Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
20-04-2024 00:12
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-19_a0a188793ff97df9e3d3a8c3e8aae5c0_ryuk.exe
Resource
win7-20240221-en
General
-
Target
2024-04-19_a0a188793ff97df9e3d3a8c3e8aae5c0_ryuk.exe
-
Size
2.2MB
-
MD5
a0a188793ff97df9e3d3a8c3e8aae5c0
-
SHA1
6c6b6bc67a1862feaa6e480bc21ce7db6e8683a3
-
SHA256
0d89bc5290fdb5776e44ac5f14e93c22e3ae3c7aa5efc4ed3a285d2372069a24
-
SHA512
dc2b1ed1bd28a2d699006aa3ba40a4e523fa7728d22a613c2f66e8743458edd71d6ff97318d2d531faebf11b0d27b62ae5bd3dfa28f47c7fdb7ef3103d17a94b
-
SSDEEP
24576:MOObVw4TaN1wdFukCba4oXtgLhU3wEdmh58rt2rR8FfBhRJUEbDk1ulUZ:MOOh3aN4FuLbegmtGMt2r4PRSEk1ul
Malware Config
Signatures
-
Executes dropped EXE 6 IoCs
pid Process 1012 alg.exe 5012 DiagnosticsHub.StandardCollector.Service.exe 4972 elevation_service.exe 2600 elevation_service.exe 2220 maintenanceservice.exe 4552 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\system32\AppVClient.exe 2024-04-19_a0a188793ff97df9e3d3a8c3e8aae5c0_ryuk.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\d0e22c71102ae222.bin alg.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-04-19_a0a188793ff97df9e3d3a8c3e8aae5c0_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-04-19_a0a188793ff97df9e3d3a8c3e8aae5c0_ryuk.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-04-19_a0a188793ff97df9e3d3a8c3e8aae5c0_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_79750\java.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe alg.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 5012 DiagnosticsHub.StandardCollector.Service.exe 5012 DiagnosticsHub.StandardCollector.Service.exe 5012 DiagnosticsHub.StandardCollector.Service.exe 5012 DiagnosticsHub.StandardCollector.Service.exe 5012 DiagnosticsHub.StandardCollector.Service.exe 5012 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 652 Process not Found 652 Process not Found -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3604 2024-04-19_a0a188793ff97df9e3d3a8c3e8aae5c0_ryuk.exe Token: SeDebugPrivilege 1012 alg.exe Token: SeDebugPrivilege 1012 alg.exe Token: SeDebugPrivilege 1012 alg.exe Token: SeDebugPrivilege 5012 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-19_a0a188793ff97df9e3d3a8c3e8aae5c0_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-19_a0a188793ff97df9e3d3a8c3e8aae5c0_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3604
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1012
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5012
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4972
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2600
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:2220
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4552
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD59fb1d16bf7f64695b830ed0f56461e93
SHA16478d1f955aaef223755de23c4ff4de39818457f
SHA256d46b47bd116ff4b307789ae519a45314cbe2fdb8b982aa9e8be95313e75a991d
SHA5125a479c184a25d0a2fb2e3e9912e191ae3ef6d4fb300fa52e35849298e8cc302ce299bebe77ab2db55d78543dec2429e4643db1ee5493946e78bacd5d6a88aacc
-
Filesize
797KB
MD5e91a8cb07bfc245fed6388a6ddd46eb3
SHA1202ff466ca3d865a93c4e4d63621d90848bd5a04
SHA256ded58bcca93481ca9d1feac94dda4a8955200d9472a25d1cf560ee270bb9dcba
SHA512294e4d7f15e1c08f5978b3fae0ac01e3afeb2620898b4502599cd5aaedef31970044b9ae52e914d23f76411c8a8c53e8ec61daef7c59e209c43a81dae4a95383
-
Filesize
1.1MB
MD52098c101206f53386fc5f60e0eeac76f
SHA1e53d4a3d7fe019ca754148cbc7645cc5ddecad5b
SHA256b60519fedac298a80750c8b0d7d0f17b16ab0cf6c1fa9451194b70cc69beadf5
SHA512c9abc8cf57b22efe0b3163a9bcb7cb252502d456aa2ed778e6caa666814d403c2e38a32d0e6fc44ec4281b7ca1cf3f341bfd16cb16510067119228a1c50537ae
-
Filesize
1.5MB
MD54995ced74d097bbcf5660310b17076a7
SHA174283d28d293d40ec210c0740d6e59d4ff3633c8
SHA256dadead77fe22111a361f37954adcf0a83536682884be6bf2e830557c90896e12
SHA512a458121bb7fff472be3691b420a8d73365fc4478b2c044a142fe0afc6df5474970f4c78b5712673b99dfa0ad849745e703081e3096e6ebd75c26a526574cc0de
-
Filesize
1.2MB
MD57d3b4761de371ec51565fd6f439fbfb3
SHA150f37d8d4170a080662ba77b792e3cf490fd38a6
SHA2563c0cbcc506cc6fdc9a2ef2cbcc0c206182316e2064f102f1d115b618c1e26803
SHA512e3a195e98709548a3aa8041209cf4290aa53be487470ac440325b7cfbd269ef9181be8f25ee92799be8c63bee0d47d334bf7d95a23fcf25c1529be74672695a1
-
Filesize
582KB
MD52e99b593af2734c2af87d18ed19f5c08
SHA10d5cf4b6e60a1cb6f5c6a5a62d0f6a52a96fc8ea
SHA2560eb1a3585b14d1775def49130559808ae9267a1499a338eaaf40c6ed6fc72935
SHA51261a084ff43440fe96d5b83821c5d10e1ec61e0ec91c01e8e082b6c5c0512ddb4ccab97f054150d709cc1e3065d0026fe9637958a15ba5e3f275271e550f9c3db
-
Filesize
840KB
MD534ea68ff28b58f798615181aed02750e
SHA13f4b9c6a6e1d2b3fb5640900e983bfc25deed77e
SHA2562305b56da20f61aba95a81c18f343a2d1df9bc68ad5e02fa13a804276b3ac0f8
SHA512d759f2b8db0daec1c8d88d0d97d49ebe3a467baaed6017c9b6c2579c06a713248f0c818a966419637a2a2526bab6924f40988f11e0935823d60c40a86a7aad06
-
Filesize
4.6MB
MD5af71c5aeb0aa5e0539616d27ab3e7027
SHA1682dc00d5e2c7f513b2aac987901b11efcbc435b
SHA256458ac75823c38b7404477fc2f888a3179aa5cbdcdd7a6c8e21a58a0f5ca13d1b
SHA5128e4836dd439202c06fcd5e2fdf847fe9bc289c17917d164dda8457e5e2baa9dde9135fc1834e956f5a0c644672b2c70d55c491795b4b3289364bd0eb4bdd31b5
-
Filesize
910KB
MD5f8ed2073bbdbb8350411034fc08fbf94
SHA1167e42ebf62b6d6bda4ca3984375a4f54e4ee3c7
SHA25623ff63e1756e1a3e4675e405c42bbba9d87a9e0bef8ed50c29c2814d95f57e88
SHA5121742e36e72c54ceb80e50e82d42d20d08e59a67cff90f01e876a0dac93d65a16345f35063feb478d3a8428e27a6278cfe2fbc0d5c657162657485fef4d8dd43a
-
Filesize
24.0MB
MD5df9d13355b36545ab1c8c16b0c8d5bb7
SHA1e7638ec9aeeaf8d31b4f73e6f14ebca1dc64286d
SHA2565558eade5d450778cf9d3f872e6d0e360f89dd41bb652505ec603befa1b79570
SHA512300c3aaa65d803c86713b56946e45cabe0cc5a2acbfb04c3acca5e2d2f385952831bff59db23bab88bc34592e6e44889d5985eb0eb10c95d5b0c51cca25794ba
-
Filesize
2.7MB
MD55b7e68472224b3f8d2efb9ed88a02fa9
SHA171fd4424bea2e501da9b57128bc8529bc9a57248
SHA25679208f1d0a0d647c6da30ea5e75e9e26c7e6c1633d7f41de799dc6a4a8111b87
SHA51245d4067e8d1bb3032b83621d23eda2bd8303da5a9f73f2791bce22bc7296e61f7d0ac87a851119116aa2b194d00c05e438dc97c8287716a04b5d5f0204785e0a
-
Filesize
1.1MB
MD5852807744e02eb90560531dfb10f722c
SHA10689131045c039185e26cd49f84880061136eeae
SHA2564f1ee1622b23f48044379af5e0e263ede29e57f9691b0e55493f8512d1f12b9d
SHA512aaee7f3ca80b1baf39c6ffceb3e56a3cd08e9110b245107214dee63b54bb7b3a06478380f5f28fd5e9338aff6f7cd5646b882e20ec05869bde29ddd8ba0acadd
-
Filesize
805KB
MD5bca4efc87b186847fa8ebf6e50c8fb9b
SHA10d32f97effbe167107e107b731ce7f3788132542
SHA256fc1477f794b760066e664e0eb090a8969ba16316c00594169bf8e5e01d7e17dd
SHA5121bcca332a8548cd52d93c01eae8e506a8422403c72ea9addc54cbc3fe58e7a24225b8435e27541910115dc1d10b6da997437c9eb931d0234d7bc46bbdc6f8115
-
Filesize
656KB
MD5de1c0d3be23803f4238578671b224701
SHA105349a6a6786971af546638bbe9ecbca0cfe8102
SHA256f5bea7b0a145a172ec96ffd4e80a1d4814cb341476123d03ae8f131476b6df5c
SHA5125010480f71312fbd11e9be2286202551552b0be0915ddace6db0227f0195877352e610e6c450e138d8da515a22142154bc6ec130c3b07755c6b8fe76667eec89
-
Filesize
5.4MB
MD5620d78c5c56242afa737c7c8085b2611
SHA1012d109cd701bf9e6d02ae6ca5b8d790b6da3685
SHA256a128a577e1ddb4ede0ebb323114e2f56fca420de7655d433b158ebcb81adebf8
SHA5122f3c1a250e2b8917bd907629a436cde308779ed1179a126aeec4fb3b916fef9309d9700a54bd8daca581f1e5eb80f8c1055aa67256b9fb6ca0bc31ee08bda678
-
Filesize
5.4MB
MD5c1c2b47bb8cfae0229e188a199e2de90
SHA144156628001ab51967c8c5e6ba4698786f24e09c
SHA25673eae2978eba1530d243854799a7dba64e690e28e935aca9f3d94b8ab45d1a51
SHA5124d7a9f49d3a41070a7c6930c0dc49208bb9638253cf51400cc8a467d6f9196a85a59f51c42c8264401116f1a89797a952b2dfcdf640d44f65c462b72fe2eff9e
-
Filesize
2.0MB
MD56ef295760d8a737fdbbbbe584653ccae
SHA1c585a704533fc0270ba3bebd31f208df866b37f0
SHA256a0f3db4e01131f1125e435b73664b283302682e68056723927e4e3ba59e1ec2a
SHA5123922fc28bd6241c7d99b5e2acedf338f1c7ad6cd3ef2be2a459038645205399dc2bdf51e37e2e348eb74b1d28f873fa360ee1970975c510b77c735733286dee2
-
Filesize
2.2MB
MD5b4c675e4a209527a3d374b966b009a75
SHA182f39e242b632c0b27b2e1f7b113d9690a79a80d
SHA256a2f72e13620b7d4ae2c6932b26e0c8e69a2abf1fe5eb198865df7644b51539c8
SHA5122e3b201af60ea2821d34db0f1f15ea3fc1bbb3d3218ab96a989867ec0f140f40f5ec80ad05edb83986f1a4b5e1bd9d46c765fb915d6c1dc4adadaa4c856c3e81
-
Filesize
1.8MB
MD5af6eb363bebc3ac091c2f3687dc2990e
SHA15927bf3e3e33281a979cec20415cb27ce22e6f8c
SHA256c9086589ecd3539e6a54e345aeb794182a856856f638047daaede403f8f23fa3
SHA5120b11cdba8e19dfacb582f7b2d60f2954848e91dcda378d271e97776ed36a3233f16be00b6252d1d09ce84598f6b99a8468c6c5c84108b393079f2f02a8c60db3
-
Filesize
1.7MB
MD52afa7043921ecd0ce63186c60e657d40
SHA1e24b1cc5647caca805b4994cd629c4f8045e8500
SHA256ca02d024bdfbf230cd691381d4c99976ecc21f2828fd1479939df056f17810e8
SHA51295ba7a84118038bd7d6bce4e8065be6fa88c1e9c9050787893ae62d68db65bb45c34787a33b4a00da7a10ab1190ebaa568ea686b745ca1494e1d4afef86a6787
-
Filesize
581KB
MD57278297bf30d4c3f89a7359cd60765ce
SHA14ba81200a26efb0c87d2c96b67296e82c8d37b1a
SHA25642b26452b66029c4fa5edfccb66571b1014688caf439b725a61129d578436c69
SHA5125960ef7da7012b9878c94900edba573c134ba68a1db55b18861b80a3c66e0b7fbdf995d0e135117c57d241d634e8584b4913357918de5f65466a2bc261295b58
-
Filesize
581KB
MD52e8bc4849be1bda97ca9935afcc8bf7d
SHA12d85ebbc70f9b2c1a7325d21ada7e6fb634524dc
SHA2560e1c310c5e5d22ce119a216fb97b020515b9d4756a0eb7698442be5b2d5dc7b0
SHA51298ed8d9d28b984e91d1338f762e907b3801a56c73d720b179e32a0eb0e31711f35264d6a1686b5cca4dcf2460869474f4202cc932106115b3409ed3cc3e7eb72
-
Filesize
581KB
MD5aeeee67ae4974050948ba021e944c821
SHA15a28ad4d1e99993bd33c979932021b823042a4a3
SHA256e7dae5bfa6c784ae015096f43fc6815261ee07102da38f4d66715dd778453a0d
SHA51234148e06e4bdf63ffb60444632c5b010078cd4ae36f9f1ecb81cef8ef19c15208159c97f9867f4e1f82dd05a501f564de9596624389cc46782aed70356bcf597
-
Filesize
601KB
MD5f8fd8aeb7b4e5b28fa09d37ead36b689
SHA142474e0c806ecf35085c7e2379e496bfe73fa832
SHA25694c68001d61a0a7491fd4fbf5f490d0f372ebe9f89fb5c02afacde7ecb65682a
SHA512a45fb948679d0e2d89e3c0e1567595628b8fe140abcceb12a4212492557feccb1c6d25871be790b743fda67e17fc896e2d469a1709f7d04bf6a5d2a604cadc27
-
Filesize
581KB
MD56290576d81b46ed4243c26e320c6329b
SHA1b520496e5204ab24404c2d0b1693eb57818a88f2
SHA2569a0f067aa95293ceca12832ba1b56d9eb90577f8fdac43435b5c4ec1a26a847b
SHA5121bd4ec586d5b467aacf20cc27ac5bd99328f653153cf6f95b785418c03dc970d790b98db9eeceed983bdd5ec8527ca8d358f5f47be14d327a22b4c4ab5686815
-
Filesize
581KB
MD502a4329251214e0cb1a7ad0f4f701b05
SHA1e6edd6869593d60ceb92ae7a5221d41043ae8396
SHA256c976bfafdb8f275f7bac3b9a455b0b4d0c35911acb736f02aa9ee4daaeaf9338
SHA5126570161af826e85b6d6a62dfe80c71d9c7fe5ae0bec854db401f9ebcb91ad39aea8f7f068fcd79ed27130f7d803a2ce6d55388172cc1f9cee62ddd51ea3d86de
-
Filesize
581KB
MD5a94313f3a528bdc958b75ea74be5cf09
SHA15d7c0848c5098856a301858dc44a934eda75a351
SHA2568c81156de9a5303fa84179c4b468b99b94f1cf4d67047ae2cd49ad5ab7458487
SHA51278fc2dd57f3233cbc7859db469c1179127b4c117a75a0fc99623aff8303d980ab3125b267b2548ff92cb8582c0638cf237b65f04685a379eb2cb09753ab576da
-
Filesize
841KB
MD5809c87487991e7d1b3b4342bfb3a1d51
SHA1281401e4881b1e47fe3788b937fc783aabcb81c1
SHA256db45c865c226d3af778043779891513fd004415c213c7d0194d00d6dd9f5b4fa
SHA512953a5473212f422fd2110371f93367c8fdc5009f8e39c76fa9dd1e3c4aeddb7cadecf0fc62ccc4df2a198a9bdbbea75aef3be4c90f521e5afd819fc780301249
-
Filesize
581KB
MD5f16737aecb413c86a1375368ce8ac4a7
SHA158aa97ff2144527c518fec42a5873f036f38372b
SHA256428438c72654647704258ee8e64267b090af8db15664d9d5371a13f72063e4ef
SHA5123ec8e84f63d28ad03b63737d06d57d39a7b188fb4a1257a6f0665b25a086f03d79f0015f2c843ce146ed82cb92b5e299aefe48611b31d5ad01b7ee0f17d85866
-
Filesize
581KB
MD58f8bfab9b0753bc48310f2548178e452
SHA1908180c2e0cff4381636556cd2e6cbbdd829e165
SHA256cbaa87f368608bdb6c44dbe53260028a3bfb86deab519501db8225e5183599ac
SHA5122a934150d8dbeede288c58bee712ad31e276b542a67895b4d131ceab6f761fbabb49ed0694163b9ce36198a6127d4eaeb68dcdf15f074d72bae1b1fca4d2aaa8
-
Filesize
717KB
MD585c91422f64b308c694a4eb511bc036f
SHA1de487eb6cdb0b7faff350a6a485aa81b0feb5f3e
SHA2562d4890476850c03e0c3089e102c395133b77cc49a0d78d4a4c4538d49f3d8341
SHA5123ff34edda22acead951b1ddf06cdaaa21e7e2694c0ef57dceefdc9748b273eb89f8c9ab21464ae87acddc55f37a996131848bca9659e81c85917f3830ff415bf
-
Filesize
581KB
MD569280e74bcea04c5fa7ab030ebbd7beb
SHA1eadc107ea6f1033a1046e5193291dd53dab8442c
SHA2569f929d345294f3452e23a9c3a28e0ab2a025b7d68601a2cef6063c547e470ff6
SHA512c3d7f7355f0325f6c5e063e9e9e862db1241218bc78ea010d80fafe307d2a2fa45ef64e54840969002a8a06b80f92623c2d39755f34a74c201ff89c3c9893073
-
Filesize
581KB
MD55bbea3866dd5a5c2c4283125e5d7ef80
SHA140e8f5f3016b56a603fc64d15ceeb11c2fbe08eb
SHA25604ae0fa991e9433b0fa22b5d9f18b72149030a3a5a46598cdd05b63af023aa0c
SHA512bc1b4ca4c42e049aecce7f4755cc1dc5cce2073eb62de9364af7b9f06a3e5e87e4e8e1b5134f4053ecf7f73b77feda2717e08752a9f5cad91321c63bd0aab8c4
-
Filesize
717KB
MD5794ed0d8f7f51b6fe9206f25c9546b87
SHA179e3ec63ec2c82b02a033b5a23d4b9c82542cfd6
SHA256b19dbe280e386a449ff4190e561cdb66ac20994035c4468a167f8dd7dabc8f79
SHA5126c6145191b8d0be0a0438e5679b56ca6845cba4165e081f83dc926d1e5af0466a9fe784b46b24633eb32e466fb4119e4002b36e3416e7bba155f14f693cc35bf
-
Filesize
841KB
MD54e07ff9c073bb7ff632c231ea26c7800
SHA17f60aea8aa8bfa03a282ce4dfeac1941ddbd698b
SHA256e00a6379234c0fe556cbe99b8663b9b96b28c19d71fd3cc26011243e990c4a36
SHA512fb7c8bdf1a71f05b0e68408ff1ad1554b0642850c0b26e268fde982925148023149919265f065028f8f718ac71d65e53094789cab4c7f0bdc0854aebf67dcda0
-
Filesize
1020KB
MD5c4615b89fb09e01f079c1bad89c2e3ff
SHA189b43f53624fd00c522f0a5f2f379f693584236d
SHA256dba8b4e07b83ea2d590c519974f94e22d7abf7a035520b1d4044ab9afdd7c040
SHA5122ec783fce9da8ff9907c1b17beceaf0058ca6b60c2e2b14d8e74d98e687b1c54d5190f66799bbde9ddeefb490bf0ed9975e619e487978501aef529261f2da610
-
Filesize
581KB
MD57d423aff2266e2124677643c51b7c9b7
SHA13855982088801ffca1a717fdc37e47481d85ae8f
SHA256d4c088f266973b08ca5345747db89da359567d7dd5381df7bc5f329b2a370649
SHA5122d5d5745b696c5972cc02a88d15a1ebfc0f1da0c99262d05aa2e45a080e87537f8e45e7ac6b04c288713d3d22bdf69a6e3e350fdb854233ff020075bf769dc96
-
Filesize
581KB
MD53c3d683cf720a4f0f569484afca16aee
SHA10d40c05a66e444098fa6bc6cb38cd2305aa70ea9
SHA256f56d2a607b659630ea9a7da798c2aefba199066c3fb2a81911c0ba1b7d92de3f
SHA5124a6078ba39a00f2a7bf3891060427d2f1a072811a3d356ecd8f1f46fb10251e27600a2320d64f709ec2d77d33c7ac3ba4d299bdc418d0d39b2b5d42f0e11225d
-
Filesize
581KB
MD57063ac568e14cebbf3f16915107aaab9
SHA13e71647f362e0248384ee48f298a46925426ec6c
SHA2560aaae4dc845c4b63bed3098870c3f9192e07317b9fb11ccf5ea29cef1550bd6b
SHA512bce1b85c60ed63139f2a1bcbae83f4d47f1a195613f3e05b612a2987fe4e2dcde1a6a1f25e88c9f5d11bee3c953381a6dafcbc3856d75f1ff1ef09d71aa4b430
-
Filesize
581KB
MD547b1d9ef1207a6f8d8046895f7596d51
SHA194b0db35e41447e699422d611ad2b843d884d382
SHA2569469eda666a9769e0c38d103d879c8ac728f4bbfe1bcdcc49a03cfdc5be6addd
SHA512178fcea72aa5d288bb8b8f38fe2f2df70fd4dd3234b3e0805d2b2e0f2ffa896626f1d7c4634e11f4705d1691e31826a09503a1a5b0883092f6dcd2d7f95dc8d0
-
Filesize
581KB
MD57ed90e8e23b1419fbc483898d1f88d69
SHA12a132f71c236f692259e787b3284f5ec636b4ee2
SHA256142e463611e176bd972f118e04c87fda248612749dbc1f555f17dcd58f7d685b
SHA5126ca1e3a056701ebf61c867732fe5d620c4dec7d7b8ffb3b1fbf470c2c0094f66364ae2f0688cc364560b35044f2fe9b5b03cbeb5862adac14f30fae18a553b92
-
Filesize
581KB
MD50e19b27db0064a1522ff7762a5f1599a
SHA146707ebfdc549190253b2badf9f305567b17aae1
SHA256893741d0c6b2cf6095a1fd8046afec5049e42e69aab928b88adf354f8894d142
SHA512d7e050845336e9e8b8c016e1bf2d1b6463dd6238ef97887d16ed773ee6f94aa5dc2b9c95ba5e556d6a1886b8fe776c28a2dfeb514fee48e6813040c6c62a5df1
-
Filesize
581KB
MD5219f79d8d109dc7607017ab24f6b1745
SHA1e93870d11baa94e3c17346e0d8eb75d8ebc3afc2
SHA25683391244aae6676cfb9623c16f9bad319cf5571230bf661a9f7feb1b57a67d9d
SHA512650f8778496ebcee67999e6f7a764fdc46bc414b951c0e93ad960eda332ca1eed58bff1d90ccd24d09ba2bcfeb1572bf392945e8d80c39aa4acd703f831dcc6e
-
Filesize
581KB
MD5b9317490d709c15b34b01b721bfcd45c
SHA158c8d44f4795eb87978c891cd039af28b96cb0ab
SHA2562665a1cda11f5104a9d56894ebd36293c87985de5fa037ecb5617fc54a6bfbce
SHA51208d4409f514bfe4096e935fc174d983d3029446a9af71bafc0fefcb987219488c3b9c8efe3df0d34fbb3dbce11762d97907ea6e7bebab9bd1353cd5a4915eb1f
-
Filesize
581KB
MD59abc9fc51b02fa03bbbac3f70c9e6438
SHA148a1990312ef6784e9e6bf4a350ec19a36c592da
SHA25698fb4c6647d365a3e3aba71daac8b38779f4e56bc1ac9723a19ee2b91bf193e9
SHA512c664c9c2587dd070e60abdbffe0db4b8d62c3284ec1c92ca48fd6413436091b7a0d0563248ca4b7c0c7e62ad5cce02754ac942bdcaea31d1096c468a9c76b386
-
Filesize
581KB
MD5816b2466863f1a0b6f1574fb99a25f1f
SHA1b6737a61d6d5f194b277bf69b5c99473f51f74ef
SHA25649319824641d066262de4b53c1ad6920ff195bc0350307440f5dd903d1187ec4
SHA512233e1e0db0defc4dc99cb8667019e62ceb19489f3b7a1a0c13028e29a57d102efefd2b01bc35fe828db201d14a2906e31d56a8f54efede0ebd8457a59cb61e7e
-
Filesize
581KB
MD5a286de7acf3625da2c2a969f0b0b93c2
SHA184b714cb3f373672886d41894fe363191652788b
SHA256c2640f50a42b5c0c40b0c62e3b5d89c74e5f6fd96e8064866bbf8a5e8a4ff9b2
SHA5127256d18d6e6ed19ec8a4690c5a7856af1e2cbd473555218b23d2e669b67e82af2f5b51da4dedfd9e3f53f9dcd87665d1bb6bc85fbf7179c03256b6920f732d44
-
Filesize
581KB
MD5f378293b5687e435da3050060e97a8bc
SHA175615570ff025e20286b0775105c3919587a5639
SHA25663440d6f6481c2612e48f6d027429e618883b50c107229cc4b1f9e2bb1a6a148
SHA5128fd5ad1a6c5a65d59ff0451ab167e95f6865e0f0720419f11926244ea223b755818c6ed0e98e8e51c346a4154642a45143edd3a8b721df2a9174d4dd629a4e8d
-
Filesize
581KB
MD586a412127c61f91b5a0e609d58d3ee68
SHA1c1b04f53e5de71e7666ecb4ff2d7ca159f4d2fd8
SHA2566b56052633e251b494d1950942e432f00f26557caad0aa0eeed40ed05a6d1cc0
SHA51225ba03c6e0429b5747cc700ae4657d11e2ad9c532e779a4c81a9b8065e83f2d91d4e762231e7a95e6fc215b3a6a101b2f6494b7ff02984ff7604bb334da6e449
-
Filesize
581KB
MD5573b7aaf38d77d9cbc0560ebf24a7ad7
SHA131019983b6deba5835b6e6fdcdbfaa29d4933614
SHA256202fee1b010ed6dc6d81d70b8ee043de0b1edc373620498aa4510db043443ad2
SHA512ed08c538fde958edc5ac99cbe44bfd1e9b7e704da392ea2f7d6014f59e6629933567f325248c0ad25474a63bb47cb0c616639e826c910af08cb6978bb4c37f29
-
Filesize
581KB
MD580cb7b961d745d2dfa9b68e969c562cc
SHA1627f0e93d2c1d944a1e5bc7584cd8aa6a7da2143
SHA2562c0545faf75d9406afda7c7b3cda57945315ad30af0663cef43b4c7da669ae26
SHA512935053cc1977b8b157fda3511c75f59c0bb260ef0d101ec4327f43421c14791140f472ea521d5011f06b0aac19199e082227e1803b1de460c340b2bdcc85ae5d
-
Filesize
581KB
MD58d5ba9b4698417b036b797d8330cea35
SHA11e7772785d82f1aedae6407c1afd59b98d94a8fc
SHA256b248910ecc6cbcb2ca757bc692e96e33947931aeef5f2d3907937f5e79d4dcd2
SHA512c02367adf702052c21bacd599ee0138236f947bf1953126590957b319c8597540b52511bab589cfeccd197cbe3c5f743b9b1847036c257c219540433bc28cc4b
-
Filesize
581KB
MD54fdb8fad06e4840a2ed45fb584f9e39e
SHA1a11f4a045611ba95d286a89a6051870380fc485e
SHA256cfe43e0da48348b989811ac102249bb06bc8eaa7a29900eac847ab717a15dec9
SHA51299beffed221b8b7368dc132e95e90d25b65ba8162670358f77d8a3adc654a9a4454a6b9c3fc7c458d2b1d085bc55a22ca8114168b79d6a33e83217a5ee11a56f
-
Filesize
581KB
MD53b084fbb1deee1c3bdc9978a76d68710
SHA1db8760134cc5b05ff1ad72c59037f1ca3a87168c
SHA256829e4821495d3c89f127268e913bce386e2274575d170fa12ce270ee1da6c1ef
SHA51246d5af40eba4d6a8f991c71c6636927a3dafe357e4292a5b4eac4c4beb5c8b9851d3b52003a1dce896f691f43f25e977c8b39f645a24e4f7202c617c636c9bd9
-
Filesize
581KB
MD5227ba5145e179758bac14ba03bd43dc9
SHA18c9fa53c444c1c4ccabff15661d69b37532f9c5b
SHA256c23e0db8162508a98c8b6450dd63bf6b498b8f1299d3a9d0631f7450111392ba
SHA5128bc15baf233f3fc55bce5015ba945e86f8788d042f60ae1b17ebf041ae5353a453c4f9f9468bf1a8dc1d1f12e50eaa7d4a78b82dbe15824810e81b15ace6af32
-
Filesize
581KB
MD554eb5dcb24b6e9ddad7ec30dba63f46b
SHA142378d9ee613971d668552df3c858520f66822e1
SHA2569b6b81e8955763b4b6f3a1cea062d237ee103561d2ed138dd31d6e62b0d71955
SHA512201749bbc73fa7aa829355ffad2f1d39d19c579ceb857f944a353991c1fc39e0933891970c186cff46cc018a406eeba7040d462e0712318b7b1fb671bcc0abd1
-
Filesize
581KB
MD5502be19869b1c423a3e91d4ee8e4ddb1
SHA18d69c93307341be1401964013a26dd6238086a87
SHA2566d06bad75fbce79df2c5a99fa24de5508a9bd76c92e2295bcf46766c30ac6bbb
SHA512a22812c85b18e12d00fa4cd18960dffb8aed38149339c2850ffdce2a8147cd1afa55e0f949f203de800b9fe1e3bbd3f2e580afa4c5311ebff6c1a30c58321b67
-
Filesize
581KB
MD5ce90a0febe799c4d67f0f9c72d46b1a2
SHA181152f00fb6238c0f8067aa66c108065a15dc765
SHA2562b44fbde2554bb73f8a0c6f8b27a394d65d6dcd047f52e4276dac3fc1cb05624
SHA512b016c46ab383f7e9106bb63db81ab08be2d557423a1501a1207fab07578da769f9a55ec80e3b46f7d1b96000747d647b6cc6cdda0f378894df74ce706dc1aaef
-
Filesize
581KB
MD5827802d8386134e96f470f5f073c6cf9
SHA137b7410ca08e0c32fc115a7020609d7472f02203
SHA2563a0cd1601b5dfe13be38caee908166610c993ae965634c7ca0642d67bc7b2d99
SHA5121ccf7d0a09634c4348e418f74cd9550ccbf600282bda780b1172875aa9c3671316a9bddd70559859b553f5b6c49913e3a509fe90da058e5a50b442afeeab6370
-
Filesize
701KB
MD56a163b23a915b1f41000a80476e62f7e
SHA13304cf610575fbcf4dbf7e6c61047ad9a19d0440
SHA256758508979694c9a37fab1e98a63689ccbb305b1f6a5a0fd3b5df53fca17882e1
SHA5126cdb931224867555f6d202506c499884313938753b9939b3ba3571f70049829b46e8e994495232911da319eead1185ccd63eccfbc4ad3d92a8d7404cf3d32c04
-
Filesize
659KB
MD5fdc2869f8ecea71cd77167c9706056d1
SHA17493957b99e03ae2f3c32c2ffe6f1ceb05cd4fcd
SHA256e7a133e940f6d5c98fda1e822a3e99f3fe08a5a77686a6b8b37d17cbf328f010
SHA512199718ad1dbb66662cdafbdb9f47e5b81c7a4d135ccf27a2ffc320bc2fc294ec7ad13f86fa400f313a88381a3cd7ba8a198eb99f92aed3466ea274f94317e764
-
Filesize
661KB
MD5a62a44277700bcdd5f334b52da559078
SHA1fa79ca1dfa9d875763f62475059a16150f309fdd
SHA256a5a47287847540e1d303b6e6aa7a8742c7b9a79d86102b403014b603c76b2340
SHA5122067123d329c3fa21a422f4a7099af61cfb37563d71385727d98dcc86c129a382649d572bd0d6c5bde1b6eaaa01b86158a5d45d013813e36fd3a4ad1f92773ed
-
Filesize
1.3MB
MD5d0b80598a4469cbe2c4b7e9972cc5e92
SHA1d88fa96b6cd60ec8effcd8590eccb4c6ff92df08
SHA256d8fb46321207b32d0b71231452a776703434e3c6cc445353e61dc8e7621eff93
SHA512323e6430ba39174cb25d628d17d41e89ac332483dd59f7a52b2cafcf170550346360ce9bf7b60018a4dbacb4d08d22dc4ae04cfb8d30cf5134a338e62ae3a33f