Analysis
-
max time kernel
141s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28/05/2024, 09:37
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-28_d07438934cea6e47b745da2194b8c74c_ryuk.exe
Resource
win7-20231129-en
General
-
Target
2024-05-28_d07438934cea6e47b745da2194b8c74c_ryuk.exe
-
Size
2.2MB
-
MD5
d07438934cea6e47b745da2194b8c74c
-
SHA1
13de3b8f67d0f25d524da612ae24e559ae0a5644
-
SHA256
930e0b14f0214d4f9dd0a3592ba8dbc7cb94e3b7ceac66c42fb251a553490c66
-
SHA512
b88b7ca41d35fc0230f53e044e28ccb360c647e92508bff46d922fd5d93712a369bca1c884ef015ba5ece34e46aeea2cabfc179c85d2b2f2831f8b74bc5bd02c
-
SSDEEP
24576:POObVw4TaN1wdkukCba4oXtgLhU3wEdmh58nSkQ/7Gb8NLEbeZ:POOh3aN4kuLbegmtGHkQ/qoLEw
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 4112 alg.exe 2436 DiagnosticsHub.StandardCollector.Service.exe 792 fxssvc.exe 4812 elevation_service.exe 112 elevation_service.exe 3916 maintenanceservice.exe 1408 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-05-28_d07438934cea6e47b745da2194b8c74c_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-05-28_d07438934cea6e47b745da2194b8c74c_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-05-28_d07438934cea6e47b745da2194b8c74c_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-05-28_d07438934cea6e47b745da2194b8c74c_ryuk.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\4ddc523b3e2edcd.bin alg.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-05-28_d07438934cea6e47b745da2194b8c74c_ryuk.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_156609\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe 2024-05-28_d07438934cea6e47b745da2194b8c74c_ryuk.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7z.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe alg.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2024-05-28_d07438934cea6e47b745da2194b8c74c_ryuk.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2436 DiagnosticsHub.StandardCollector.Service.exe 2436 DiagnosticsHub.StandardCollector.Service.exe 2436 DiagnosticsHub.StandardCollector.Service.exe 2436 DiagnosticsHub.StandardCollector.Service.exe 2436 DiagnosticsHub.StandardCollector.Service.exe 2436 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 672 Process not Found 672 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2960 2024-05-28_d07438934cea6e47b745da2194b8c74c_ryuk.exe Token: SeAuditPrivilege 792 fxssvc.exe Token: SeDebugPrivilege 4112 alg.exe Token: SeDebugPrivilege 4112 alg.exe Token: SeDebugPrivilege 4112 alg.exe Token: SeDebugPrivilege 2436 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-28_d07438934cea6e47b745da2194b8c74c_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-28_d07438934cea6e47b745da2194b8c74c_ryuk.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2960
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4112
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2436
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:4336
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:792
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4812
-
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"1⤵
- Executes dropped EXE
PID:112
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:3916
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:1408
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1348 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:81⤵PID:636
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD5fe99fe2f1705b8a7145bd54b618bdb04
SHA1fd2383eb80f1cf32fb097daafafc61e212efe161
SHA2568856d8311449554086712d780039072260770b2d046dbfb90649a22dcf5ec4e0
SHA5129a1748239a1e7ce56d3d0583383bb2cdbeddbf1162a6e9552aa3aa4516b6cd8e020e4768ad2cfbb0020b04b788a060922aa28f4b5c49b955eef9a8b5866fe219
-
Filesize
781KB
MD5317ca80fce00c2457a6c20d2dc2ae540
SHA1a97d01457a222bee8609ee8c6eea9a7a6cdb25cf
SHA2568d4c43d3df73ae251da3920057099da7b5bd0f628d2ef89e695448f6c2908df7
SHA512389de72987df818b7f1c66a0a658d9f99088fc146818870a79e627ada9f512023ecf152999813c59b86b3e90ceccb3edc9c6328ee16184acf36dbfe89041cb64
-
Filesize
1.1MB
MD534926f9fa497f0e3f8117dbdf749913c
SHA1166f88cdc21f44b5aadaae4b7bbaf66b3f31ddc6
SHA2568aceecc0c531a9103df38abe92084463134e2c42cc769bc04d420856794a47c2
SHA51211f01761bd732f7e56cb3bf017d26710604c98f0090a5c9b87f1e48130594b7d84346f12fe1651d37f33782a17d62278e159bb582cf56c789c1a88fe9041018d
-
Filesize
1.5MB
MD501bc0526dc6025331fd1504d93bc5c52
SHA16c32e5b0a165397a7332d9582805803b3a36e217
SHA256faf3bad95a7556f85051a9e0e4d265b7297b31088a3b2299af211631c94e9bfb
SHA512d9bce11f0fc3635cbc74927239ae45f8c564d6f2f041089ac34995904c4cb0fbb30e89135fa55e1b99d2ece71e3d769343667726a126e5ca3ed628fb37bf9653
-
Filesize
1.2MB
MD54467a3d2795acb92dbe5ed03372f7382
SHA19e3a703e8da18e1f73400da2c94bea8e14c61ca2
SHA2566cd741ca2377c0be69a335ef676a3b2eb131592d5b158d29df672e361708a4fa
SHA51295c1f8542a9b62a54fe69051adde5832c8871c5ece64495c6a3c726d78d76b66b13a7127c4e5539a2671f166287b67bc32a67216560b1487bda9f6f4de723c9b
-
Filesize
582KB
MD52827167fedbb68e9e6fa3c113c9ef8d6
SHA1c73e07ea62c565fb81f014f2b9033936e76d2314
SHA25664b3682fc6e4957cc6e824532bb967482c718bbd1649d1f4d2c1ec52e549e755
SHA512e375717addf52fbbbfcdc2d151860fba1f878f4eb1f97a2603ef6952c4633c4a6058e4938cd000d2abc521105aa75d50775f5dff98f123370ccb670c3f6946b8
-
Filesize
840KB
MD515f7ddf7c3dbb3acaee7dcbe8cea12e1
SHA1c383188de896993d18c5a4b3d7e0abc2b54c0ef3
SHA25616949e2b8a0d76a7be7481bcb6d76ded071ec1219ec3fbb2619cce8122a9c8ef
SHA5123b3a361fd172b32f6e726973f930aa21349984d0a311b5d41bb5e6b6d7f7d38e08e96f182ab86b5e2d374f23f9a6ab60221291f1019171be777bcb84d1dc4fae
-
Filesize
4.6MB
MD514d1a69638ccf2608802931fdb5bca1f
SHA135badc84455ff4bd9b0373eeb06644a14d773575
SHA256100a2fee2c881a3353c0deb4cab829d8175ff090d4b646abe6ab3771dc7b4f47
SHA512706042f31220a8b02c1cfb5c7de4e274a00004ed5d64f8d0a0fb83b05ba881a4038f689532274c784c9cbfb0b911c5252e8405e5a6df7864f906eb4536a15cb4
-
Filesize
910KB
MD532b30d958695d271929cd40042323f4c
SHA13e9e3e51a3ca2293b38709dcc5e8bbe9aae383cc
SHA256565b5130edb64bc529cdfdf5c5d8e5596af2f6bce5dcf44915b662008336ac9e
SHA5123897b91ac51f219c656943e8eb2ef0b7babf436ae5862e654f06c5f96b8a211929ae0b388475abfadc22929dcd76d709a0e964caa73ae5eb08bbc2e37a722ee9
-
Filesize
24.0MB
MD5082554a0ec9c111cc2b0d423946aaae3
SHA1f1f9e8c62a00ed75d1b29e4a2abef158d165e0df
SHA256d505ef0d9e8eb257f5a2de3c5171661649242af6ed94597755bbea3ca0679568
SHA512eacfc6f69f96a0b6212a0b73b074f1cce6661259ea59dd81b9b139cd2bde6f8a54fab725c48a23f2c407c202b38baaeb7e98a811c5117969cd2442a22e2a3ec6
-
Filesize
2.7MB
MD5d8f7115f876a408126d454e914ff5776
SHA1c13d63d8afc9584400be02aab63c57b31f3f5606
SHA256ed5a989377b3c8513014976a543e124acced7468c892a156db1a1be884f8abed
SHA512db96bac0a80f05ea7a6ecdbac2486c2a15b294a66297b2d35b76986226b91bd0000e4cd882c4e9e8818cfdb50df787dabe0c190d99159e9536430e5135f88485
-
Filesize
1.1MB
MD5e2bb6565a211d743192bb4ff51ea75f1
SHA1c26a1313352e11f749771a78f9dbc9a353cc7384
SHA25637d52b9366e6dd4b7aac97cd90a36ca14803b24b9261498c2b671695d2d8ba9c
SHA512d75f86b535c2f3a0a28df4e259684babba1aff71f7fb42e1fe443a6c2561c42ff0e48391ed532d227ea88a6d1f766a5edb55e8991c0fd55f68b1d8a6171117b5
-
Filesize
805KB
MD5fbb485ab5bc6c0ed9c560f2a3fdfbe71
SHA19a75f17fa25f8e7a5b4433941a11fa311365f005
SHA2562d581eff53266c765da58ade8440e55769588b004a870c52bd9680bc230b2073
SHA51225716bf10f42fedb2c7d001044f41c165e8afa5ebcee7d2fcbb8ae1505138b4bab703372e949e3b1b71ccbb3bd9d51fadb3b4fbaa1cdd9f2f80800f0daf9bef7
-
Filesize
656KB
MD57a315435ca15a49a7310a8497222c1c9
SHA1eb7ffbe395ee8676febdd086bb412189f772186a
SHA2566758a9486c8239649b5a7db78507083d660bb2776184565e11d5f461b5205b5b
SHA5128f879f2a4ed650bf528d4d083f79bd0e7beedece30d67933a62d4349b2d2f065578fd2a3caec75aef471738f0cc5f4eac4135ec3aff71d98608a787693244b49
-
Filesize
4.8MB
MD5f30fa62d22178bc57e1a01bc898c2858
SHA1ad148cf26f9bb3ded9386ad85bcf067dcfb47452
SHA2561d5112aff1813cb54296839d935e2f92e1460568d1610f9c8407517b96dcaaff
SHA512fc4075c9de30f5d3562610b05b86dea6e94717ee4ea7f087e6d3cc6f2b7a5cbe7bf887e97a443334263ba1be1990a43c1b070377c6b5d0484ecc3ca025c99df8
-
Filesize
4.8MB
MD5c34fe3eb5298924531e241b9593ad50b
SHA1b361be8105afcb20f6307d49452196784127694d
SHA25674e653209f4b6cbdec73910d0d591a03480dcf9d70fa69f6bf3b704b5f255d2e
SHA512e2ccc8132be0f4d1c881b36e80eab174af9de9b0b25606dba7f36947702461097ddee2b7d58308834958cbe4899be7f2d32316a9ce930b4a5d36613837859dc0
-
Filesize
2.2MB
MD530e56844e9c6bbbba6805dc1f99ce83c
SHA1710b90dab831ccf80fc6e36eb5ba28c068a57f50
SHA256a144aff8c9eb8c2ed6b293ff0e23b6b5ca2766c05579eb89c8da67e720ee54ee
SHA512145e7f53b256302cd8d215b0b402ea193a97aac94c259cf63b40ec33e17727c7458acbc594ad7b3ded803ccaf81ec45af48da098ff346d4d885ae6902ef17cf3
-
Filesize
2.1MB
MD5d9c9a9e5b9ab15a94a2cb25a6ab38403
SHA1ab240dfc845b711865301b3c46b5b91754d28e94
SHA256d251fdf80a0a87a0159819c806a4e30d87e36aab5740d1779bfdc927f49eed8d
SHA51278b45f1372a8ec918f76296fca82dd3a6b101c1a51ecf40e07744c19d54595db507070c9dacfe8c5dca8d25470b36245d8a22a1fffd2c48e988aea8849b6905e
-
Filesize
1.8MB
MD5e839160d9d6b4a82103fbaa91ba54313
SHA15efcf5a777cbae1cf6224565e012dfd0ccee4c22
SHA2561a89db934854e68d68a3d4a4e516057c56b9b0e83eaf0f64d5d6d8ef4926cbb4
SHA512b5779bf06af16559a5c02dd3999ec440da127dac94a9d7f5f51eaf4a1867089ccbf7cda57c62a36456f4826747627cfb715fbcee2f78efd0a20ded9bf05a2bcc
-
Filesize
1.5MB
MD59a68c416bd7693bb9a0e45fbd40291c3
SHA1090d6b2a7fa2f92aea8d03456df38b5189c6d453
SHA2565c74dc03367972827af95e15fd6e6a02947e414e2aba3cb79de3e62518dc3fe9
SHA5123c82dc01f1b3b60aaa29dafe9e50865cd902f0c77566387ea7409c318929766596e40bc6f768ba4dd72b57e5451fd9f7d582727e9e2f31807a0fc5c521a2791c
-
Filesize
581KB
MD525f966806f56298bd66e1848a9e0a120
SHA1aac36205b541462e88f5cfb7dbb1a15f8b8a54a0
SHA25683c0c1beb4de4a9f84ba8d216a945d9f21cfcf56672984c6475764a993818cad
SHA51286e00e4bf47b10ae3b37fa0c99719c8112805280144e42a6081f6f8cd87dbff76a435fbdd4fc9689c01a00749fe07f1a9669e615734822a5df6c2d6ccc419198
-
Filesize
581KB
MD52729a2a2fbcf92566bfb154c0b6aa2bf
SHA14b14c2d2d6c6b913fc78e25a0456e4bb9668a2ab
SHA2569bdc1ba668368602807bbced491641ca86368a37ff1369c0cb825bc24982e3ec
SHA512c0d9e9185bfb73cbbd7f3cad5b745afaa00f5b5f32c364bd4c680659eedeb423308770a78d6c15dc8e4de26e56581366bc4fd0955c21d92686576a6af44f5e92
-
Filesize
581KB
MD55437cdb687ec5e8cc8da195975a05568
SHA134bba9919db82d4b7307381069d3e0bac975b6bf
SHA256d76d4a99ee892cc26f21efb587737845fd207bc51954f434f7e95d6bba98aff8
SHA512a35191589b84cce78646e3adb9846a2350af065847be6bec96fd37e70a20495420f8cd6c6258df4ab4fb1a4eea6ae8efb225a3fdf38c5d9233093cf0c76690b1
-
Filesize
601KB
MD591e85453dc55d378e359f3385e5fc8c7
SHA14049bfa697a603e154f64e3639568dd8f73c9a9c
SHA25645979e83a972d7d4226b4b21c17444f5affe75daaef6804aa3576263eda4784c
SHA512055557458e719b150f706f0f6f170bb089e08525f061710ad238c9363eab4d27a74cffa239c59d80e58b3ff708980a759af71292869be41587892f287bd5157a
-
Filesize
581KB
MD53806e84c59cc8ccad10cfd652153e4c6
SHA14012af235460342e4d5179e984fbc469c039d8e2
SHA256b6c3a876c07065a58bcbbef8856692e081617db652803212ce414347da1480f1
SHA5127f3bb78051e6ac0b6d0bd2ca608682c9657dca48cfbffc69bc59d8e33511a54253a0f160b598776375b2d916e9a2576cdf355f603cffbdb3d1cd35af970b57ef
-
Filesize
581KB
MD53cdbf0d3aa3fd4f38376a3313ea6edd4
SHA13774e2f7ce119319eeff5cb641187e15da338b4f
SHA256bcc1daa777ef25398aeb23f137a9ae991a236e06b0dd91ce8b5e9c0a47abf69b
SHA51271aa6b50d4801b76a3bd4ad670f961f75571861212be026d87795f598caf97b31e4cb56f6e271aeb4444359cc4374ed1e1a0cfff60494d6bf9af3012ad115200
-
Filesize
581KB
MD5904f357decda1c437c073c255be799ad
SHA153d78887a70f9a4442de934c8a6044447d4e81c8
SHA256242dfdeadd149d90ad44c2ec42a7cf5e3569dac40af7cc0e32d7d3a7eddf35fc
SHA51262f2b9c4e35ed25806dcfc44b466a1153eb8b733ace31c27a1a7238aaef07d7f91807cddb5139f32abdf43f6fe9e6e8e5c62d9d242c29a522621fd7920456618
-
Filesize
841KB
MD5626c274ad2fc2e2bfe6d2e1cc0ccd508
SHA1477641f8bb2c7338d23fc698a7ef20849e388ae2
SHA2560f6336b76f9ff099f6eb94b36348d7db798263453294184d321f89d3da082082
SHA5128b40248b997ea0f53b493fd3aa2eb7e5d0683055bb9cf41877ad2f171225fe2c6d4a47f79cfbcb6db5fb1caf3c1239d8bcda62f8832ede25badb04ac99cdb3bf
-
Filesize
581KB
MD5fb804c27d6b19465fe478f3f969a654f
SHA1db2c2ced9248a2060a9a3e860ad8590f0ac4f566
SHA256bc5d9d72b1c5e2c05e230531164f145d318c7599974c16c28797048fbfa56762
SHA512e89bf63911d246d9962c536e64be0d3b1d23f5809fc6dec162da390a89be4292024e973d5f3b55bdb79c1a584692c0e643b3bc9506608cc4fd03efeb7d1c5380
-
Filesize
581KB
MD5922f5d003e4b8a3be2e16af7779ee48e
SHA179651006a1d29ea148c3b524e9128b0e3b3c89d5
SHA25624d81874919f3be40f841c405169b4f478f966b7f48302b597621bb0aa9ce397
SHA512ddc3a18d063163ca86943dcad8a9daac6d723d1d1b01bb41031e40cebfb3c3ffbb95519afb166fb86e89838f48da27ca65b6c4295e01ad949e88cb86e7e4f513
-
Filesize
717KB
MD5d6b529e01a4ea7a400684c7a7e14fb06
SHA1ca8ede2979eefa0f8814150c0b26196a8e8820c6
SHA256a4e3d1af17a3bb0407ebd24f3f4efdc00859a1434a8ec54f43bee7cae9eca1ca
SHA512303c5e975280f3c972585ae084107b691875e0fca1f9584df0f9aee9feb9d6f2eef6553a236aa68ee9eb36c76c4c0612dfc3d58b6c5659b86c0e313e11fa1c2c
-
Filesize
581KB
MD5162702fe88ed5b41a5bb9923555c2313
SHA124236b627c6d1d8487b3d4b2311cc0a6c9de42ec
SHA2564cb1bdcf5f425141919802f48d76aadc50b990292390e0ee988c48efbb433535
SHA51275c808e3f274d4975dceaf79683813bb04e5ce8f88084bf294705ccf660d5caaea2cf9b0df0d7652e4fc61a526ad9769d272362682e89ef69fc0dc6a2cc784b6
-
Filesize
581KB
MD5392afbdb6279282947ce078ab1a2b3e2
SHA164f5beaebeba0de7d672c9b278523d7283b2e12c
SHA256aaef56e51c1d0a9539a1fe03d0f8a7a134884750aa5ff96601f6f5cf03995379
SHA5124fc8de813c4447e384895f834a3919e77d8d3f61c52a2aa5c164cd2b67d11897baeb1342bcdbc4899b57a82f478abe94ed8341b7b014f736f665a54213f41c24
-
Filesize
717KB
MD5edc6cc9210b5bedafa8ef67b6d99baea
SHA16a171cdb69f57d8bed0e67d64c28e0b3ba377e14
SHA256814d59ec158bb346324408b52ebb20659fa7888997c219dc89d7aadb80cc9826
SHA5123e3003aa32c390e47fb2ea821a120ae226ac0884131c948a70c3a36ab15ce14e349fdaa06116cd42bdafec3c8cb739394cd772a8e6d6694442fe07db9be73495
-
Filesize
841KB
MD512dfff2c17f2b00afbb6fadcf523fd9f
SHA1a43b8064d58baf408b0d0ae15661c739f9246025
SHA256d7d442f42bc7273b7085394172c142fac0e0a15a34710bf78cc85fa9690bcbe5
SHA5124a9da1a4d9cd019c0bda1ef4c2284beaf883b179b916267e7611eb549042b22a8d57db2b860840d88d59f81190f470b076c98ac4b3bc51e3f4033f96a4fd0967
-
Filesize
1020KB
MD556dd5be816440b250ac986d24560ac9e
SHA1710f3fb89bb7f214eea42f733acb8c6210c6818c
SHA256ccbdf67a4d15eedba5b18d747bf9d0660ebcb8770dca2ee3b2cf96fa7973b0b4
SHA51258793042c778041c00b07300cb3e8b0fd94f75a66522cf65791ce737cfa3b178ab6efc457998c9a89c92095091db1323f7e657f67bbc5951b7ef9aaffd018bd3
-
Filesize
581KB
MD5d4c875269c90d775213c715de87104ef
SHA12b08425ece85ffa40543683aa3d8cc47e67cd86f
SHA256bfd2886d3de614fa716224a637f642ded32d40fda8c012e89a51dfcd9c25c4e9
SHA51299c36926f3503127583f8b4c81ab1f3171d88b47661ad51289c826eb50c1e6f4b0e1d3d3ccb4fa1ac3db0f628359c2db80daffab828a338bfc913e40c2017238
-
Filesize
581KB
MD5efb4d76ecdda07e7a69dfddab4c03084
SHA19b6b976531473ee8a598e5136ffb00b9ac623816
SHA256bad272d5176ed9d50eefd01daf69ac959794374948ceb31075a4be8a61d4875c
SHA5124389c7bc5bfc2af4dcb7a9bf5d64658856376ed3f51d3220f201ec6d57677354bb32748e1a8170403126be19c7a85837f44d31015b5f74b2c9f54533b9a91b94
-
Filesize
581KB
MD53712f831114a619939f5b45de49e53e2
SHA102b135e9abea35aecc8ca2c7ee6b3d6e3edc93da
SHA256a8494e66d9341106a2002c8ee6b1df784637814393ec3b14229212e2a63fc7b4
SHA51219efaced54d352611272c3199444817a21095e41dd379ce6bc7963beef3e8b2e6a6d547827a8ddc7aa138b9fd02a07fce5b2224a66ee950587dd6a8caf258d16
-
Filesize
581KB
MD5ed772f2b02423512859e25b437299465
SHA1c6723a8d050781b1f82ed4d0f5daa32bd57b24bd
SHA2568a996191b92f931194db48ac724d74e3a8b1abc545bba4b963f294336f02b8f6
SHA512a5fab2b2fd105dbcc2cd4d3607b8fee155cc4085fc9d596363b144d03ac46d2814e01a88dfa41f811a48e3f9582f81462dff90dd3b8c27a4aaa42f6173066a5a
-
Filesize
581KB
MD5ca3bca998bff6efd98a55c710b45552f
SHA197139bd82ddd56f2e36679afd754578829abb6b3
SHA2563e1964a7f4c30b71ceae1f75909b17d864903b1fb6a7aa5686fe3e1ff306ad9a
SHA5121754009365f0affad96a1e15ca0affb2479f1624fd8f263053f9ca14649e179d69ab0e46a125d89626b6639295a418d27b1d78fef3210deefacda8a2acaae643
-
Filesize
581KB
MD52c27f863cf43e32df079cd562bd92a62
SHA191aec68d49d9e627ff71ec145d00329c73ed842b
SHA25674aed6b140b833c491827e8481478972a9955f6eb1c1b74c61ad5d2b270b38fb
SHA512cb6ef1efc6e6973167d730641679308abd5730c2355417d686a3ccd5bb96df02b0f21f69eb7f5f6ca3fab86cefd18a7b8cee5b5943dd7a6653ec617a05635191
-
Filesize
581KB
MD542dcd3286d58966378d129e5c265daf7
SHA145398f8d14582295724117fe7ce57f1f58e7de33
SHA2564a825cb177ce8be6facb09b347da3c442f2dd990618ca61710c8c07faa8b36e1
SHA5128e5c4a7d1bddb872ab76b3a8dc2ac8bb1f1d8527cbae784eea951fd9cbfd56d374fed9567f332f65fac38a4fa4d476ab0b403a1bf593b6d1f57c2095aa886f10
-
Filesize
581KB
MD55b2d6a051e930b83a1a556b1abbe4f5f
SHA1e9fe771665d70e3c5784722a710a49b801b92955
SHA256ae6b05030d5b31be6d766d4a9bfc8fdf9e26710bab7275908fae6505a1cc1448
SHA512fdbc1c5b66b80fb69b4f26f73f0ac3165329d53a368f638c66c0e4a232e6236d7f823722ad5774ab92253e35a1bf9332cb36a1db23c106c57cfe1853dc22863e
-
Filesize
581KB
MD54af9c96c8f3dafddfbe8cf63628ca821
SHA1c2bb43a37193fdc25321ffd68c5e34a47b33c611
SHA25639c68e8c2163fa6b78b4f9aab44fc9c59126a91594d3b565b9a093d7c66f81e6
SHA512bd4a398a1065f1f7199e475e7420b38c2c3a18ba28819031da5f671acef3b90ccad2fb9ee4f8b4ae57b15d274c842097fd766360e84853d4cdb2c4fa8fc33d33
-
Filesize
581KB
MD5ded91b4e904ebf399a7e26cf12dac81e
SHA1d5d31cd8c59d861b3b8868ac720d11c1c9b1189d
SHA256afe1919623422e2b627a5e091fa944f5e9c68832c44161e49b9848ed2a772f86
SHA5127b19806fd310fbe47015d4e7cb1725421f5fe5e1df7a19afe962019ba39cbef8706401ef3e31ae3238326a7eb8b67077667a696d413e96ee5fdf01f6b766f2c6
-
Filesize
581KB
MD5270f522523a3497ebaaee0831012da61
SHA1454f76ff8a5f35daef06fabfad6f37211d3c78a0
SHA256f09f0f53a4d99531adfa3c738393bcbbfd56e3b0c9ef9f4027a63938824d77ff
SHA512b3f14fe0e6bdb4f10dd0e5eb1e059e6795e05976e23de825401ba097ce7b72fee73ed189d684d61ade8da2732b0e25de2144eed3206fef06e8d5c4cdb3ede31a
-
Filesize
581KB
MD53df1c5d4537ab61433face731b7ae4e2
SHA1d326c3416b2b4398582f872bfb1651ec276da959
SHA2566e87d79c5052040c7c6775f7c40a1f22efd35a6ab7ecd0affbb8689c8080fef2
SHA51298944c40e21780d6ae0599a3fdc95f01cbe537bab91e90c0540b88b6e13633b626e5b600bd47e918563e4a7ce0adb93fbf0393bffa35dd1b24d78d4df00f70be
-
Filesize
581KB
MD52c2eb5c4eb2a14d41b3c0604d857368e
SHA153de8d69b2fd52134adb1919a96bd2a12d397350
SHA256ee23487052a38d3ff6df364127d688911f99f89a776237c4992b48c6d0352416
SHA512189f0f1855768324229342982a7cf2fb60d4179e6c90ba7adaa056a0d7d566aa2c08f0748381307e2efe92b15d56ac97cac9183a227ee8930b7e0306b72b8d5f
-
Filesize
581KB
MD53f62fa8bdc0d18e1a5ce42910e1c496d
SHA1e07feff86b085385220ab93820d0714df3cbc2eb
SHA256683fe312864e8bc61901a833cc98ab32dcccc2dc642bd44eda5305ea303508fb
SHA512cb3d841c1e62bd380718c17b53b16c2e1ee3ef93607f35eb39a226175dc4d31837b53318f35e864ae1c0fba07f40cc9dec9510105e97fcadccc7b8e27941402e
-
Filesize
581KB
MD56d4f6432ade2a61297e496fb1bb02d7c
SHA1fb618a8b79397bb729a25c94cf39138174fe0236
SHA25657101073b8d6185f033e03ce3c7d4ebd97e86d55139098dc634bd95864c6a181
SHA51263e69c140f91c87ab6342f66f092fd85c15edfd6225cb624b71ee168f4b4517aeb853bbad12453f2319bb701b02051879fe7719a30b7a3ca29a1795884bfae6f
-
Filesize
581KB
MD5b3489d2b4ee4f24da2707c7761a659ed
SHA1c936b1538af10bd5dc877a5ba5bbbaa3c8683840
SHA256a9ce6a26cf28065dc162c5fba4f721dfb426028887934d588a561495d50d71a5
SHA512374ac1c1d81f49d8d3a587478f67ee16d7dd0808af85887394b544eccd7780d53f1092e6fb8f7adf60972d62ff33a093e1e1092897afb6aca06454d6e3146836
-
Filesize
581KB
MD5072d61cb431b3b4bd1f8ee109e795df3
SHA131f6c3703aa1d8ead33c88c59e81ec0261480d9d
SHA25675a6bc6b942f1b42e8630b99595d22f96fee4daf0490746efe2a810852a8f0ac
SHA512c32a98b8769d9acc6c5905f25d6edb3293841fe082688db0da8c12d9fcc99eda281aaf18cb4dcd84b9cb20c53818b54b781b672d68df2e62d47602cad218665c
-
Filesize
581KB
MD5c0aba479aae2ed84bd88b55a49a77138
SHA1d5f9ea7fad9834d975404991c3f0e509f3997097
SHA25639736a7e5c72f956261aec71da1b4d1e43bac6994a0b983d835f8ddc63823ec1
SHA5129737153e9c92abc3434458b2f236ee22168bfc6eb576baf0b7f12d51730fd91134001d1b7e27fe303577a1641aa042ab8ffb18840d41b73a0b0ce9dc61ac1cd6
-
Filesize
581KB
MD5b3d104bad63847cb0a793b39df95254b
SHA186bb85d7876278d16aa7f4fed0e4b5c78acbfd67
SHA256f5246a22f3b148871fcb93afbeb0d14cf3c971287e83d88479931701f5bdd80b
SHA512fbbf73ba9a8b3539fe17b44790911a68ac66f52632e3fedefb39999f02648d5d7e383fbf98261386f4222f67bc0e762b2d58a8b5b0d7e4376f88ce4205432620
-
Filesize
581KB
MD5b70b8655ace8c62af1c91b2b81552b3d
SHA1710f19d7534493dce1407f102d272908f0af13ba
SHA2568cb3d170995d162b83f35a7974477ced567841d5cd240c71600c5ef09d238d51
SHA512d147f8df70258d924e05415e6182dc0ea47631f9de4a1e1e54fe802e13ff88f3f92b3d51a44c182a2bddc52f4c8855fd7d19dc3bc5886ea70bd89dd51fa53f7c
-
Filesize
696KB
MD5031810c47e27c170dc4302d00d00a7e1
SHA19c2ff225072d11e3035fadedc00f8bde1ab21c78
SHA256a8dbfa13f94917664eb6109c8fd503e84c70ed53442f065d47c10552e85c4101
SHA512e9e4ab2bc9e09174a1ce487fe3a9f902f98ee4c955992c381663c58dd6ea4996a40ae3107a9aab09c973b32ffd425f193d51e898365ba50ecb8bb7778aee409f
-
Filesize
659KB
MD565f1af5920151480e071b24e785d9d57
SHA16a2b9d77adf1f2116d9a39395d1abeba1a5ebdb0
SHA256b0e21de104f976d3c1f0c1f03db95abe1412e73161efb2bfe5cce6f19612864b
SHA5120537b7c1851e70d5c2c421d0c0765cb4b93cb22d0b86e5e6c0515324bb8dd9698fabfefd498686d8bfb8de384c4af7becbfd71e3814c2bf5282a0a5a2ab9515b
-
Filesize
1.2MB
MD5e44c8cb236ad9c34c9ee2ac3666353d4
SHA1b7d8ed4732f11ce204e858884d54dc3d4411c7d9
SHA2565b695e23f472a80ed86a7a8e53a2b155ea9b184387e7682e22c0b97f9a4b1733
SHA51276d412cc83aa74f686a447c84a2ad2577f64b823b6f48508395f8862c706b5a70e4e9418ca8cf62b12971326bd8b1c9481d4f263c75a5cff4b259db2c8e37e94
-
Filesize
661KB
MD5a328b3463fc47bf9241aedc2f96099cc
SHA120441969622c3e48a2ac0c766ac807ee6a8a40dd
SHA2562e7f15e2f925146a8ae8773d7621ec2ec6511d08a450ecb47e25610893382fa6
SHA512e4dd1e3631ebd63690c26f175582098df2a6f32b66bc6958f55434fe63ddbab96ee8a06ac2a92e866c4ae9196e4d0ba9b8b32dc0e2844c9986beb6ee918dc3bd
-
Filesize
1.3MB
MD5615fdfa2cd26c012cd590e853017b760
SHA12996cb12ea7c17491094dd3d5915f1ad430a3bbe
SHA2566e3f69986ac59ac71d8875cd5a9095ad11ee710ddc5a47cee1df44a0d8a7d04b
SHA51250a7656e9271a3322ce1d8e51ef2870815face48a749d96898f3138572f9699c3bc8a11b808453038b77707cf0b0e7b23edff7874483e315e75f3fb69a4ac6b1
-
Filesize
5.6MB
MD5460e77ce6cb07261d9b982e325b0db9d
SHA1a4d85378858544a4f2de4e0ffae6dc5e0fa9c21a
SHA256fdf0b220e2f31e2f9171e639db942ff1707a28b6c5499003ec6419de2db4880c
SHA512a12f87f08c29d4f1d82cae0472625f219f69d79d928875fc6c7ed7585d22f2dfbfaa0432459dc6fb54ac58d84ecb9121a510aedf18b38045a45d4b549af4e02f