Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
30-05-2024 12:14
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-30_3f40dda6b02e2aa89e7f3185369729ac_ryuk.exe
Resource
win7-20240508-en
General
-
Target
2024-05-30_3f40dda6b02e2aa89e7f3185369729ac_ryuk.exe
-
Size
2.2MB
-
MD5
3f40dda6b02e2aa89e7f3185369729ac
-
SHA1
34aba59ca0e32cdb996cfe1d61927103f0213372
-
SHA256
f061809aba047d3248e7b8b7c02ce7943da2a6cb38ff757c32840920ede10f4e
-
SHA512
8f312166197c7e90ce46de41f5712ac116e9e1f6727751f1f09151562eddc857fdc03c68f0a94e310b15c8cae92b9e347cb53a2bde5d33ce655fd15a9c452cfb
-
SSDEEP
24576:WOObVw4TaN1wdkukCba4oXtgLhU3wEdmh58catr0zAiX90z/F0jsFB3SQk+:WOOh3aN4kuLbegmtGBaB0zj0yjoB2
Malware Config
Signatures
-
Executes dropped EXE 6 IoCs
pid Process 1484 alg.exe 4208 DiagnosticsHub.StandardCollector.Service.exe 1692 elevation_service.exe 5076 elevation_service.exe 2588 maintenanceservice.exe 1380 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\3fdd2429b4b1389a.bin alg.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-05-30_3f40dda6b02e2aa89e7f3185369729ac_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-05-30_3f40dda6b02e2aa89e7f3185369729ac_ryuk.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-05-30_3f40dda6b02e2aa89e7f3185369729ac_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-05-30_3f40dda6b02e2aa89e7f3185369729ac_ryuk.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe alg.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe alg.exe File opened for modification C:\Program Files\7-Zip\7z.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{28C8484C-303E-4CB2-A704-E3FF47E10F7C}\chrome_installer.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4208 DiagnosticsHub.StandardCollector.Service.exe 4208 DiagnosticsHub.StandardCollector.Service.exe 4208 DiagnosticsHub.StandardCollector.Service.exe 4208 DiagnosticsHub.StandardCollector.Service.exe 4208 DiagnosticsHub.StandardCollector.Service.exe 4208 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 660 Process not Found 660 Process not Found -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2108 2024-05-30_3f40dda6b02e2aa89e7f3185369729ac_ryuk.exe Token: SeDebugPrivilege 1484 alg.exe Token: SeDebugPrivilege 1484 alg.exe Token: SeDebugPrivilege 1484 alg.exe Token: SeDebugPrivilege 4208 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-30_3f40dda6b02e2aa89e7f3185369729ac_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-30_3f40dda6b02e2aa89e7f3185369729ac_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2108
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1484
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4208
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1692
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:5076
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:2588
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:1380
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD51aff2aaf30b64354339c010cf40c80b8
SHA1eedf010aac519f3ee4bc34cd1d59967b7400fabb
SHA2563cd2e572b34f021d293530b3ee2203a676ba35e78514c0d9bc13da3e9b16c0b9
SHA512494449f2937e733134e72c62e6784c5102d588f05f0a67e0383fcf38a2bb063a3ff64564116334635df3d97ee469662dbc5f5afa4bec23e06481bdbd6fab54af
-
Filesize
797KB
MD5e43e11ce710523117ab2582a6f92e4ee
SHA108927e6b940447091b5790e5c789b3e10a3c8851
SHA2567a8076e44880aa44e3dda4a62db0c5356b99c106df906a503b1f26fd4675f4b9
SHA512624f9f4b2cf482238945bdd87cf46a77cffe90693b5c79ebabb60337fad820e4f504df6262d3ccdfe39aa567c8f49cc9d45791d5db7ea5118bb9dabf74310d3b
-
Filesize
1.1MB
MD51f3cd01138f76d24af9fce33bf87eae8
SHA187195eaebb232a886c2e9719cb8f9edcaca42c44
SHA256c6ccc5cc68d4c12e412cbc1a5f1e00b5b9134cf57edeb8ec8a8266ae5cbadd50
SHA51274f235c7b23781c81095d3f761cf6f59415fcf8b1296fdfa827a7eaa1755f7855c60d0b14ac09638acff90c84a7455fbe40a9309d996b0f5baa7edb890066d03
-
Filesize
1.5MB
MD508d059b141217365084b5ba5b8be6996
SHA163865dc68ecb092f06d4d5f48c5bee576a5f607f
SHA256a695d5235605e8dc7c0f238d97749106b2178a7cc0a2bf023ead60d61a68dd72
SHA512ba315d9292c9bb0bc216f938453860ffebdd22e5ee02bbcf23834624a083671c970cd94dea3ffd30d152a980f73bbd6b79e9f36df6f7c4a03e1c9e1d6f061b5f
-
Filesize
1.2MB
MD5c16b1f1356036892971b1a9815a069fe
SHA18b7e26ba49ac6102f14670c51854e90fc5710ba1
SHA256da192a85061b6e83d553f627c6a8aae2acc74cfe564abce03135e185e5d6b26b
SHA512ef4b258666b7a7d1eae048e60fbe1c151d94a3db66b90a3fb5255abc0d37fe82de9145c4c908472cc833d5ea10ec7ee05b3872211ba3b925c5f4f3f2ad2f18cd
-
Filesize
582KB
MD5c90861f121d6b3555da8557f47bdffe2
SHA1a1f643ec16843a80dfb35c06dba3f92a630df365
SHA256ab61490df58298ef79e2e361997141a07231e98de6d4fb8e992f4abc02b21a05
SHA512949f812037873d739f6c4f8865c315c30ae15f6131ee5fafea31ad950a0639f968f8bc1d0be1a724287e1d1d385ac646b4e33304715e98a5a5a6a3ed0acba7d0
-
Filesize
840KB
MD5a75b8c777639ec7f4c475929652ba6d9
SHA1706e6f5693c72e9b92ded46a08cb1c688fa4d92b
SHA2569660ccbdf3fc8241ec2494a5bc864498d8b90c2c82a0eb9eec55cc80c565661f
SHA512499244bd071bc38d8e3a35a057e3bdde3ee85e6b7415c198011120f461e88e09374172f4b3c124e77f6e51c8b524426776527c109bb981d3a7fdc47ccebdd276
-
Filesize
4.6MB
MD55b0813590ef3ad394e7aee41b87b7df3
SHA10e4d601152dc66f02f400e6cea40157a89ba9ce0
SHA2560f47a7ef74053b5a4b454e02bb027d2e8e8f7ef9f6aff00657bcaabbdb3262a3
SHA51279670f2b0574594728ffd700da805e517e1f3dae23321948a88810f6787e76a751b017b8352ee3912c8a2ff59f0eb632e9d876c36989e9a17a94cedb82047331
-
Filesize
910KB
MD57026fb363cea803f1e6eb3702b33c9bb
SHA17a5187be990653dd3bb624a65f497e80c6877cd0
SHA25688f820983812b7d8432f0db9d409006477f6f363d513d0b1319e4957103ab549
SHA5125f4907042628ee9221c54c959e2fc4070bd19c92b5e83f36321a03b4b5cdd39cd03549e135cb907d1f66950e41fb9e068f3bcabcf62853af27878020e592d289
-
Filesize
24.0MB
MD540a6b6c2e01c60a41f635c991e4adf5c
SHA1d9103dbddd1cc98c38f3e1c0a469cd76828f58d2
SHA2564bf318dba2e23f378451b1fbd919a063165785488730d60692eca283db5efaa4
SHA512d3bb21dd1ebeac8652f6ebbbf65be673943982934d4da30caa0a6d69884a6780ccbb17b69710f847cfbaa292a584e5ef0ca86056f37bf1205264a195d98d71dd
-
Filesize
2.7MB
MD5adab68a9fdf01a5b46360c9bd4319489
SHA1e653d88ed1ca56406ab88a486071e50b383b6bb4
SHA256293d4fecfc214c361bd796de20bd2ecc3701c02c773b90a54e58491d281a9c2a
SHA512364c8ddd6aefd69a8041ea3f6d018293063b59d538e11f1a48c9feae1947ded5158edb4b39888878df9b8a06b522e5a139ed012ba1eafa3a411c4eec3ce4a061
-
Filesize
1.1MB
MD50d99118a40912d434f5a20b87eac6e53
SHA19bbadb6b4499aae32c83bd1b0461fab51037af1c
SHA2562a56f681c0ef4d100f56f6f25fb9a0e281f61de6321d7499865c25b9d574e825
SHA512db1c3754bdb8df359fccf520ec7bee2f53f9f52d216647f52aed09791ecf806ee2e1c5d97f20983acee071fa1900ee4e16eaa510f77b2bfcea9d61d41d6f4cca
-
Filesize
805KB
MD5f75e92a27f42bd7516319a115d6395bf
SHA165ed461e17adacd42b6ebe9fa5cd57a4bd7dea0a
SHA2562d9360b8affbb8ca0e15915da9f5d16a20fc9531bcc6a6fc24437777d5a5d74a
SHA512efab472c544fa66946363335a44da912d830378253ab55e1f6948f7cdef8a3e6872529e51e78c76e103f1e6f1eda54191cf9ebfb7f00a941d57b2e63f22a408c
-
Filesize
656KB
MD5188755cc408cb994705a4b442a5da345
SHA14710cad3dee05116d60b9ca3b426466ff503ce3e
SHA256c3ea2b58ac4125aa04c246b81e2c0ae1dff18da681729186d4e31b3025cddbf3
SHA512d6efbc403f5bd1eeed6dd5bf37c0229d9693c465654346ab48dcc0b2f3b35f7d7bb7b50c88d74e55566316429a232f0b949d90158582cdba7730b6b47bc6f330
-
Filesize
5.4MB
MD511b0ca9d23c7761899a90b3ed988e87e
SHA16f3081a612da2cd81d844c03f202daa7a3aaec4a
SHA256bf87e56d7a7f5f212100575f221d2ee37491a8f42fd48d5960cdf0a8f9d8b8ad
SHA51261552ee1049951df9a369a8c2dc839befc3c12936da46345302686c950a535bd07de64d10c04e6799ba126c4d8ef0e41515302b492ece387852b0e05885f34ca
-
Filesize
5.4MB
MD5afff1b91b80ecdd61bc55004bedd0f6a
SHA10d470c894e8b525a5c5558128985c4f7121433b5
SHA2565ab049a0aaa1e9f7863916499b59466b7e2a78ba3c10b61ef3cc4ff45ea087fd
SHA5124494efa0b5a806960db2dc3028e9ec29b47fcbdbb794447fb9fd0bf6a5e7adde48ccd07ac890113efb0dd4366e2691927eb7cf167c31098028249e77043c92a1
-
Filesize
2.0MB
MD524723d173236d8c19a92377ac9fae6c8
SHA15147da36c009cdbff5424d4f99d04544b3867c38
SHA256d6b367dbedcc8991f387e1086d839a7b86699e03932a7a2cef2ea8b604cce9a7
SHA51271046fa849983f70325f9ea54ed625ced12523ffbdeddd09e2fe884936ac7446d9388b81fcc6659e1e98e1eb198fb48253d12e8c3da145ef0eaacf015078695b
-
Filesize
2.2MB
MD5085e0bbdee74f21f2988c2b1850cd71b
SHA1c5bf056ced49f29c6ce2c56e11a7fdb038ecbd3f
SHA256c6e64f4d120e3679b7ca002a77bd918bb7fed4fd7043d357b2c04f716d0d6d96
SHA5129607ab52256cee6d8d2ddda83fc8279dcf4f96cf3042fd12da7e9d271915943c368adc0486ce7093b9f287c97b449f0979ba16d969b4420cfa5e6a97fd316e1a
-
Filesize
1.8MB
MD5787acb4774eb9d1a2050b6913dd61aad
SHA1294e606397ae1304c23c647e3b4df290bb85ea3c
SHA25697c07e80ab36dee36faab28412245d4526c3512fd9cb0b45255c3d5ca2060141
SHA5126040b01a668a262c63a068270301506806b4e373933025878c22f898f9f8e08fcf247106e09fc291bb28bcb514ddb056942eb34d799d0bfef5e7b319672fc8d4
-
Filesize
1.7MB
MD54dfcb9aed55bdbc9b44ed91738663949
SHA19f22b196e34159d2c54f91be49139792195ca567
SHA25645f426f84d314216788ded359a529b603ebfe39b62aeb4b2ffd24d26589a31f3
SHA512b20286a84a36389db8a7a39b0d8903cb7d914ce133f86c0aa4bccc6a62c5983417f097e7528e28137b51c0d272121f64d026539ae16be91d15639e1197858dd7
-
Filesize
581KB
MD5ac9eafa9b73776fa7c0074431383d8cd
SHA168c8a18cd228c7dd29b4c6d7ccc2d59a2bdb73be
SHA25663989c06627539b0bbc708cb95aead9e6ba6cedf1d0c0a1f07e9c4b83a12efdb
SHA5123d63aefbb5abf8ce4a5ca65040914658731e6966921326eb750c2717f9e360e131b6a22ba4b2180a3a9303dd2b0edd0c78291b56999f69a890c188c98494b775
-
Filesize
581KB
MD50055561e46d48febdadaeb9fa5740999
SHA1467c7c6ca2b25cd390c5918874420075aa29e822
SHA256b43da45817d4a514fd8fbaa283facf2347973bb8a2deee792d6cdb0367178c28
SHA512305cbc42b5635bcf0e176a7205d9389a7e0d87215dfb05bd7566aa2cd58d603b0cea9b5296ef5321843239a380eebc289ed14bf43826ba50678cab69d024cabb
-
Filesize
581KB
MD5bf069c248301a66aace21cafdecc0f1e
SHA1497fe8fb3779527c263da91ed56250f8b61ee8ad
SHA2561a3bc0f6e9afd4c7b65c20a5a62d70d81d74a0b2b37420f38b8cbaa0b87a9ec9
SHA5129a63f6cf64430b961caae1173d21867d693a92ec957682835768d7ac52a4d04ae65ace45718a7fae836813262341be84fb36c199a8a88ea10d5075b1aa32d3a9
-
Filesize
601KB
MD5d033dfd3c045b52c5a8c10b137b7cbc0
SHA13f66f9b59ed242e35c9a9e2dcbae6bd40e0ff08b
SHA256cf043e3b45bca73aed15c10e7a64519f31885eff0edd4c6a2555c3d1ed622ef0
SHA512706f17f8e4407e1b032cce468baaaf94be4f8cbbc4539a6561f112ae0969deb206b44eec5d52d5bec823f3c52ef7144ae72f25d22c922cc5fca306aec7cf79c1
-
Filesize
581KB
MD5d4c9a6a753ac507a26ceaf2ae18c1272
SHA1e2f6d3b2b1137f2390652d82af51d25590c82691
SHA256ba002d92462587fc91f8a1d07aea7b3d6de964b515a5bb275ee380a5d47935fc
SHA512066a0ae65ba8f095cd1d379bc9b911e500d03fdc1a668fbff3df4d9b880cdc776b8dd438223b43fe9e3f3b8501b3fab978a26d0d0bafa44b5cb9a3c4b7da642a
-
Filesize
581KB
MD52fd6f484be4372081353425eabe350e7
SHA1b5690e37656a400770c6559fc48ee2d853733dba
SHA256886552cf21cb5d1fd24e016ac9b6d38a8486053c56b213dbdc7ba7043cb29c95
SHA512cb8d00e78e5200f21bfaccb521ceeb5255106fed0260173153e0520450ce7c78bc5c8474e32e983fd18659ce189204d0b5cd64e9d2a876851d68959661a32cc9
-
Filesize
581KB
MD5f56532a887af6763c45b2f2a8b004e51
SHA1b47cf8d7cf416f9249e3294c2db0f34d7addc881
SHA25680ada1060967b487561cda7ae46d7eaab50391acc7db35c9f402219e916dd119
SHA5127992c773d36b136961ce7fbee15f8852c71bdf77fdb04bce1b2143eadfef1990308c1bc4ecf832fa0edb6552f3f2be7fb2868c8565d9a030c5806e26a693f0d6
-
Filesize
841KB
MD52d94cb055937a8a91c341c5bdd69bcad
SHA1a73d6b99dc5bcdff11e76a4d710d9821545b0116
SHA2565b28f528f02e8dcc632d73940eedf8cc1ea3344347b55c3d3d982d2b607861fc
SHA512034d2d503039641e6fb000d6a068be2959a3dc23416cefcf0363eeadc4eca3c48aef67feb2818bb0db55405f4b017303d8200afba32a03a57427fdf5ecd86867
-
Filesize
581KB
MD561cd9e7c767b52ef4d26d2b697369486
SHA141e588f4326e23ee2c42074fb0bb660e5bc1f511
SHA2560f7beb1535f2c22b824a2f2b9748b6cd07e50f02c1f60108d5f90c33db8f95f8
SHA512ab358f5e2035fdffacb219bafb9e5e132581b3749eb9cb1a1b2b691ec282fcd24204074168d4e362231d2a5f1154307f7337d2ca524362ce36d812403c47dbee
-
Filesize
581KB
MD50057d39700e25ef3b2427cab5dc4fbe7
SHA1ef80ee8ff799725eeb1c5390f23a049da3807ec7
SHA256ea95674a28a133cf92309357dfe93ec9acc3e007b5491d8da1d680f0303d9b50
SHA512c044516b21e11a29a0032b60c084a8d2c26e6e397122691035514169d0dc651b09941737c6c1d68799aa4b14dc4eb327608b301b0d082b6155375b560880e597
-
Filesize
717KB
MD5345aa8b9a9ee9b3af10d58b93ace59ce
SHA1ec6a80e96b6ddab56a626d3be2bde38becb1157a
SHA2566bace97422cf15b6600c7ea558871a95506555a708b028ad2fab63b7d3915cba
SHA512b1b2ea984ab9231d0f3dad3787ed43a535f2e506720e2cab8ce37ea85277637dba7a521aa03d708f3fa415bbe484d38478cc35a546ad7c3a61bd1711a20d6003
-
Filesize
581KB
MD5a4898cd29def610a709347627f3ffb09
SHA148d1d217d5c8a11c58445c4f3badd6aae24f715f
SHA2562a0a936e0399fd5e2b869d55c2b2e3b010fddc2477c1d53242782826b986ccdd
SHA5125bfa2a807c213103e3193271a1d22fab89b68f779dc5b533c89ad282f86d0cafac1361f9869660054a1c9801ec5326b4626de9cace9f861e2f6fe7ed44f6cb33
-
Filesize
581KB
MD54250585c43d28853fa4d43f162141464
SHA11fda532df90b0cbd8583379d9e4a8ed7503f5865
SHA2567f3fb6d3f2578ec1518236485a2d76ac0942755e8e5666d6819bf4449ffce894
SHA5126fa19997a25a390d5abdbc6965b39d7bc0c39e3637aed9a8575e6785066d02650f1faacc1a19f768fa1f229c72f637b752a9e0bdf01470138047cce8351c155f
-
Filesize
717KB
MD53d5e7f0c563330db1923a41672327979
SHA11e9c50c8dc328da7f7af87252275e55368b284b7
SHA256aaf14369365a6e8f7905fce1c23d6615caa9c0faefddf92e3bd5ee3597997fef
SHA512825dc04d6757fd58969712e7be68d9aaf2e2c8d62df4d08c08ed9c92f7a78b3f44ea6d7e0f05533af6a4bf6259b0c0e5a26e4274321cf5aa8d33e46b76544332
-
Filesize
841KB
MD568003162a33d9dfb664f166f0e1c488e
SHA14ebf8fb56e889c64903750f5998fed1ac77d8b19
SHA25682f9d38e8baea242a52803e048f5d039840e886c4078181a91f36c62f912582b
SHA51298e77b6858cdd5f3923ed46ed73c24e990b2787279da071a56b33acd3f92a600ff8533db886e1f0510ff6d36b4d8efb118063cf7245ca3a4c5b6f98d36727d6f
-
Filesize
1020KB
MD54c890353a6b128920f85c3ad9f8536d1
SHA16973c9b99a90dbe64764bdf6448e66733105fa4b
SHA25616d237b4d2c10c308ac48e35463a6aea0d793180a9e703161ea1c03ac32cd2da
SHA512432a046f64a4b9d74f0eeaa4e447e5e022afb76ffbe73525d90eb5611daf3c731babc721b73e1f5905abf76e00d411aa8db1484da39961daa144d53c9965b4fc
-
Filesize
581KB
MD583e67ac9b5550097921a66911f23f779
SHA144c0f48a55760de1d6e22a4cd8933274399686c4
SHA256bf3340454e450ba5d894c41260bf9507e11a2a7b576029d99f0d05ed21b20779
SHA512c234ca42f5e843a716ece194c51b10c4411c50d631678c60702eb711433ecbd8bcacaf7bce65e1737a5544aa3847c32724cd80f4151e7409c8873139bbe646bc
-
Filesize
581KB
MD59ac93d97e0296d00fb42dd0fe521d548
SHA16091a0ca4969dd7aff29692ea411a9f688b25690
SHA256d3174009c2b2aaa4fc13497387cbe2d72e94ba859a9065aa1492714c55a29782
SHA512b958cc344a69de15daa1b01479d4800995b5245d351a7a27245faf2908c947255807f442102b7d77ec59c2741de952cdbdad2424c6152b15a5f317771db5ef5b
-
Filesize
581KB
MD57ab03c35cdf155ef047bff79518b8567
SHA1537887225afda8f39302ed92145bed46576b9ef7
SHA25688db5dbc4a529ad2138d191c5934c21bf2865cdb35b9d782547b6ed5d516fe7d
SHA512c5d540f52c9013e0824d04cf6f639295d53e0645399512a82810790f4b0fad0d768a0a66b19d4be4700feb31e1226c559903029ddb5e0044c633ca9334e7ab1d
-
Filesize
581KB
MD578ca17d4b27c018f84209022bc876939
SHA15a9b1850dc757df2b566f53528855e49fc7c9de1
SHA2569bc1e1612136cd4e52ce743ef30ab1b283bbbdde9e16aeac2e94cfc458f572a3
SHA512c711b6bf2a3ae760fdd5a4dbdee18d0defa898154597a52669c7fc12cf3328d3c798cd73abb37acc6169ea5dd5385f6636213bea2de8ca291eac7362abe7d6ba
-
Filesize
581KB
MD5c91376ca4803a4b8094650f0e71953ca
SHA1a70e07824a48c1c6b77b93bb2343dec7c90637d8
SHA2568aab3ec5bba064d96b287d0c400cad15eeccde31dca240e4839f2bb0ceb09b48
SHA512840ec62b2ed5be35e81c070763b4a8ee61df7f8df3ed2e2c28bf7df202a9f0d0fed02f18578d6a0dcb1d5074f4b9291ada79467d750080b28b7bff4175f2da56
-
Filesize
581KB
MD5cdf89aa805e6a8daf8c89c16865da25f
SHA1a5aa432b1298887b7469a3f88a8ba52fa98dca69
SHA256c5fb7b3dd53abea8c9f08b20f4c527f3f3566def5ae61f3ae80ccdd15ee4fcba
SHA5129ba7b909126fb53fa6acb0fbf023897be202ff1ca4cebea1c8b929a89ff02289a7e4e21f8377c623f929d1fbd66821b569fb502f4457626e27ed8131edba4481
-
Filesize
581KB
MD5a5a6f010fef2d41fbdcb1f999772e92d
SHA1d2c902244f75c0d7d2270e820dfd98c6ce336362
SHA2563f4cedd01934551e36ea8a756696f9638c9df37a051b004856330762a6f99f90
SHA512fe993dd3291ba1c8a0a1319a01477504ee85bb882ab74dbc55cf8fb649d669f4299e91ec30a52c07fb537774fcc1fc1df2bf17d0b03c24808c1bb4a2e140a4fb
-
Filesize
581KB
MD50814c51eba3cd807be089ebfbabab792
SHA110465852ad07e4504e917aa3d3592a6fbddc3dd7
SHA2566e63b592133b6d74105eb7a5f327c1e74b5244cd40d25244f2a26ea9f808b86a
SHA512207f7ea53b6f22b3f462aa3da41a33e18d6c31ccf93b97fbc153f1ffd3837e8ac57944ddb767f7b82cb4352cb4167e2dc2551c62f34059b06df8433157b081ed
-
Filesize
581KB
MD5fc3e71ad8c12d728c9a8fba2a10d0ce4
SHA1a1498e27b285b0f868cfce09f4471ea0ec2d0ca6
SHA256e33c93bdba26c15144383a5f523cd265b3c0153ebc233a31cb05680eab1ff4ea
SHA51256112eab7e4f8bb4b1cd1711accdb78579d19849d1ef0312d15ed45ecaab95f18a26abfba4b97015bc4b52e1c0badb665197f63b0b0fbaa56b707f06f9ae3f1f
-
Filesize
581KB
MD577bf14bd52a2ce60bb7442fa4dbedf4b
SHA1f7bc81df13c1ec01f2f012e71a1ca3829ba18221
SHA256a8b95aac6fc2b17cd89ee8fc160216c8f96f2434f4104261c5cb951341a6346a
SHA512a300415ad73fe2d30a7400fe5730a5f9ec78bdd56078778687f71e5a550dc6111ad2c379d7ebb865a55fb392b2193925c6f84cc24e1ea87a38978d9c2cc17104
-
Filesize
581KB
MD561e38bbf93dde74267a5dcbbb0a0f32f
SHA19c59d9eaf53a939acea275b0b765630922aa53fa
SHA256cc84278217675dad36292fef4afef40eeb810128eaed7f8a5088b5d5131907d7
SHA5125a688544a46797725308c193720dfccff4ba5c1997a15df8963f5b63b4998a59ec98519d857ba156869dda843e937ec58ca82acbed79a9943a7b06854887a733
-
Filesize
581KB
MD5aed2e56793b305a55a80d7eca115e615
SHA110b13e5542618c2c25b8b249c0cc7bc6129835ad
SHA256581e769778c9835793eba4286eb01587967851e1c2c09a2c462cf7cff79b5013
SHA512574d152dee6920acd7e73d7513367f9845180ff7745edc057033c9b01173c4ee7eb0b8f01eb32b874b791b4b75b3c7ab5319376f1df67150903ecee7f33d6de5
-
Filesize
581KB
MD5240763005e4c81125490dbabe4c6d242
SHA1ab3b9a93d151b5d2c5d9af68769d56ecc51f96d2
SHA25664006b3951024bc5af38c67a02ac62413dc559c132e7619312578b7d09690ddb
SHA512df5a19b335d0bb6e83cf39fab68d006a0b22591fc61380a92ad24d704a310adb53c145b437eaa43b1793d5d79fa5b10accd93a2a350a3e12d9d1465ba220e194
-
Filesize
581KB
MD5dc1a38a2cfff895b8102ba14228b3eca
SHA1ba23ee1d67b9a9d08e0fda2239a62e1767a8b592
SHA2562e196fa9d1dfbcb450a1df20a6577bdaaeca78e51b6ea766f37cbfa5b3be326a
SHA512054c66ad4d5bd2c16fdf9442b67900e4374462e4a032c90d84b40ce5f9daf2749e76f927ec89f59062c72b4c89eabc3a2e1c8efe3d96cd0ddeb3f932716c2742
-
Filesize
581KB
MD59b5b6d2260046f9e520f6d452b994aab
SHA1c03b221a4f0c23fa8f700ddb22ed789eb26394ca
SHA256bdd71f0122e010de8b172823fdbe999c7dbbd65445b912d5a4362bfd50c1c19d
SHA51231a199889eb9722e621517413e903c3a26f52f747179f3b7721137e9d9eb78b174dd070268edc7ec48bd966bb46eec6da2a176e231d8d85ea89c42804ac7adab
-
Filesize
581KB
MD5fa33c4a49488f5860a1c759600c49187
SHA1c845916d49d048b9329c26c52250841d6e65f1c6
SHA256ef6a420048f8e215013de4556716d32d2202f91bec04bbf505276de272bbefe3
SHA5124b8e024406f90879085a99f964f01f06a5bb2472b99a914deff1d6b45522df267dab17bdc7618295f6510ba2ae2b38cabced146d8c89e8cc1779ec2a4fa92739
-
Filesize
581KB
MD5ba4b6a5b9680982a34914ea2cf8dfab7
SHA1601e0fde91ec4b368f2a7c68acb0e51f586c891f
SHA2561e693a6e4181f7a893a1d7a6fb3faad0106d69b40a7b1426f4709576108d2d0a
SHA51255199e553e9c8fb8bbfc0690b2904ae5b54f36a9a6a5c90e9b3d90f4f57108d8fbb404f41b033b1245e191cfafec73311e7deb6ca075328b9bf60afe62788535
-
Filesize
581KB
MD5c7cb1eb161f2059013cfd982fd9e1ae1
SHA18194e48fc638f659eac1b6ede362d97b81a076da
SHA256f58b870a37ca0410e2a38b5d12ba5b3d0f5bfaa960a58eb8036b3d92e85b549d
SHA5122501de202e442f503952e95c0eb685004c990414a497fb638dd00f5168858b5a2ec8dc3ce9e8ecfa5f6682113c6ae74cc63538f3d39c552c739172c721378cba
-
Filesize
581KB
MD5d7fc0184205daf0210a114393bebf2c5
SHA1d4730156f3a3893150a48efb504f7a20ebcbc984
SHA256d217aed8b39ba9d55d1261b84a419a374e5c2f9a886c8638c43d42b13eeb872a
SHA5122d1c88c04a6badac5dde6dc1d1804dded6f50cb63cebf0b57d9bae32b727779c5ba8ed6191bc3115ab067e5e813f70ce549ede3d61dcdfd50ede3d004ef9a876
-
Filesize
581KB
MD54fa32aa0e8e2ae893710852fc8714fac
SHA16b18c352a7776eb74873d4ddf53c66a97d35aece
SHA256f458b84a8b44c453a7604b7ba2822ea8f121e7fad00e4e183f9c37dbf1e7f9bc
SHA512ff3f56f52a30ccb7f18c9150e6694a775488a5cab8a03a2362097e91c6e11945ba23c45d6f8caa0ccd187604e3557df0575fa554f82a3f2c4200c8550a1a9592
-
Filesize
581KB
MD55458605875b770675d31a873d3a15244
SHA113b19f8b6d22f3623e8606fb039a732983da61a9
SHA256976170a4589bade0b7d3f3e77a3adcc5c8533647d6f6502ccdad0da2a953595f
SHA512380aa8db7dd848599e0e388171a9ad1be4d881eeb296736841f1cbf1698ff90251ef41ac49c8af09b280419a99aecea670c2b7b8234c8a08b94e4f8ab3deb421
-
Filesize
581KB
MD5e66b54c964dbdf7fe645a1f6a088e395
SHA115af2acfac76f7884e29fb613dbfe16b8c9fc8d1
SHA2564f5a9b1eeec2bfc5673a1580578d10412e3279acd11099db4ff1e64ea2d29642
SHA51241c2ee37edc6b01c9425342308feb80ad03ed4520eabca5d8d1e575674cb0335fa881f9ff4cce93948ed1cc8296f857a2509eaa95e29ffbbf3bf0f258f9b481f
-
Filesize
581KB
MD5269def159b47d6839e82bc4d77f6b79e
SHA1521023319dad08d34f0ba9df52cf9c96a25bcd47
SHA256411d20aa4aa42f34d3e11c3e2c5aac8a24484597fb663ae91da10ff89ae7cca0
SHA51235e10279b9cde75c0956309f2d2e6bf3752e8d59e016332e2aad9bcf5ccaec8ec1fd21d3288e3f2dabd2c55bd883d2decfc7eb7dd6218c97c9cdb2ea998aaec9
-
Filesize
701KB
MD524bfefee6a80563c283ea9de72410905
SHA1e3b945ba779d1f58fc7b014ac10501bcfb2b84e0
SHA2562e25f5fe1018fdc241030ea1c095bccbe02e558d93217db8e41301e14f525b6d
SHA512d0c599d555f2531584b122d76876d634535df6abfe569486728976820b04fa4a717e44fc0d5d58f968e25aacf721acadb31e89c7dc53cb2d837a5cbc13123d40
-
Filesize
659KB
MD54ab33baabc734f14614da0cc70db4c81
SHA1d6db34045882aa106adb54ba4e2ef6933c3069ea
SHA2562f4d32fadd01d79435446975c07f4c08575a5968b3fdb1b5d20e4045bb41cfdd
SHA512a31f4e8982ed1febbb576cffbb0e544650b223ee05c0dd809da5ed478e2deb947b1ebf4be739af5946c39505ad329c01f290bb6da6a610e31c9d6f8042102118
-
Filesize
661KB
MD5ce1d31f1b756ec75ee33219faaf01275
SHA17b25a15b5902e4bf1309ef0f7dcb7cfaa45436bf
SHA256316f3529b350e2dce203df831cbd11a55ca89c70f7e7a182c361961f82dcf346
SHA51247d76ab622cf930aea08ab3c77875df64484de0e4933e23e0bca605f31e08f200164963b28daee94522eeda193dee278f1c725016d057a83d0185e13b73e22da
-
Filesize
1.3MB
MD5446f5357c784329e524e707701513fd6
SHA10ff72fe435e62ad48a4ffb7cfeef2566d729d8e6
SHA2565119c4affb81483e5df31f2a86770f935242831f191a9021971f15bd2a93ee22
SHA51282b19af7397582e69eaeef295c92cb0c03b46f84230cd66286e31ac754dd4f2b199b391f79fcc9220fd604d3b45eec7b7c4982718f71f456d5d14edc8db3512c