Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
30-04-2024 15:02
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-30_dc2744e7e1a5c7c4d5d981aad6e43842_ryuk.exe
Resource
win7-20240221-en
General
-
Target
2024-04-30_dc2744e7e1a5c7c4d5d981aad6e43842_ryuk.exe
-
Size
2.2MB
-
MD5
dc2744e7e1a5c7c4d5d981aad6e43842
-
SHA1
a31bb9beb4c1a11334e7e335f579105509eea891
-
SHA256
502167bd027f15f72f5a0674486ac7624a832ff90e7027991d2e0001568b9141
-
SHA512
3ba31d699a1b662803a9af51066b6e7c60c35ec905396d94daade7867205a123c3740e65a60ab643bdfb77b0c0ce048aa5db8db617dd8f9dfaedb405d94b9eb0
-
SSDEEP
24576:8OObVw4TaN1wdkukCba4oXtgLhU3wEdmh58d2JOt934J7Z6bQaj1BvUm9J:8OOh3aN4kuLbegmtGrJE3jM2ce
Malware Config
Signatures
-
Executes dropped EXE 6 IoCs
pid Process 1840 alg.exe 4980 DiagnosticsHub.StandardCollector.Service.exe 3080 elevation_service.exe 2440 elevation_service.exe 4552 maintenanceservice.exe 3952 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\system32\AppVClient.exe 2024-04-30_dc2744e7e1a5c7c4d5d981aad6e43842_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-04-30_dc2744e7e1a5c7c4d5d981aad6e43842_ryuk.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\3d9b1b3dad45b396.bin alg.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-04-30_dc2744e7e1a5c7c4d5d981aad6e43842_ryuk.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-04-30_dc2744e7e1a5c7c4d5d981aad6e43842_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdate.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_99140\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_99140\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_99140\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateComRegisterShell64.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe alg.exe File opened for modification C:\Program Files\7-Zip\7z.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE alg.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateOnDemand.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe alg.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4980 DiagnosticsHub.StandardCollector.Service.exe 4980 DiagnosticsHub.StandardCollector.Service.exe 4980 DiagnosticsHub.StandardCollector.Service.exe 4980 DiagnosticsHub.StandardCollector.Service.exe 4980 DiagnosticsHub.StandardCollector.Service.exe 4980 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 656 Process not Found 656 Process not Found -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4376 2024-04-30_dc2744e7e1a5c7c4d5d981aad6e43842_ryuk.exe Token: SeDebugPrivilege 1840 alg.exe Token: SeDebugPrivilege 1840 alg.exe Token: SeDebugPrivilege 1840 alg.exe Token: SeDebugPrivilege 4980 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-30_dc2744e7e1a5c7c4d5d981aad6e43842_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-30_dc2744e7e1a5c7c4d5d981aad6e43842_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4376
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1840
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4980
-
C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3080
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2440
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4552
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:3952
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5b22b0057b25449683dc433464c454f91
SHA14265d860717fc93c052e9323dd3feb4c151231ee
SHA256c6c7057e463f4f05f9dadedf29eebc5badac9e1410fad194f2fe79e13bcfd53e
SHA5123364a068e4f9edd3310bfe3e7573837a6121e2028ecdee321d2aae29bb64f6f334efc1fbbcfde5711e446e09a991f7183f1da0da7ef23330faabc74e836b8d3f
-
Filesize
789KB
MD563b08041571ca61ff48debbb14bca442
SHA13dac6b123262b01738437d94bee21733fac37fd0
SHA2561bb8d235b1bc152d95d3aaec46713c465e7fcc8c46e038d13c1a37ed84cdd605
SHA5121f3ff5031df4f4d103c6c873c755135eb5107823f20254923264c7aba891af7f3f3d59e0f402b1fb8608805e496fb032f6807c56bd657282f2542d8b86bf1f1f
-
Filesize
1.1MB
MD509fd32a9e550048b50bbccb12cf93621
SHA18a42e2822804605828ae9aefdbda919dd14f9f31
SHA25639bb50c2c69238dba86b7645986b1cfa19842e8b7113911ec97f4a6f4cea3c15
SHA5121e43f6d6c11db1dadfa52aa93fe5d874741f624d5bba2d76e449f8c0260439462c5fee6b5047094ab9ff0a46157a8b54fe7eab35ee8defcc02eacbd1e93182ff
-
Filesize
1.5MB
MD53ff428c6e3808c11ed72d247b8aca963
SHA13af44ffc80a1c5546453d1f64f0fc7e46c3df995
SHA25660dec7e372ea5bae27c24fd66a377d6e1926c3289bb1204a449d5e939a7aaf59
SHA512e2ca10facb3ab3887ecddc344daffddec697a8979a77b8736aa57b83fcc4fa6132e63c9ef320eb83a92a99540c11502ced375f5af946199452ee928937ed43e1
-
Filesize
1.2MB
MD583ab9cc8f27af05a476d2a61b0d48b02
SHA10813330f48e789b0d2e3fcc752d4e60f63eb775f
SHA256914868b73329931e0007c1a39cee64db85b54e92e0ee0f189ae4d0df96d95a36
SHA512558fdb62beb229a08f60bc4e6bd95c33b43cfc4a47fc272e47ee1609796a9bcc3721b6a48c5fb751abc1a24fbab1dd90bbf92217fb34871b4c602cb911a798d6
-
Filesize
582KB
MD5d09a5619bcf2f53129b0943844be1fba
SHA1855a3d912a04e8b9505ba71364257dc43e81f266
SHA256238c3faa388e62d6000360cf72eedb02756d5ff7239a3dc1e649493d9550c846
SHA512118e13ceb184b3119476f875cc057e4a8ef3ae62879d3715042018bd8fb64dd9545115b8ae3be1f7583f9a5f57fcabd68b344e00c9bc39895df9dc5a6d24fee9
-
Filesize
840KB
MD50f77b4fa5a5c272fabfc089eeb2cb9e8
SHA17b9938fcc2fa88776b5c0297398bee80d35a97ab
SHA256799167899045b87efc0ea5cb14fb630feb303b3d4a0ff7a850aff068badd8e46
SHA512c74179d3d17f74e20dcdf055dc94bf7663a9b0d784f015f2680cc87213780862dc6656b8cf99ca4542e8d54ff325f86a7acd34c386c2b2d24581e672138ce0be
-
Filesize
4.6MB
MD5bdfcbf3a5ac7496a2b0753d710c780c1
SHA1e9e64ff6e13703c32c60a50e11d9f323999af895
SHA25688fe1b8eed8b143a0d98e01151d31b9fa628282c813c6b6b5d5e5ae12217d716
SHA51215d536404ad7045cb68c7bdac94e3a8e4cd7eaf401811de7063394e130950b9c09437db15009d9e630d927ab81ffc302931acc3477c7d9378740fd30e40d2b9a
-
Filesize
910KB
MD553322e57c19684af7834ce1688f8747b
SHA1284548a14e5c31c13981e5b7608743e6663ac205
SHA256f9533ddb942c1f27be52b92f174e9513002fbb198c02b69b4f220bcc12744a86
SHA5120d242fe6738f2b054c81db2311b2d5bdc2128e877804c2cc0fe8f2d174bad93420266114298abcae8d67e534f7b87954a1bbdfb416ac6975c6c463f8ef383180
-
Filesize
24.0MB
MD52487f9ee7e6a18bbbcad0d5b86858654
SHA14b8964f10f35a16bde96a3b3e9b748bfba476a8d
SHA256e9b2883de8d2434e5b4527b0d0a19db56e99ea7e4300d6024b9260596616b604
SHA51215a2953543893b33fe0985bb63fdf333f7d49e2d0a76ff53e14f9571435324eeb576f702b3b7d4fc834deba72d2864c7727ae0998f03c9aa3414fde48d01618a
-
Filesize
2.7MB
MD5e6abd4b16f11ed58dcde934d70fe1fec
SHA1749d3ca9f6ee6d041e4ec174429939e14983da6c
SHA2569a2b36c688d689650b3f098be43e248030c0eeca43464e3d3048447789dbefe6
SHA5124e9adea65bebf31732e00aa6dbac400ab61435a3c260289025dfea9c3773fdbac6c6c37f7da81e8cf4bcaf405d35fb26aea718815714b79dfeecdc1d78584ae2
-
Filesize
1.1MB
MD557081d57217d5d19b221b3c957fc2840
SHA100c360625b0add4a042d823fddde3055c387069c
SHA2561ef3b2ed75d2cad253f4dabc6eaa1d0a00b831ee580ef17229d7b235e4a98039
SHA512aab1f34b50074f0281e2df41e00e9a420f8ccc0ba829c5e7417ec2082171ccb2600874f22d76127f65843b35aeac15ba25b4e99265e3d1c80011105c503c7d6e
-
Filesize
805KB
MD5130698c41cd9a0ac22092ab02d2ed12b
SHA17bfa48c36b30d5353a6522cfa7b3b225153b2f48
SHA2564ecf774221013f7b56d3c06602d4cee8efee314b14b9f57cc76fbb5ad4906258
SHA5125f13494eb387f7549ec9935ea05e960558898b5393bcd915f6d01d765576d3e5ea5744ff1c2ec0803e8c25ddebae683be493e4a1ec9966494b3c80862e800c73
-
Filesize
656KB
MD5cf719da58b0e1e2e69fa1d45dac915ee
SHA18e8ec4ce1624713c92eeedf27a2c090206b2b900
SHA25669cfca2cc5e1831c1d6af394394c1328c92f433e97fa28d9a4392c0adf82718c
SHA512b767e4a95d6fce75d8460f956ae97ba95d98ffa2e4bddb7470df3973a9be6d89685f50520dd93288fd6d2f265306313d8f5e07688f2b3c9d8438f7418b8dac1b
-
Filesize
4.6MB
MD557d6bb482113ea76ff99e0d255eb3ba9
SHA18c56e015d554fba1f587a463f0d4004c4c49a6c2
SHA2567232ad0da8ead7970e1eaffb2cc83f8ec17b6fe5f0d805342815a42acc6af3d9
SHA5126d57a9addcd823d27866dadc2ba05a33a18fefdb0cfcdaf7636c6f3f4e1b29b584a603560dacc7f5b2c473050e095ae1ec4a5e4f682888652f01cc9146502b39
-
Filesize
4.6MB
MD5a33db926a39f6312cd861907d72b2c2a
SHA1b14e3defb10d60a192731b609397f8cec0928401
SHA256481498ccb8f56911008de6c29c0f28dfadef13214e94e449d433b14f237e798a
SHA51274fbe50f29c8ea11ae51b10e6a0ba8c2843bd85f602cb80fe20d3f039983a27ec0930da1543efded1db25dfce0cc765396aebe95f19aa425c693de72775bf980
-
Filesize
1.9MB
MD54074a7ce8000e90cf69cf3f14017aaee
SHA15f472e8db2d149ed49cb622c6716eabb977a3136
SHA25610de724fc902eae0261c4d8bde9c1774c9d2cd216df611f6eb6c274c62db5034
SHA512c1f2d8192f364dbb73a32cf6aa72d50bee164934d43a298f3d9afef76e88675276dbe402591a04ea036d9a2fac7348be9db310a62a934f4d626dc3fbb2df042a
-
Filesize
2.1MB
MD5fb2cd1c77568c37b202f913f0c03a7ea
SHA1a356118fef1d45cedff24aa8fe08b2c0590e7d6f
SHA256e8e1c02e102979f355193a3ac6f7a6e53cb166e2bac3f6bf237c671469677ae6
SHA5127eb0876f4d979efa5c2d1950897be6f016245b72220e15b77e839e38414f970eab8ebfc96ccadc6815e73456e2493d3122ae2009be40b669792b77d5498cbc60
-
Filesize
1.8MB
MD5537de58200ec5c06e4bc474fab597de2
SHA1ddcb2dd8fd919923a5676ddf5b7b47cb64234994
SHA256d73b640986494f391edd4fe014c6ff4fee3a88432b0c8abeda488510818ea4f3
SHA512300399f84a06d16bf1df6246b1cc73b608f911656356231e49e6825ef5f3b36b90dac307cc3d1a74285b225153e5493ab8f2c76b6787c6dd582c0b492239b86f
-
Filesize
1.6MB
MD5a8bb7b556b2cc3c6abcebaa325acbd7d
SHA1e064756909668bc9f63451b2bb7cb493351c6000
SHA25690cdf2825184d9fe3c1617123ecc7c74afba33e200479f91c9cd0f3922f669c9
SHA51259f0b6b48d45f7fe2b83835863411955fbb8518af6c07372cead428570a1a9aac616ce8f86bf767ecd01be1b0e1744c6779d91b855ff25b7781fade88eb2b59b
-
Filesize
581KB
MD56294bc10decfd42714337bd11de2a728
SHA1307eec72e0053c094e2376553cc01508fdeb1905
SHA256c3beb4cc211f4113f5e65c885a02bded96b67acf88c5e2cf8cb83ae829454a2b
SHA512d8241c64f6fc755eb009159479c16368afcd7c2bac94de955a4df4541e3c7f4298f1e38f0b09dfd2ff79637933d32bbbcc7134c5897587ed421dad314397d052
-
Filesize
581KB
MD573bf5e5f453d01ecd82dd5a47b9cdebf
SHA1373ece5b9ffc68299dad5ffbf9bd2d42e4484af0
SHA2560648efe6d9819e401fe3d60c811d8cedbaffcc89f66fca489693d6a19b6c0202
SHA512c1c626aebac3fe95e118962a2a1f856bc5c308533fd6e4b7fcf8fa2419e554f16c90bb5de755cd058bce82adebcdb0f82f6860dffe88f497cdb3d57d0c4971b2
-
Filesize
581KB
MD50afee1c38f3e4dc936b6fb58b085674b
SHA1ee2276d65817a4c2bf090c4a1fc4b42ab2cbeb2b
SHA256943a851d2b2463db3cfb1f238e5192cf369ef36539c97291a43ca0dd55c98f61
SHA5126b98c8feb27e059f6e098e0eeec6e606047562dc8a8b47bbcc498e6274e3208fedcbff4ba12a399bcda2035dca96a35e8101121e18b25dfd3f738602166899b7
-
Filesize
601KB
MD5df57e427b7304cf7739c2988ed400b79
SHA177941248914e49c8129bd4c2f281fc24ea9f266e
SHA256472bd8c7c64aec9f2a98663ff776b1d3c069438ad8368f34da019b4d4bbaf7af
SHA512be3fd695422bd3ab1b6026748f07746138431865cb98932f7c473aee4c6c8b8dab332e5a783fa77a9ca3eff80717db21be8e86fefe2252a1f51ff2a455454a41
-
Filesize
581KB
MD55996001ef4f6da206f050d530e2ff01b
SHA10a257063eac0ffb73d19ecf9185e5da8816a1ddc
SHA25633c6908b406e08a5f6219ab7fae3306376b142e6c68a065fa4bde3810b5edbf4
SHA5125c655c937548cdd823373e8dc9d9c80112bd6d958ed333839d4a7ef600c9853da152bd02d6da0dab7be5521c858dab0b82a7039fc2bac9e88a5bcdb5d2e6a656
-
Filesize
581KB
MD5f98411fa09436451cfcd431dae7180b7
SHA177bda376be7944f2be489551d16b543059c59bf5
SHA2565c7abe0d514f9a64b347387c5055601d64b7fad0c5cce96f629bec04b3873c75
SHA512aac132bad12b1f00e00aa7d96e6e148bfa4c73d8947a1b6c081a8be52815d326b7c54dc06b37642c54a976616cbcc9b6f88ae2183e95482ccbc265851836dc5f
-
Filesize
581KB
MD53ac2b94aa5e036ae27d123d5c2cb49b9
SHA1bea8d7296452227afac1f87141472654b419061d
SHA2567327056ea1b5d5ddb68a1844036a56c13e661b33d18f2b12b42f18796c43d897
SHA5123501a74bee0353f0b99e387108f09d4ea8a8fb49f77551ed0d3aa716d46468d348b2ab6e62bfcafa546ba738b99ce0ba6b4616d82f60557890003ca042f6d2d0
-
Filesize
841KB
MD557c1c235d47a5f7dd65419f4ab1d4711
SHA1c62ab68eaa7ad0bdfa4fab52d9eea8c1ad2fce63
SHA256655607e78e8cf205db189aeeca8f82aeb1671622479c11aeed7f82427115a79c
SHA512677d1ac3f60c83f1942504afed7e355c000fd9ef9c199b9aa13463c8e1c6cc6fef581096b8531abcecda64de571978edec20d5c7f7167683247ae9fe93fc81dc
-
Filesize
581KB
MD5002847211c64bb20f207ab509ce8a4fd
SHA19694d7ad1ab7a1c8eb0e60eebd6939953bf76f6b
SHA256d2bcb0b881864560f08640f21d8be8be1d4a859080e7c20c4f46f43726565b44
SHA512e5aadbedb2a35f8dfc545a7e6f1001067c32a41095cbb29c62e065cdb731f13d609edcc97752be2da5cc9e82b7ab46aee5965b17c563af6e2d29850112c8eeac
-
Filesize
581KB
MD5c96519835579f06b6c96e3b1447787bb
SHA19f93fb9d95418b3e29383fe406eca321bd678115
SHA2563baeb6e73cc09f77981093b92f059748797285771e296cce2af7aa2239c42cf9
SHA51288a025334d3d493df67547cab87cdba2442818dbdf211935063a2146bb89add52da6a08262511304df7af8af6cedb36109cc064c305a1bfdd9ded2b682afdb56
-
Filesize
717KB
MD5dc6266a59eac81eb7f12b9a7cc81b1f0
SHA1246533650e5d10276ab5066e183964ebedfecc2f
SHA2565829122f6374778d199586a5cb8cab19eabaa7dfd8beee9ec437fef823214cfe
SHA5129f1cacc76dbe21223c241b696d685c47fed92bf4b699a8b4e369d2d52400a1c9ea4c9aa0b55d2857539f1615af1f8c2e4515d3168cb0aa646f5cac078224661a
-
Filesize
581KB
MD53a76f17f5ec6d39bd1abe58dfb1f0b71
SHA16b4b6b21af7fd4ac0265bd5aae066806faf1d7fd
SHA256263f7124807b4d9cab4a0a5fd1c3f295e6f5ada30485724226836711161eeef1
SHA5124e4334cfcbb3759b0e5f032a89ebfa12b548876b02756c89631e2ae2330d98228b0a2cadf14b2fa7d5a810b8acadb1d5df727a4c0b787f505ff7d1f5629d2b25
-
Filesize
581KB
MD543f19001dc67b74d46e3c01c4f24c794
SHA18d0bb57208c42b04360b08abd002b10e30f9b190
SHA2565ba49805a2f1543b050e798b9f9960c3d5c735d3a9e0033547fa1b5e2ff97183
SHA512ba875ae246468b6e352c271a0d2987a21f473ecf23d3647deb7b847f15e55837ccc244ace5bb63343dd55ec541c13863ba2e32a0bfa874a54e54425c3079a98f
-
Filesize
717KB
MD534df853c791eaca40e63a12de3893566
SHA1d2b84da9b900ef2d1f82aa6673afefc27ebbf98a
SHA25694bb8bdc86b65c9854a7333ee5ca6ff0943b2cd321f57fe1fd687af499073ae4
SHA512b0145d976e1515b7f05181c4ae23b0f99a94723f87418b63d582ea273db091d0aff3f654b35f6dc5d5b479976259e5bdf9eb5e8c48df1b3d28eb1dee66fa22ce
-
Filesize
841KB
MD56c5c193dacff34e054d9ad0f07bf995e
SHA18a176686bd49e3f52c3c96c38dd703c87f8f986d
SHA2566af15a5abb57f9a8c4ff72aa1528bd1cd096ece4e81e09c7c0b9f8013d552acf
SHA512c5518f1dd3c6a156ebc6ff52e02b6e3622126ddc0fd3a368ab60a2937acd2ab7472d1fc878fd1ae96d8cc8eda06b49ec0abe4dec584538c4ec134ef25592ebe4
-
Filesize
1020KB
MD556dd61b1055964b694e8491c321fa3f9
SHA16248796101e327b0333ee725e1ada91662d0a762
SHA256fc863330c43c63b73fa70f149f036ecc3cc1d35affdc9a116b52c7f88e1c48fd
SHA5123c440421597c385d32607b9f862c42118b75577e3d3f897a21a87c039133140c9b2c064903dff7f89fc5840c00c7a1bbb659fef335f641d0521a208c21d5f732
-
Filesize
581KB
MD56d70cb99b5cbbabc0fd0d0f6dcaa988b
SHA1e2a4b791709cac530db6742c48cc19fb2f16259a
SHA256faf9d60a95e6e7c828286aac4364204d11c506d7cfb6372cf30e1db97cef5dc0
SHA51227f8e57eec780f667a4693ae557f1fb94325b9d11824dcffc5fde06b9fc209880c0dde4dce5df036919c076fbd1ca62d485d09c720440c0608ff947df8ba5f2e
-
Filesize
581KB
MD5228e523e56c9ac3969ea9e03b9c32856
SHA1fe569847462145c40e2f35c2700fe82c80347186
SHA256ee2cf81e506ba60a8d3a82f776cbad6886b7f665e5d523fec815e8fd4d39f8be
SHA512bf970eb8a74ff614ff074fd55dbdc0f05393de84e61939479487a837ced6cc95b4b6953889bae86ddfaf710a4ada777ff7d9321bed25aba58d194904a3e356a8
-
Filesize
581KB
MD5a3d1a4ce98455da2e58c857246f0068e
SHA1f350e0e93ab219696ab442c92b108d36f3c981b8
SHA256b7e8e66c6e0b42272562d4d5fd31377913afd45bb1dc70a27fd9a74c187ae06c
SHA5126df7c87bfc6b2da8914a960134968d6f9b8e8644a1575ad3e97558f5d9dc80a37f779dc33ec14f90a5726bfce2a550406dfc069356bc41144587511a9de443e9
-
Filesize
581KB
MD56f42ac8bab0884c73e1136bacef5b3af
SHA1c5bc3f0b91a26fd90ca004d600e0ee9f03041327
SHA25619992c1f65309596f0ee936e77666867fa6d5cce79c13c86a791d8d9be913334
SHA5122dfa2f65fac785631b18b62b6fba2b4d319305e7cd68a8a7b4960c49bc71fbc55ebddc7d5e890f66dc7e0b0c1ae028c5465a26d4e51b72179407715aa8857a48
-
Filesize
581KB
MD5c57785a42f2e59c8d379b0a120bebaa4
SHA12e0a3f181fbc9753d8bc06a0ef315b8c4207493d
SHA2567090a6ec0dfd9eaacba2dd605deaafc940b3e31f60244e9579a1b614df5a935e
SHA5127c10ab817fcc73480858e9cc75a0448d0e54f2cfaa235cf793b5e440a6661acd2b5e7b25fb05c2e8415e867900da21f2a7258f0e959bd32024b676ce3b36affb
-
Filesize
581KB
MD5ee8ff59b61ecd9dd7560a5ec21506e2a
SHA1fd8012698a3cd7674d6e5775fc63c920b9d53d31
SHA256b0a3c79bf7d5f11ed321b1ee6a0873046d8e44201383e15723c53eec7ae74d2f
SHA512ddcf96bac1c6e8c20cf7bb0dcbd0d9f23846b2accd8aa02d26f9977be079f357397f68f1237eb20a99d6dc2567ad4e24d63b879d4a02294b527a3b32a14b04b5
-
Filesize
581KB
MD5ce8d1ac50055bc6b020cb40a52406999
SHA1e236f3dd0c94297107dfd7d6fb5cc67e24820546
SHA256fd1672876f6280fa0e0314afbd144386c256cb522382a53f65f2eed90c262afb
SHA512e803d98d9adf20d1b43292121d840ca1284cbbb1a1ca9716c0eac7a1159159f4b4c163e85e99291d98685d7181c8bebba759b45330c3b355ba3d3178a5d0dc67
-
Filesize
581KB
MD555031fa76e649c2bf0304183abfdddc4
SHA1b3a07a3f595eab6485a45796edc9d6f312ebbf0b
SHA2566582c2f286a451de97f5236623c09f8e32e16b4469c39c15668361f87077d84d
SHA5124d278f904f068ff45c6a96104484ae2e07be4f64ceebb8121a58e993ff5fbdf7a63e5948536bb0141d3783f1d66b4bb01abe5af4dd9bb0a4b8926f92fd5ba254
-
Filesize
581KB
MD58eb3301c5a817ce65cfc674afc8a447e
SHA104ec6a5897d4b3d387066001e66b518058d3d5d3
SHA25639f1385b88adb29e11f4f6fef05c1b2f17960574cb614de4af99375633a9843f
SHA51206bb7f3bcb6bf58887d64d6c82edc2bed9ea3f5870a9c9f1125cf5a7003eea5a3519abb4c50705ff987835f8086fc28dbae20b6461f422b6bbeca150649841e5
-
Filesize
581KB
MD5ff5ddc8dd92ba5bb61c8fe5746ec8c89
SHA10f8e756238627d4e5f4a821f1b119281c7fed311
SHA256cfe4eda27f4c653f9426e9879e47b042a19e4a640199a396d7a03d4865cc75d1
SHA5129d9318c0128c4dc0625ee7c88b8440ad4c5775a84fb77691dc42c1fb08012df2e8375ce04ad2af25f433596d1c6d063afb5fa060a77bb96587fab42dd0f79b86
-
Filesize
581KB
MD5bd53a1ed8e688f398aadcf84b33034f4
SHA1131b34bdc1146d389c6445f99f38dbe6450ff30c
SHA2560641020e7fdc4ab91a7bef583a3dcf6a0b6c5feab52c801b9f91f8403887b4c3
SHA51275a0735eca8126408b09a5f92a6894a03e4c79315bb213a0640dafb6e2346ccd12f049c8e2b84efd564bf185982e10023e85c0d2b6bfb2ad5e7d3e427ea0ce05
-
Filesize
581KB
MD5a18767c96686b8bc0058182a86b261f8
SHA18d6166586f6c31114d11f07093a19b3acd2c042b
SHA2567a927ca61979c0183b3ba6f79645c3133eec08b18cc0eecbb396a05cb34f0fcc
SHA512e5606ed46d851b91031aa32380cacfe97178ba96677ed97cfec90622fc1d1d8231a743233486058f56a553116c97024d5365154e2fcf13471a441188b0662fd0
-
Filesize
581KB
MD5153e3b43797324b1777acfe5b0510ee0
SHA161ed01bf5af18b880972259464fe12cfbf7744f0
SHA256b96d1e0cfd0a227b536e0b153ec2a5d4708ca83bf513077e1c4db3dbcc0698d9
SHA512809d49c9d91e146c6b7cd7bcbb8116dfa483dd39a73a2cbb537f766baf4ce6010a5e397fa94e84f3d4afb671dd9ecf133ea5a9c7338e4d4f279f59000ddb323c
-
Filesize
581KB
MD5d52c5d36a3540bdcc30f6363c2bdf07a
SHA13b7991f04f56c10066b5b2a15cacce836426e5b2
SHA256a8e7bc234f59c45489f809c41c9dd108d60b3fe39b733d82547675bdd4769666
SHA5129c538ac554aa6fcee91b535c21d9ecdd1becfc43b70139303b8fc1e989d0577fb912c090e4f875f0e2895a53804cfd7580f751c08c64782f1fbc8d28cc28dd7c
-
Filesize
581KB
MD50e2a89c535610b137f8a7aada382c274
SHA1e3d5e17e9f9ddc6fcbca1167b60851d110c2d9a7
SHA256054d89debcc14e64d914bb2a1dea5f03a91a22fe2943c5e83c88afe96238ca98
SHA5123b1697dc53013001481ece72eff83372a856bb9e85b034dbcf175173cd3e32489b966860c0890b083946d730e216b978a5d356b8ecabacc88abfd1923e493d4c
-
Filesize
581KB
MD5ddfac830f017b162bd57f026b340d6ce
SHA12475b515c889b27824ec12ec7c9531636b39a108
SHA2564a3c8d5cdcc880e4013e2186ea76da100dd063207c26c101912d1b310c803c2b
SHA5123f49b6b9e0c326c5a4b8b2c950a19c8caaf95f163ed14d2778380f77d9c4c0cf50a218e8784d9beab016c023c84d1970441ead1627f6cb8df98871e7fa8ac0d9
-
Filesize
581KB
MD5467e705049087dc298acfc10c79254e2
SHA13c377011119e39af98b78eb9684944ebbbd3747f
SHA256ea71d2abf3786b8808f5263fc1ef2a88eda9ba3b6325a54bea1e2236716ce101
SHA5125e0bf829cd54bee62411b40f96243688f25b974fb789819356ae6b8f6a63e59bd58d4e8e888273ebdd8f5f363cdd8f507ee7d04903a24d11e41d35c12d1fbe3c
-
Filesize
581KB
MD5e88ad42b5db207ff6ef1c6ae8c5802d1
SHA15ee71442f1e296ea798624fbc89c406da987e1e6
SHA256797475d1fe03bd5cf47d4a5eec738c580c94c1db499f96acecdbdbf90bd7aa5c
SHA512ff747617d6f6656fb04b09bd7de395cf1bd7275c84d1a21017b5faaf12c290798def8fa5513f3a9d9ba7130220a4ac8b2ea7e2a1413eb0a4a37534d19c665997
-
Filesize
581KB
MD5dcd5a435660be3dbe74211934628f060
SHA1d2ac4391c024a8dc835c977cab38137ccc965c4b
SHA2564de9a49a39f8839b970031a7ff1c72ca059759866afb2585389a06dcd6f43daf
SHA512538781fda8b0f79c443a1c214bb3ab0454701674a85c8a2bedb3f8a40f86b7eac2b93963adae03b2833a4b1209746304773c71c159358b15a9ff58aa8f74b869
-
Filesize
581KB
MD5c0a2ee6b35e779f2ef54a25a40bccc2a
SHA1b0b92aeedbc1fd47bd55b8c28d12f2349292e009
SHA256c0f34abc86b29f74ffb2fe3750f652bc9bac497fd90d3e35d9ef0bf30c05e853
SHA512bdf603696f139381a895e078735d60932061907f8a30e2abda53cc2bd9d5ca72b2669285996ef99c695c45d8ae3af7bca45aeea6391110271574207d149ad590
-
Filesize
581KB
MD5059b9cfc0707aa6d14213b505ddbfbb3
SHA1b952f197cb485a6e2ba044d6c82ae4bb46a49ccb
SHA256a3eead2ab0e3f562af8d111ceee65042d8630c664088d53b407c346194e4d035
SHA512403f3abc454007356fbea6e5d22e2e6b85987a315e47e5f02a7166925278e5a4ba78cc8fcad7ba6cd52b21721ff07636a91efe9cda903cac9c5095de81a1c8df
-
Filesize
581KB
MD5a79d0ee12d0e6a63aa1652cce8ff2581
SHA1c26e0e57491649bedfbd9825124718555d54851f
SHA256c4c905e2df036c30189aa1963ba3554d284e2654ac9721fc85738e843f152575
SHA5129fa0e78c1faac77b0f3fc37c620e1f07a76f2f277b9b71244830ea5db79ec989bf17fcf56a6ff9dedd8daaddfec431e19cd91f4a48beecb98e21500e0db7e8bc
-
Filesize
581KB
MD538d5316bd2b2d49d4de9b3aaab0091ac
SHA1625de00bff26a7b63f82bef5aea167c461bab410
SHA2563c11240b7f96fe2b88f2a0b10e6c1f6c92ab2ceaf0fe9cdec55fbc6970f22a4a
SHA512d445ec6e81c86db3b14046a5120b9ecdee8750d9196487613bc4023ffb688d30495f7db44e1281db0c2ed0e578e4e5dc945f4ffdb723bf7bb6ca85255b73ae97
-
Filesize
701KB
MD5b31a3efb3642e78022a20a05ab28df01
SHA1ecc7d892e6b24a18b263eed27201dd0a94da4fba
SHA256e73496e3c5a6184e4ba2a8cee5f8183e8975c7cbd56fb25b4ef7fdce23cf6a6c
SHA5122791cc7761a6fd9e7a251a2453e69fde60468542a6b350f96b29226d22a04a1811d4961896725b1490977ce8e52decadf9391fa0f3c83730fa4a4a08b92d88d2
-
Filesize
659KB
MD527f670b9ffc2ff9f63fc483daa0a4c75
SHA18d47d33d42a4cb9b7393099a7a127650cb848eca
SHA2566ab05c47fa4459aff5f3e839c9bef565047bb2feec90e32737567bdca7bf63ff
SHA512fa60d2a9d5f5d8169bf94ada471aa1aa05fc9b74b5ed92808754a1c46c08f361f10b976867d9e5f1e21302fe7bd4a41d3adf5dc61de7f0c53422d93c2c143448
-
Filesize
661KB
MD5d4a2ebc421fcad2434ff2ef55ebfcda7
SHA11eb0b6ae791696f919fe2c447037f784607c2d5a
SHA2564d8cf98eb3ba2637a4046d5ac41bcb51621364944a5dd9abb3fec412833b65e8
SHA51278c0e05f1eb9495881e423a3fbae937fab73348d749238e6619d340ad1f7a379e524d3c2b6f4d5077ea99fb59be9c0d015592ef1480970ca066baa23f085f43c
-
Filesize
1.3MB
MD5673dd78b0fd558f448b1f454eaa6730e
SHA1f80ac8ea01523cba8bedd4ffb2433ea6f29e2670
SHA256d4c5f8aedd28ab2330e8ce327c4f7f3830bca55cf2e8c7216ad201b07f4321b0
SHA512278284e7eb2de79e353c70b228d712548aa786609306764c14d3a4f3b3445d88fbd5f270844de0a821dde003d1fd577f88bda305789e68bbf26e9bc21200a8a7