6c02e0ff004ba612b0b7cfa0735
SHA512905f33d6c5b4baa97ff7cc5217b50215adce43b62bb656c8026979dfa323735587cfb0789042d2c43599e129257499b757594ce40c8176eba83e8e9785180566
-
Filesize
581KB
MD5f375420beb6ab14377ee4f8d02d93491
SHA1c1df89c602eb998589a315bb4018d583a60a7dce
SHA2560e72e73895f6113461e34c09579245b9b825e278f53a5839a729ef66e0143d29
SHA512fabed89ac20eb55aacdb5d146540f17d0a8339b6f8b0091a5495457305563e072c3547e8e888151efb629f984bc485bdb4065fe622851fb6639759476c34c3bc
-
Filesize
581KB
MD5760538fd5e40231785bb80b3faf6cb9b
SHA1e56a2ddc4ae365a87389b13408648b93dc036a23
SHA256d64c9724cb689c039fed1bf395af58a113b53cfde06df004e0a158c71ed94baf
SHA512c9f64b70dd5b357b4e6ddfc68560b178c0a7889643b1dffd10ebc624407a80c6f8163bba550dd915a28902e684a69d58ce89668f72e0f46e52ba93c932fbb7f2
-
Filesize
581KB
MD5b1b66899c44e6f00172d54277b2c2808
SHA1962bc7f6faa9ca612207c18e39eb21abb35e3651
SHA2567b41b03177f0f04d1719e66637d11fcace5854be9d9da83783e995c1bde033b5
SHA512ae1759e2c0751c9e2f772d9382362a6b15718c9f5232ca60f7ca55e60ff32a3dc1b136392b3617e7b6dd9781abc13fb8b416d2d4bc43338901b722f6a03d9863
-
Filesize
581KB
MD5fe1a319316d6e967e102885b127dd796
SHA1c5fd44dc856cd50c1d7e1f7f4349caf1d101848f
SHA2560910efd14bb1b7d2e4479d15bba28dcb7d4a91bdda8d54c9cbf83ca403b7553e
SHA51297210722e30f41d6aeaa387dc51dbef6a4ae999ff4548c36de86b4bc1de3be6dd377e5b69a1237f2e9af92c503c8e7c3bb9d3e198da9c6277967ebf7eb78659f
-
Filesize
581KB
MD5ea29fa0773fe0ddb2fc1622a95422309
SHA1c2b74f57088c13a826bceb8beefbb37910b70d7c
SHA2561d427b9e2fb2a1e40b3204fc0e060f10916d0407e3ed28c051cdc93aac93051e
SHA512fcf65037ed54f363fcfba90e187d9d3de1c09bdfd0115db8dada7a1deb006bc541e272211e6c00fb93e5061b0685ad7ff342e8cacf2447f2d414589d8b6baba5
-
Filesize
581KB
MD55c2ab9deec06ef6725de326fe14a50c2
SHA1a5502af302966bf62a97991a39b58ffd98bd001d
SHA256bac6bf5478115629c120c932324f7834977457247c6a0a17f3028975e3f3cc64
SHA512605d12dbd1cd80aab6fef19ee312c89e8bec7afb4cd67f33ff2993c011b58bf07768b0115c5b002866d7af9c6ee12897847e0a311a8d42ca88ca3838922ced41
-
Filesize
581KB
MD5020c1215a6a7bd2874ef5a8affd72171
SHA1fedcacc127276e6746edd88bef364dcf09f17320
SHA2567b398d9e448768d4dfd8758937e7165dd5af27a4ad49835243a27be0ba07f80f
SHA5120ec428b3331331679a04f0b622d76b425132bfbd46644ecc7ce1499aa9fa1b0af7fd6dcf3100dfabfb2a57a4e41787dc81c56d048173a8074ba0ad77508ceda1
-
Filesize
581KB
MD590162bb098998a60a44db5f33fb2fee0
SHA1213cf8da63327c0db302460644f6320359adeffb
SHA25654bb88a697a7803102799fed285fe874bba6f6206628274c050d32457f1e75ef
SHA512eed92c6c7a32fea83b05d3148ce9eb35b29bd8a6208de663ee3602fe6ac0a9f39724995f39a597d2382d4011cbb9a7b5928863708bb4348bc271bef4bdf89835
-
Filesize
581KB
MD5a26e851717a9fab3d3abb4db5026328d
SHA18d8fb16c3db1fb2a06dd09eb37866533e1055561
SHA256be53c4241f17f204f62d36e3d3e981e0522ebddc69489938cd129f080d5b20d1
SHA512df37137323fb7be90c0464c15889b87ba8ade69955e439a181537b00de8ed92aefaed9b0b32fa8cec3ac24a4c6cc1a8202624b607186bb1f5c5c485208494532
-
Filesize
581KB
MD588485d937e9951c03a5e50cc32029e37
SHA1a6759b65d02ebf1d2755d8eefd8cb5e77ac842c9
SHA256907e7285a328e98d87d9bd471506a2cc06f2983956d53847e95c5a200d0b5143
SHA512f6a50501d660a9e6ed6cf7a30fc6d193c1aa87608bc368d06c9ca06dce39044f7fc3292cfa0206e9c25a2d8134a9a0c2d38f6a1726e1a40e059a6e0b7e8a0020
-
Filesize
581KB
MD5988058eec093a82fe59e86830f942a86
SHA180ad514c239bdccb24c5087f27892cdd3394d706
SHA2560b8e927879e013b16217f218e73b1b526f779eea47a9d53f91df5d42a1279db0
SHA51268dba2749e5274a6093e3d128c7d7d3f51148506ee6662cd9fccd7d8806db698b4b0a3b18bb3d4b890d0d588141e12ca708ba3cffed9a0443f4271d6ba44d29f
-
Filesize
581KB
MD57113eccf7dda426832718a19f406869e
SHA1a7010ba20b54a1d4eaf3993b1576dd5ffd342b21
SHA2563bd60072107e94fc6fb162dc7adff4e7f59556221b589ab958a9d226ed3312ee
SHA51255e171947d0a370e83f3fe5fe0b5004ee46871dc27dcbb7d385609aa4fb21fdf6d20f6d3aa5ad439d945c1073210f040532b6d983a0b1ce389246ad358c2f158
-
Filesize
581KB
MD5cf4374d96d20600c4fd15700ca7599a9
SHA10946a08e6a6462480d92f64559a221c281e986d3
SHA2567c9debf80954ce5160b4f7afeaf507b98515706e7500740278d533eef8d80893
SHA512101ba0596f4bf91996a3a2055746e8f67051174617648383005018270b832e1ef0fcbd2aa7c87890bb4770f8a09d54d50ef3bf90524cf94021ec7cb20bf14d60
-
Filesize
581KB
MD5b9a253dc2eba4ae715f17ea62b05e3f9
SHA12cb724c8d7fd5e5098f09c179782f752cb61aacf
SHA256ab5f7b4e21e23ed93a1a777deec13193bf77f445a43ab045706f44a1916fee29
SHA512449a79e1e43281194ec7aa057d09132a662c09ae51542298a5eb40bd247d1cd61df1699713135bc3cd24f73bfc28e7d80d6728e07e6f49af460cd056627b9b02
-
Filesize
581KB
MD516a8b3ff2afd95ce3d90ce80c9f5e065
SHA1abd2651e75746681b1a7f2941a7c69d9ca739249
SHA25607444c772b33d133224c7aebe2d2d6abdd4505f7477917d618cac39537c9c836
SHA5127a7b24125e0b664611cfa6fb6e71338cb6b96ff5787ad8454319954dd613c4e2a367192a781ef2b77b7b50777d3b9cd345ffdf911ec5c18a1607fe2318931370
-
Filesize
581KB
MD5c180addb93de66f056974667a7a627ee
SHA105f38a4960e7dd9e15b63e0d22f9344899921223
SHA2561d24b0a35b4c2bbb4497cedb5b68875124b6d8cb585e4e45faa736e95aae561c
SHA512174793b1d3de95c7715f886d30c16c7b0720f569dad503337aaada08760d651fb48c85311a7ccf26b6fbecdb04d8c63c394628747780ad761192e0e88eb6e7f8
-
Filesize
581KB
MD55ee8a3f4ff42aae379d39c950868ca9f
SHA18871bfe9a9db650ad987ad300e3897b4f51cb7e6
SHA25606679e42fcbbb0858e83913ebf7cf7bf0571f6eb173da71bb570baf5105895ee
SHA512c62c85ff4463cb5075ab6d193803ece027b7ed26e40872d161cdad4850b8b3ed072dee9cd0e15669209b64449e06a9d5a8bdb88ea555a84ab1dc8af2edc05ac0
-
Filesize
581KB
MD5a82e49b0a541ea06c70196c88bc0c388
SHA1e6fabdaf05254dda3ed1c4454850ebbb6a5b9a50
SHA256c86cd0504055d449dbf37159091e135d28b8e7d04f12852d9cf3789afbac823d
SHA5120663fbf9407131f48e4a0cce07325405e845114861aa83408b9c37add97ee43db1b0cf5a57e1611c0a3cec4d5482538848ec6c1dec5ce0b0c877e6f27459ac77
-
Filesize
581KB
MD5a5e8c5623c9f142012c5cd791dcaa91e
SHA1a7eeec49407501066568cbaaa0bb78b7625eebe4
SHA256b3f233141be5118264543672e4339f7309220d664319cec173809786081b3eee
SHA51267ae0516d4d6b5167127ca49e62eafe3da6cdf6c651e10550ca479b275a0aa775b0db3f2fcbef8911afc989c9d5219e9509808189d4b6117e2895e0f453fe296
-
Filesize
701KB
MD5ac3ee95434ccd7ff40edfdec60ca4e24
SHA179f9dc35d5f453d20673f08ea081538c3c8c3bfe
SHA256b90376f721beac0e27bf762dc89db5283c9ed9007af4e300a3a254d27fc13c43
SHA512eaf2a624cee7bf965e5e7007b1b7a4fd9ba34051087778a48d6cab29d313177ac9d9c71b3f75eb4bfd9670c1e5924aa9a33b1a9deb8d8ba39d0a1ab952b6d4dc
-
Filesize
659KB
MD5c31c0aed26f1a0d5786424fd1fb3aee7
SHA155518f8f98cb294f696d04567cd517d7637b56a2
SHA25618aecc1403a6537cf0a56373212cfb6e492352e22739a75c0a6860cbed708f1c
SHA51293cf72dd1fd6320ea74c098facb355209fd3995bb16ab86b760dffe32806c26ac6815e149528d677ac1d82da0f63d15010eac38816715a8673765f0b501538d6
-
Filesize
1.2MB
MD57f8a114d4e6b5bfd9ce883739c3872f1
SHA12223f198c10ccbf28b736fb7b7fff19972244fb9
SHA2567aef99315ee24c9330cbaaa1384c761b52a8479256ba2398cbb71fae866d7b30
SHA5123d5802824ef44ced122eef4d0cdeacbfb37473a47b07646ee23d4269a31ccf6035a4149583d11e383450e2acadd67a17654157ac98fa25ff688a6981fd3292d7
-
Filesize
661KB
MD5d034018b53cf432864ad91bc7d7043ea
SHA175516ae277255445d76fcf9f9f0f1dc39e96ff83
SHA2560d37b9c9a3c7fadbe8a0a9a500bb8ffc8a8395c921b8f9f35a1390bfb74308f7
SHA5127d65d86c044fe47dfccff40f2ecf6eb7558f4c54a8221ff5769183d76ed6467499926a1606a02466236989a714c6a5e83a5d5be64f1df3941c1eb2cc718288ad
-
Filesize
1.3MB
MD58e817a9928e1c98e3ea3242362e59c78
SHA18bd809626aa383eede40f616f407143c04e926c9
SHA25610a16415076d5645fa71bd80c5f04464de52d52088f96499141ccf3acf6e9ad1
SHA5127d7ca20d438139229024d596b81c599dee5101dc201357e185fa5497ced050e20e929d43895209bec59dcc876b3e8bca0c3de9f48f06b2d3cee6af89bcb85ee1