Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
03-06-2024 08:44
Static task
static1
General
-
Target
2024-06-03_3abd248a781722084d41e920e6030da5_ryuk.exe
-
Size
1.9MB
-
MD5
3abd248a781722084d41e920e6030da5
-
SHA1
3a9a85e6281e44d49707a4ba671bdaaba9d14a3e
-
SHA256
51e202b16fcdba0b624dbba6118b0e7c785e90c5aea0f50b45e6c37633d3c338
-
SHA512
22126194faab88ce5487ea22895d794d6b494d83492b3291108c0a56b7eec1b2b1b83522610d537127fb3851918508687e3102a241b8b600cca00ac2937f534c
-
SSDEEP
24576:A78r8FfC3F32nUnCdAaKu++nOfV49pFT0SLTQYWkK2u4dax8C:A/fQF37CGaP+s7YSLTQYWkK2/
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
Processes:
alg.exeDiagnosticsHub.StandardCollector.Service.exefxssvc.exeelevation_service.exeelevation_service.exemaintenanceservice.exeOSE.EXEpid process 2864 alg.exe 4904 DiagnosticsHub.StandardCollector.Service.exe 4684 fxssvc.exe 2020 elevation_service.exe 1184 elevation_service.exe 3996 maintenanceservice.exe 5036 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
Processes:
alg.exeDiagnosticsHub.StandardCollector.Service.exe2024-06-03_3abd248a781722084d41e920e6030da5_ryuk.exedescription ioc process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\bb43ca6ac3136770.bin alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-06-03_3abd248a781722084d41e920e6030da5_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-06-03_3abd248a781722084d41e920e6030da5_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-06-03_3abd248a781722084d41e920e6030da5_ryuk.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-06-03_3abd248a781722084d41e920e6030da5_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-06-03_3abd248a781722084d41e920e6030da5_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
Processes:
DiagnosticsHub.StandardCollector.Service.exealg.exedescription ioc process File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe alg.exe File opened for modification C:\Program Files\7-Zip\7zG.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104468\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104468\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Windows directory 3 IoCs
Processes:
2024-06-03_3abd248a781722084d41e920e6030da5_ryuk.exealg.exeDiagnosticsHub.StandardCollector.Service.exedescription ioc process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2024-06-03_3abd248a781722084d41e920e6030da5_ryuk.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe -
Modifies data under HKEY_USERS 5 IoCs
Processes:
fxssvc.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
DiagnosticsHub.StandardCollector.Service.exepid process 4904 DiagnosticsHub.StandardCollector.Service.exe 4904 DiagnosticsHub.StandardCollector.Service.exe 4904 DiagnosticsHub.StandardCollector.Service.exe 4904 DiagnosticsHub.StandardCollector.Service.exe 4904 DiagnosticsHub.StandardCollector.Service.exe 4904 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
Processes:
pid process 664 664 -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
2024-06-03_3abd248a781722084d41e920e6030da5_ryuk.exefxssvc.exealg.exeDiagnosticsHub.StandardCollector.Service.exedescription pid process Token: SeTakeOwnershipPrivilege 4560 2024-06-03_3abd248a781722084d41e920e6030da5_ryuk.exe Token: SeAuditPrivilege 4684 fxssvc.exe Token: SeDebugPrivilege 2864 alg.exe Token: SeDebugPrivilege 2864 alg.exe Token: SeDebugPrivilege 2864 alg.exe Token: SeDebugPrivilege 4904 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-03_3abd248a781722084d41e920e6030da5_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-03_3abd248a781722084d41e920e6030da5_ryuk.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4560
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2864
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4904
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:2232
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4684
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2020
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1184
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:3996
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:5036
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD530afcadc4338208af7333cd67df62753
SHA15445b1e5e5add83e8a09990806a073503df589df
SHA256c653bc3f1501c542aa0c8e8b8e1ddcc83e33e446f5beda8b00afde83d4b08393
SHA512ea4b6589096a72a640c434e2aa92596973f465ebad4b5d936a3bf42f62cdbb838f37194f31df07d977f563be33ea9d7d6b8457d62c17333e950c36aac1f9d787
-
Filesize
797KB
MD5b08623afd3441fda3bd649633fc02700
SHA199b32b21174649381eca5929983c24c890e24af0
SHA256c58d234ccea887eceb0ba5825c7f93a195d1ee75f0be190067c322000a435366
SHA5121ee802174de11ba6705cda89ff71f9e10ccdfa1bd47e0e56d59038fd788835f4c63cba86fd2ebf2a61822f40c659488c617682917643fb54cf7c373a5b16027c
-
Filesize
1.1MB
MD5089ab911b041580bb1d9ed865383c66c
SHA17c5fa29840e048863fda2860ab8ce9e8c6d50020
SHA256e5f2ade71b96bdc24eed177a008c90cd6b60a86aeb60a1ec606673638dd829b3
SHA5121f383f015096f9806143223236a6ed33733a386be3ca091248682ba9c59707537d6b2b36e875a8fbacf999e3cfaf76d704f152474511314c273c89c6725b54a6
-
Filesize
1.5MB
MD59c082ecdf146e96bc7cbc208ef179612
SHA1aca8b7e51348f5fc4b0c46cd1639b85ff893cc92
SHA256b22ed2df90494b5ba46e775800bb681ce504a685966114edc74e36ba1ebc08cb
SHA512005f06c5d5c91d0633739763cefd21a8b4d2967f67c61623dd887f8160878d4b342ae4e98e124ab3befa65d5dee935b15bd425b9b2b2e9c253f88e866e246c0b
-
Filesize
1.2MB
MD5eaa944f2b1c0ceb52d85bf1a39ca044e
SHA1a6302a7c5ac68a6ef2902716ab014ba491f24770
SHA2567839b9002df041e14095db9b4d6287e3a9b5426b0441093785fec3cb9a76c0ee
SHA5120496ac36bd6475e88cb2a6384c184b4aea37f9bff22a0a3384e9c384a094512b5a106717cb61247a1255f9a48b810aeb33048c74206fa8040eee460915364350
-
Filesize
582KB
MD50bc25118df5f914e5b013cd6b277ec37
SHA1b3a55235b56aa0c6a3c0de91995897b24e8aa7d2
SHA2562c4bb67d6b7849ef3c94dee857faba96dd55bfa22c35ce3e3446a24a8dad1c49
SHA512048b2b3b03876145b144c2a078f03dfa3b5594257d33ca138cffd8d339e74aac7d16948f5ae0ae69deeea3bf873da9ca17b9d68f817c0edf266fe535c55be0fb
-
Filesize
840KB
MD57e7b9f707d34cdd27a52fc03d1e4c615
SHA1c9255114373adcfb47b2c215eb11668debb8d1ce
SHA256f9fd26b2a604dddf7e63b2211d942506fd5dc47734d4312381f9211d08cf4435
SHA512142fe986f994f082df2bcad6b52db68fca7edc7d541679fd5ed061dbcc1322f990eee0f235bcb4970c470d3888f00b7dc89c02bba042eaa58f684530a4a350a9
-
Filesize
4.6MB
MD59b2a607751924fcb865b3a8a37d3e26c
SHA1f36c40d6e8a940118ed78cfc90c97d3d9591c38f
SHA25607ae427717678213fed791d61c2568ba1e4410541423395e632cc2648ba1ea3d
SHA5129c2f8c1d94cae78abd760cb029a115d137fe2b69123ebca21c98f07d7a3d2e00bee2b3f2499b3b7f4a2b632352cd8913567686ce1e98a95388b69751b59f056c
-
Filesize
910KB
MD5ba19ff829fe2bf18a182936e8cc1725f
SHA14392010a03d0b3549ee0bbc50aed330b388184f5
SHA2568c9b16019a0ac78f26925bd13e55ea0444b87e6d10b0241e34ff33aed87bc77a
SHA512a79a8576a8ff16c2ef0ef2f62cf5c7c69a3f0be83db713631ce4834806dee730be8bf94215636ebaed845b64670672ed03090ddb4cae7cc618958f9c24e30d3e
-
Filesize
24.0MB
MD59c15dfcceae298d246354263ba608915
SHA125b7be276ca66a1438a871052ad80b904112b4f2
SHA256b42dd61b44d1c4eddfb3bac7ef9bc0639de1aab317c314dc8aec4e3d2b28190d
SHA512870180b61c37ffe9fe9a468486bff3c63eb439b70fab53946c9dec2441c499201c65f5743b5de58cae179eaadecb13901c86523c96cf1d371c28359a9b27e986
-
Filesize
2.7MB
MD5060ce5445f9bf51eb4795ce1972841d5
SHA13fe0f004426ad50c2126fb891ea1e9de3582f43f
SHA256e3f35994e7e96f3a20e0ed4eb089aabc14a9e577ab9412cd0a489ae7ba5a6f62
SHA512cee96cd5ed4a684292fed62ae498e4944a0a7aa743178c2e49b9cc1edde028798486bfcb305bf62678708da446b117344b3f892e98eaee94ec7da47671d6632c
-
Filesize
1.1MB
MD561fe637c8dd7fa3787ed51426bf3cc4a
SHA198ab2f57bb34232abe945107f6f835505b9dc45a
SHA256e72a7c09eaa17a06f8f718ab6f30a41d8aa6dbb750a3ba665edfb685a47fb1c2
SHA512d6add966bcefb202057763e74264fb654e231356828ffe9a07736549945a5d1f2778b7147e49cc001ba53496b6e92491de28f9718f5ce5b311d019a138805bb3
-
Filesize
805KB
MD56d648fcdee0adb76e6dc3c81e872a316
SHA13eabfc004bfc0210037005751bca8d173435c471
SHA25613319ebbe808b49209866e1edc613cc993b0c1246ef0281c3544c726c2805316
SHA512502cc9f7ac804e9d285df7b64b0c78fc92e061d2cafec51dda94f872dcbde22af12bb151af3bfd2808522128c193c2477a89b09878995cb0e8b6e1066b828abe
-
Filesize
656KB
MD5e2f489cfea9b3e2ae399fd679890c034
SHA1e29d3b420190f59be2dafea01b4d8b021ba1ec39
SHA256c87a35497c36e1ff64135b959ea93accff7326b5b67180abc6893ed1258b2804
SHA512ddbe987aed243464ea1df8031d27af28ac8842e0891778bb7681c840cf1a6d30bc53f9bcf7062f30a472957e40ecc48e968ef19d1f8c8845df85cc3b756b8857
-
Filesize
5.4MB
MD54b7e1ea5ad216d50fc8279d9774c0145
SHA1c26ca92378aceb7beac6b7f716929d4a554b5922
SHA256c23cdc8187976c340044836deeed8e6e61aa70639e07402f0ab8d46aab9fbe91
SHA5121835e3945ff9b429d8d9183616997ac7260a8fd7a97ce436c8cda8e694d1c2bf4d5d32736ea48c10f0c09ec9bf854ab3813c3dc9415ce8b707e27ae1af447592
-
Filesize
5.4MB
MD5cf76299fabe26cbaebbd611cb90854c6
SHA1b9c45a44e21700fd2ca64238cc8b27c2988065a1
SHA2563ccda16c5197c8510765e80e0b94a81d573e2b156947d03314e194f71b393f67
SHA512ea5c8d7cc981be4f73b555cd93a08826904becfb8ce37eaf939e5f86da021d4bb06b3ca4575509a083130052531bc46d09f429fc6410ae7d2cfdce695af56938
-
Filesize
2.0MB
MD57f7452ff4c15c14dceecd422c2f71fc2
SHA1340cbe4ab510bc6c1fca4330c2c55f4ff05d94f2
SHA256d9d7ba0ad08b235fc94a329510177d6563bac587e617da42e8d4337f565a004e
SHA5120da996bf6fa21cc9596d4301e7fcecac5b6e8b6d06a82ccdffc9fbcc1d4c6daf4635dcf120bcb3fbacb7ba3b037e43fd1f01e1adcff2f0cb8ece0c0af3e223c0
-
Filesize
2.2MB
MD580c95f41ae8650713b79163ec50cd942
SHA1813a1770e00a2343411286c6e07c60a9eedf0a95
SHA2561ae7b3516649d5b54c32d900607c5ece8ac2fa75ee16b176e97878755664412d
SHA5128f6b7ae651468d6cb249e288b6c27c36ba9f753ed2cef47f20f59e4ad1bd66461d87a8b5920641f573f338cbcfc56335c41b18c6d9a3c7fa5718ea2e0bd16977
-
Filesize
1.8MB
MD5fe1d8d8294b81d67c37875884a4560a3
SHA116eb3f1b0c6c536f15286063c47e41ec3f562a4d
SHA2566ff38bd925d84a2a01a14e587beb3532dbffc80a12222d957005ade35c917450
SHA5125466a8bc01d63a387c5d8e6e78908720d91c4a6079a70db996eb2495197cee38737b5d05a1b37c90420372755ff7cacb4dbc2e278ffc03a3f1e5599e2ef95c03
-
Filesize
1.7MB
MD54af50998b6bc3aab3c11a8e6013b8282
SHA1fb707a56725191d49e387da09a92748449b05a16
SHA256579e09a76b915e72fcee068b6d45acf07f8a8797792e283f5d37437fc88b6d2a
SHA5121fc9eb39cb24dde37e9696fa5d2ea2d6a7065cbfd34e56464ae3e80aff8e31043edb3378d384830c28a952e3023076bf3e3142ba13cd9c531590e8e9832f6e7b
-
Filesize
581KB
MD5aafe0afd0a0fb82ccb848aa67d96d648
SHA13966014106e22d04515c23ec84bf9385be132c9e
SHA256d51c6beea4c739ab8a20d95bc48d852222cac5a941c555583ddb8425c5fb2232
SHA5122cc1f8e061657968c6b300ee0d904ba6a15923a7bc7d7bfde1c1652be0a5289fcf7d1e57bf693301218cfbd9d7ba9aef1f90eb0c3c8b3b2c50f72f46bd4b2a64
-
Filesize
581KB
MD5d1bebc41fe59152fd2e20b72e3dd9182
SHA1e1187178345256b1822f94af22daec4345c82c2d
SHA256033dc72c0fefd6e2247105d24893d901b92111cc3f2406dce6f035cf4d1e4ebb
SHA512c160c7039aab250d13ed46dbfd62230b2901a54d77e7d4e168789e97d530e7ec11009db6979fb82894308566cf2a92c033f7b34e9d08e1ff22e7e43fb9e3d220
-
Filesize
581KB
MD5f700fb1c0d831c861838cf28098a0beb
SHA1a16cd489c4025b678eb8cade972e017973a9129f
SHA256e5fb91fe057fa3ea0a8e6e61b59ff6b15d7b393766913734aa5b4011866f2197
SHA512ed3c98dbf07797f79b1ff0c855373c9a40df631f361e2a9d661bbaf35868112cc879a8ff5df7eadd1152ae50ab15c7048cde98f2d134a78e58ecc27ae74b37dc
-
Filesize
601KB
MD55fa028df6572e8826e3073165fc7bbde
SHA12a0d7f24959a3ee492390879b110863d8664d12d
SHA25600d56d3e625274155e0a93696f74f1bf753427a7519af0c51a68b3b461076c53
SHA512953c717ae315198ef3212bf3c8523ef6781d0569cad0c1052bd0f83f99fc372faeb570f99c4a43af1829962688efdba1c54031974c62f14b24b957857d3f35ee
-
Filesize
581KB
MD5ec9ffa594b30196d1683860a41bb5087
SHA1ec32218c57dc6e198bc392c8695250c08c72b2e8
SHA25672fb215b0a4d4b0a394fc2d6e86da95c15bc7618976c941db2e656464ce92f2f
SHA5125dcb584a68a7ca6486b5e1ef13df68ea4f05466dbf1da73144a8e5016f8667434b5545a62ea6fa6ce93449a8e7a7b1b32e9b6b39f9b6efd07c23241f31c81d53
-
Filesize
581KB
MD56a1a904f5e04d03e52ad9960334e2de6
SHA13931890b2d65eb6465750cd8acd11f1961d29b87
SHA2568b3be08d935db1011ee24f483b7ef2d998da3c0db71922b3af019a49987479dc
SHA512a9a1ffec1976c26b381586e860dacd6e518a1c99287ebff2eb58e8c68198a26431773781893c2390a54c1df9054f81377beec25bc46a871d803aef4ef8ab0241
-
Filesize
581KB
MD52ce25f4fd71e77033f5f486a7514d625
SHA134f054119d1a72efac957727eff1c33bcd47db3d
SHA25680ce18b073ae1c7a493f92ddd4ab2202493ea6cb7f3d72955854dc5234615d7c
SHA5125a909d1009d40e389f63d030ecd2b20dbfa762e09ed7393cf819d170f4644900997ca085f03a980d73e21d1768f5230a0c42d648625811793238d7193e84a609
-
Filesize
841KB
MD5390bf6e6c2671e154d4d028afc1b063c
SHA116c2a29cd003eeda9fe9838a272afc5067ee9bdf
SHA256165862a457d43bcb12a24f0244fa0af939a9953ef71b5b9e32da0b16692cf62e
SHA512a15b8900437640861fe3199411459257f3b0d36ad9c645a8fba1dc3aec25474156de575b2f72cc2697764806cfd0c8a41a55675d41865894510f5e16d6b5a654
-
Filesize
581KB
MD59014d174319a819c8e9780171b35e47f
SHA117d50b8bb1578bd1b0a58678a863d0ef56bac400
SHA256885c0cde688d6ab154dadc974417c8d00e3540a9a6b119d28f29393fb340ad70
SHA512942a2fbb1cc005ad8f3fc088cf6a80360b623a36e8b75e67c3a70bd59c4468cabca1e5535c5217732481de71dfa33f4310ee1efd41121a54483fb9d9bb44b185
-
Filesize
581KB
MD579ee9394dc1f4d5f48b6a59598703799
SHA13616dd23656d43986d7a7437c82381c927ef6a25
SHA2564e72c6276808d15e16d511be7bab42abfc0adf9430a96e9ab5b7ed3b39584ae7
SHA512d80d9a66314e8315d4c7bd95a3003b74ed432be4181bf5a97a373e8391d6004fb6bff1dbf4de7667327141ff729bdf701b4d0280190f1a70b1b85503c7948f20
-
Filesize
581KB
MD536e95a4f7e26ea5be015ca6da89eb388
SHA1afc15c54463abb78f6612b1c5368173c3aa36bcb
SHA2564ffae7f961b782f8abbcda20ab6f06ece594bd60548f33cbd3e2c519810fccf6
SHA512ef3940c573a39409af2de17874a49adf0ad8eee56b2a76408e39589f27f10815b8201e56d54a8965132e5790618c83489bc17fb3112e296935a30c0cd6df3fe5
-
Filesize
581KB
MD53d5031e4c797420a81ad2549b91f67a8
SHA11b81ee8d189c859d6cbfa0e6abc9eb24b783394f
SHA256dbc427cd4c703f670e989e875d2eca6be9898e0f3dd4cef17294dcf692ec1929
SHA512389bc0aa498410b05354ba7d8729b9b02abe5dcc623c3120562cf486ae1aef77edbc9762557b45bebfe905e39034e6ee84ef5475938e30840e683f77c6a10463
-
Filesize
717KB
MD5878f7ea9409173af05a09c8a46dae05c
SHA1e9a077f056c2fea9d0c91299b49cd4eab771b6ab
SHA25631d7ab6ce648eeba5e5eb0e7042b887555004b5afc6fe3aad07a394d31ec092d
SHA512671b17c67237ef6f1eb6439f9c5e170aa65fbca4c368673faca19834751cc5f390caabb1a583ae759dbd24c6d41146dac1c6dd5f3f93e51908c4559774aec83d
-
Filesize
841KB
MD5b73a25bf5d5b2d87e0620d080b01ef79
SHA123726671ff34dad1dbb2ff15b5a9b0ea8366ba8f
SHA2563bd2cca87dca2983a78039cff578de746cde6220526d6537f0ad082d2f6635f6
SHA5122e0dcf6b61067bdeab3c3798a90f2b7026ef72ec72a1a826e7e2b8cb5a962a0400e730c27a761e249fec367677c1e8ea7bbf58b9cace41bc5d1ba079dca5924e
-
Filesize
1020KB
MD5c206461de1debd71b2b72ff666e091a0
SHA15c90caca62efa66af2f37052a9b331381a13c896
SHA256b4d5b249c68e7fffd4f31189ae3bda436dfb8255a0562befaf690131e38a1f6f
SHA512a73b30147eaa4eaa0dc714cb74ad583e7d0cb787e9ea55d1d1137a93511fe8c745d1cd769da7c645ec26061fb66b9d0682271fdd8d4219279cb3504276cb8a38
-
Filesize
581KB
MD5e9c6489565171e875cdf2b89bd0b0199
SHA121b70dc3b49f85bcc56748ac8601e4267d7fc87e
SHA2567cb1d20c24a3b34012000148dcc717f3070a709ba3cdf6a261ab61ab03c441d6
SHA51204695644aa423ed5453552c70826dc6d3af1eec18e67df8e6ba9a2b512d704d4f032b391d77790a6de4ca71de6e49283a9a76dd38a0138a53ce57be769772585
-
Filesize
581KB
MD5f9d91da1b5d4f009e4e8aad4661cfb1c
SHA11d9c08ea08a1559480159039f394265171b6d138
SHA256c819e7337dd2516d99e84e4ba80b22b5b2fd63a5ad82a9ca5f8237eead86e2fd
SHA5121ad30184c7a2910cec8d57e4b1d3eb655b343fb03a33524c68a6fe156fc246833faf586ac051b917b1782e73b0d6e02dc29491808d196829db9251f2980ed92f
-
Filesize
581KB
MD585be63c2e1f9a08a8d8bf76bc89822d6
SHA12103287a7171580eb386410c6b2294142183a136
SHA25613b4941dae595635870edc8b51ea4aa7ebb77874d48fc5a57f972318376cf9b0
SHA512ae23970644ae2b63f3a5e6aa13d08e915f55b4a2d3766285525d0c6313db5f34705c8dd8211b0a2143fca30ecc30170f6cc1dfd3b783fc7187835f9989866183
-
Filesize
581KB
MD54b357a2be228372a7a6b00f3fc7488e4
SHA18879c5f43e8b5bb7cbcf06f81d24a19730b470f4
SHA256f4c8ee125197446d187fe9088a00c9b2aaaf0a53ba3c6a284c903eefe536bda7
SHA512fb08a5cac9080924584beedcb8755c34ce9d12175702e2993538f8b18c043dd5edabc1079c32476a814947ae924a9a18f638ea7a622b33ef5ef6418e6bca6524
-
Filesize
581KB
MD5f332730cd12adbc30a0f48572f40ddde
SHA15741f4f81a03a1b84f3929084cbd423c9dc732c0
SHA25687fcc7b8e6d47add670aa5ab13c82cc8f22a7be7722505c238ee1353b11b9846
SHA512b0b0a8f5a57fba85678974d048c54914d5de5bfef390cb196e11ee72a576109273eed962022e40a478d1a14fa39ecf08368bc9fc515d9e782fae6d567f52e84b
-
Filesize
581KB
MD546518a701149174d5b038797a42a7bd9
SHA19413f48c7c9e44d5c4bdf534ebae8ede15db5f45
SHA25628217e98280436c0deac6b2795f9ed9a875646cddcc09af1f59d92e5b5ccc13f
SHA512c95d13d1846bfc915d2015b7609a34d4d29cac8b227d28cc1dbf99584b2c2087b2ea2d6dc51c2241fffcd6a6e7d8e1cd1ecfae1cf037c33d353c1e551bc99a9b
-
Filesize
581KB
MD5a56cc7cde328d18fb74ab3fe348bb678
SHA1fe2740e9decdf9fafdf8075f5be1916d8c8d6975
SHA25649399146271bf1626c5be30ab590fcd0a3c77c5e0afd664973727915c8a42ec7
SHA51281479a70de55d41dba4c651b51e7e301b8b05927e52929ea9a122e60024cbae13d690b8450e94317d92eb5f79d4416bb4738fa2383ddc3b72b707cba581af920
-
Filesize
581KB
MD53a28d07cfe7529982302e3230357d459
SHA146b9374e0d56d6a810f5d5d872d71dddf7e5dadd
SHA256b924cffbc9ebd424a409d60acb9c6fb1337c5a1ce1ce7b637f1b403b427e66c3
SHA512f75a39222e10f86dec358ea81c0f82cd33a91035740cbace702669376d2aea1de1ece1a83f4273282fe5294d0d16a4929d8fc51a0a07a1d4d5161a92666c5b98
-
Filesize
581KB
MD586db1276b7f4e7d24537d74be543d6dd
SHA12baeb300e68a0ad01e46b63cba96d94439b8d849
SHA2565a26fd49c46a5f6c87c372599ca7b14e104911bbb9b8eceb7329c25b456f89c9
SHA5126b919fbb3cb4a5aa19628e811bfbd8340d8f20239c505690a3244daceb834e12973e674f2f2b8e775534c087d5faa0646e26e596122ef19e96cfc30747d11f49
-
Filesize
581KB
MD5a831d78a599e05ef415b1375e8cdbe2d
SHA1d4aba6c95cd8db70720e3edbf329eb0b238dd1c3
SHA2562ad084ebba61d67ee9faf61caad956195accd99960a194d6d331627444a814d7
SHA5126595e5f3d2951d910da5f13af9c896ddef5282f65503c5a9054324604a6b94b6c4c0729d6315ef4c5a8f5118bc44e956b3e16cd02ced562601bd4223b6ed6c0b
-
Filesize
581KB
MD5cf2691d33333715fddaaa17cf430d0dc
SHA1ad3eec680128b60573144251ee0f6c89fac1b629
SHA25652aa77c517f1c633f28130da838f9f041441e8fcba11efff49c0bcdb08e6c082
SHA5129cdd56356246d1987650cbe1d1d6b09a6d7e65a3e463fa96144413c019f6e791c3f4a882e8b74ddcda41695c20e286d5d2d250ad79aadfdc422488b34c77ebe1
-
Filesize
581KB
MD5f694eaa27bf636c531603300bbb72440
SHA1884d0aceb9ec36ee1a15411f514675f88a5cee6c
SHA256bdab7a2e5cb98fa3ed9710d0db7222d2a9e61719bea699aeb498a8a45b88c528
SHA51238885e5f1a041233f35f6b613c594ff4467fe9658f1413085c32ae5f6d54ba5e3d9d338e9b86dcb761f9aeacb6e0403a53c18ccf1b25b2df94c753616bcd4f5a
-
Filesize
581KB
MD595291c11578e66ee9ae3bdfea9c30b97
SHA13ccb254baafc5f2fcb65075f51a18d9699a99693
SHA2560c196c3daee2f8dd4d3a92ad60cd3f0d50cb950474cd5dcf6b03be02e4faac9e
SHA5124b6660f98b1730f0b3ec63b58cf9742c93422a4d0c95c3b85157c4e151ed1d8cf0b3479e0e915cbbad4a5a91e66ec6cb096b9c6b1638d61286460d243660f35a
-
Filesize
581KB
MD5a0998be9686ce3b03be0448d0d081a75
SHA19a698e747cda5c15a1f70f1127d8f00894104ffd
SHA25620cc17f36860eee00c4e102162544ef9d0e1d675ed9e2a19d6fe9ee503c24fc2
SHA512f7bf6c952a7bb4069c4c31cc2597ca9729c9a2c2138e5008e7765f1b56e259bb7b058605d8ad1bd7bc47b1bfb21b29be695c739e945b7e4d16e4be83c2e551b0
-
Filesize
581KB
MD5b7f3825f8a7d053381d07890ff939459
SHA1896f4c97d74a786b866ec70d06adb2da0502df8c
SHA2560718047294c39cfdde6516af43bc2dfffefe66f93a880a6a1c22951423df4da0
SHA51227ef40e4db9793b76be72bd63e6b24ae4062219208b3a68d2ae0daf2b0b41519797b3807f509751fc5f403a971db55de61170dc5ec29a53c352b0ef0a22653f3
-
Filesize
581KB
MD508a78e2cccacf9ce1bbf7cebde495d6a
SHA107ac7f62323937b99044ccfae0c788e3bb77a0be
SHA25678088c3b143fdf178058674b99ccd908f8511eac87f8e06b7c51d1566f6fed15
SHA512d6fa8dbbb54041c504d6a2c01e587de50eb018f2cd1f1401a3d31414e861bda485f391ed8f8eb469d7a4082149027f01d8485fa103e6d291924730b41f03b8a0
-
Filesize
581KB
MD566bb64e2b2326ca8d4096e07529046de
SHA169a56f080bda494135371adda881d40135cec641
SHA256790578a868f0042c148ee63bf697122500b6624b1dbec44f030047a7458c56ff
SHA512d54eff0546a674414c16e5ac1e0f953bba67fba6a94cbfae6ef0786baf7ff05bc9807bedbb4ac884c68947491c071da762d70d6c8e209e02a22a6d1b0637eba9
-
Filesize
581KB
MD5fffca8f005b88a00238a205bda6c32da
SHA1f2412b95177a1d74bf28dfff1c69bb6281a736d3
SHA2569235e78b5bb9caf1cf56127d6fbeb87401c9c4a24202cfb662ff1a1572ce278b
SHA51258622c4ffafd3412a206d6edad929daa19172cb513d330ed64e42c13e75c3d5b2758140041ff439ef85db4a1cd0d9e6dc01a3bbc8102dc81347d90066b64d6b1
-
Filesize
581KB
MD55baaaa6bb7f647fec7a5ef6f58dc5256
SHA1333e1e3e4f356505607fdb4b9a5920f005792de6
SHA256b1e7598ebc2b7c46c8578ecc0292c82994b3f174faf21eec2237583dfa38a92f
SHA5120d3f6fa20a4ce0399dfa68e54616640beab8b05e52f20f9582e285d97e9b5f419fbf0dac3f1e0af7ce0ed05fdb4ae82a41cb24a9059945bedea9cabaae6c7038
-
Filesize
581KB
MD5c0181a4348782e47b1a8876dc044af9b
SHA1047ed97de2c724ce615381a7da368bf6c85146f7
SHA25686b7d4c90e72ea4d4fe28a27b5b7b2117df67ad6690bbbdc69b2bbd5103f8c88
SHA512f266fd2d33065a7e67a6cc1ad99244ba238fb882bb288ef7d0169d375b7ee4463ab10a3ed955c15b7b7e9f0f9e3409a44040746eb4ea3a00649a5053a0d0faf1
-
Filesize
581KB
MD5da7e68eeb5e4421d42888704366d57f7
SHA18ba432da1ae7a3616c665a479ff59d813e341288
SHA25675909c508d74f6f31d648af4f8ca88e38e5a92befc66a2d79c0cee887f0f9154
SHA512a4e7e26adb78e0b7cd710bcd46b41e888fea48110a4abc6353eb2d9dce5d0559ae176266afebeaba6f823bb10f843a44ccb7505b59f6d6ad67e895a887d8e067
-
Filesize
701KB
MD57c4116fd394bd9995e64eaf58196e0d7
SHA1bbafe376720bddf373f87768bdffce7a92582eca
SHA256c08149ad1388cc241feef452ea5ea6abd849cc070bcc8cc7277b26474298cd03
SHA51290ea2b996fd9c457c80e72657f2a0f51f3564b8915854804de95e79fe97d1a9281fcda7aa8cdc3900b442d0fda1ab0f513ac5dae0e62f4ab5763354483c6ec57
-
Filesize
659KB
MD57de1c098ca235ed6db290b685b31e10d
SHA1c2516a60ba150064b4ab3858511b079553068aa7
SHA256a14d6f33f81351e013a026fdfca5e70bd2ff1db41330cee85ad47a993c626a48
SHA512756fce27f17d2c5420e2ce028168250217282fd4e6d0164de98cc413abffe370fb818e23507a2e5c0980e9f8d8bb74a80709f7d7a9bc99e5dcb54fdbb2bf1efd
-
Filesize
1.2MB
MD581357faabb6b7e70c84b4457978b563e
SHA1b470c4b0ad696212b514780c2739ccbdb60dcd48
SHA256f76f63052eb794c3d771695ba9c919be8bdef9485fb9fee533fc6f15cd1469d5
SHA512401d31c8e86877235bfcbfd1c751edb5078429d6c51800a7b45e904140c82bf6accdc99219525617823dcca26423a6c30f3789faa9943f397e9eba9650bef2e9
-
Filesize
661KB
MD5081ec2482e9ac6f1c378452ad6a28015
SHA1d5b228b0c79c74b3845fa9ac709e176c5a2d13e3
SHA2568d16e9069597698bd10da743c0d08e83d857630834cff2e8bf60b5d270ac5f20
SHA512e326480402d60587016cfbf9737c1a401f51f4f24de6c691c8a0ce04a4f6d41e79fe0a3d99810971067e20e443834d49b0ce8105e867d99976ce9c154006ee98
-
Filesize
1.3MB
MD504b11c3ae82494fb3527ed70d34a0fc0
SHA15a2aca36c7398e9762aa34f4d9fe6667e14ea989
SHA256585de2a57bfd669914be71a18d65c05fda50ccb508a53543fd4367c2d4a2c851
SHA5120a574ebd0e91037f241bc521456ccd2c3d0c3d2f84be0a2a1580db31802c77d61f53f441acf0b83c24c89845c6f7d9d484e09bc4871d73c8c4715faf347e5b11