Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11/05/2024, 08:55
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-11_4762f7293a36f4e1fc805fddbd2f0869_ryuk.exe
Resource
win7-20240215-en
General
-
Target
2024-05-11_4762f7293a36f4e1fc805fddbd2f0869_ryuk.exe
-
Size
2.2MB
-
MD5
4762f7293a36f4e1fc805fddbd2f0869
-
SHA1
90302ffe3015c19c9e505cf527e570a672b860e8
-
SHA256
5f512b00702df54cda63d0860cce025d1449d9e6661a50f8c4b7e802db5787d5
-
SHA512
344625beca42f8d770832128ce33c00dd09ef31f17604d7771eea529ec7cf7e69d5c741af88276a9c8665090c4ce899a1e5770776293ffce71e91eec71256cd8
-
SSDEEP
49152:zOOh3aN4kuLbegmtGKRVlbnXf9gPTTW7H1GXC:jU4ku/cttRVlbnP9WXW7H6C
Malware Config
Signatures
-
Executes dropped EXE 6 IoCs
pid Process 2932 alg.exe 1784 elevation_service.exe 2068 DiagnosticsHub.StandardCollector.Service.exe 3628 elevation_service.exe 1992 maintenanceservice.exe 232 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\System32\alg.exe 2024-05-11_4762f7293a36f4e1fc805fddbd2f0869_ryuk.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\3b8d716ec8648821.bin alg.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-05-11_4762f7293a36f4e1fc805fddbd2f0869_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-05-11_4762f7293a36f4e1fc805fddbd2f0869_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-05-11_4762f7293a36f4e1fc805fddbd2f0869_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_96109\javaw.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_96109\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe alg.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2068 DiagnosticsHub.StandardCollector.Service.exe 2068 DiagnosticsHub.StandardCollector.Service.exe 2068 DiagnosticsHub.StandardCollector.Service.exe 2068 DiagnosticsHub.StandardCollector.Service.exe 2068 DiagnosticsHub.StandardCollector.Service.exe 2068 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 660 Process not Found 660 Process not Found -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2672 2024-05-11_4762f7293a36f4e1fc805fddbd2f0869_ryuk.exe Token: SeDebugPrivilege 2932 alg.exe Token: SeDebugPrivilege 2932 alg.exe Token: SeDebugPrivilege 2932 alg.exe Token: SeDebugPrivilege 2068 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-11_4762f7293a36f4e1fc805fddbd2f0869_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-11_4762f7293a36f4e1fc805fddbd2f0869_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2672
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2932
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1784
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2068
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3628
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:1992
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:232
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5cbb5f2a5dde8cfc9a6ccebf7e08b852d
SHA15d1ffc1d96fae957b03a9ea24be7a69afe653580
SHA256cbacf64f7687cb6e5c4cfae7b3dc26876d23c2e81af214d87103309f1b44b7a4
SHA512be2714afe60eb507ded7d6aaa5bac730519fef3140de2b86415b04f52da649a2b7a5e04b72886216a7d755ca4541dfc6fff7177905bad63b2911dafad0df1ed6
-
Filesize
1.5MB
MD5063cb3310bbdce6453cdf1a48e2d1abc
SHA1d84d931e16199fdc1a27ee50ed72dd4af6080b44
SHA25691a5ca0c1c8e6dbf825fcb506f62d180ce66185b6d3325803690ed22ac7e5042
SHA5124b5416aff3250ec290c4600b8bd43e345bed55dc07e4c1f975bb5375cc1f63b646c77d309bf585b7001529cae04820c8ebf5d31548e15ad1b815c99794de559d
-
Filesize
1.8MB
MD5430777141614cd6d734cb97ec7725475
SHA18f4a3a0773c5001bf616959b2064f4b25b50b459
SHA256610f76ba006c9704ba32abe62e0519bb9f66726a226ab34cc44afb9116799388
SHA512ed976160a8295016dc05d033337ee81becf55c14598a66bf52c7aaec88bc866e38a77094f768834cd5ebd9894d7620ea9b7974d7a01a307eb479d99cb596b2ea
-
Filesize
1.5MB
MD5ba7e77cd9599e098ab065e0c57b53379
SHA1a6c3d071c70dfe9d9ef95667d758d52fdaa91d66
SHA256e536936e252a3f7f5558337cf74755310a1dcab647422a71c9250bf7c69d37a8
SHA51299ec5998276286de2763b3dbb1b6fa91620dd6d00ee2e1bb92c739ecd7403f1e3f8b7f7ec91aeaa295e20fe884771707323bb105705148d14760968956f1184d
-
Filesize
1.2MB
MD5c6c6edcaaa6d5534718c7988fe4e94fc
SHA1e0c646003317ce644f806e4c6fdc53f9aaef150e
SHA256ec260deb08c331b5d017b1a9b9e78306ca65194ef31405a58ccd1d275fc24beb
SHA512bcdc2ad5c62af8edba48bd0358f1dc4edf35729108ad52d6ad7cc2aa95bf4ceec047a85e2ef9dbb2287c48ec440083a14a2ebed01995912c18f7fe0189e4de2f
-
Filesize
1.3MB
MD518f35a8f2c4ffc8a86d871d09bff842f
SHA114de3dc19e28dd676374be92ba9e69c6b7a587c6
SHA256349b11b198a4c19f1aa34ff30f75e823c94a7338faff0cd27680ea2bb41c112c
SHA51278510acf8379a7d2b280445e4268ac5df6708964c97e61a3c05a85f3c734537a6ef4a48c06e2e97bc3cd35867ad55919ba30071d3093874072fa62b0e601ae31
-
Filesize
1.5MB
MD59d618f1c38fd4a86020f233e8e8bc2e5
SHA1818036f510602bf35ce5bcaeccdc63e5b0355dce
SHA25612bc906e89f514b1082f135e3f5c06f45387751d7448bbfcc7774b2c5a219df2
SHA51299ad472ada295f7f76a3d9850d105064f9bf9e2fbfd9ceade23ee19957d304c3d6b769a99f5ed42fc20aa8faae7e7bcac7ef3bb05ce69b693dc8ff7c025953dd
-
Filesize
4.6MB
MD5b0971cbebcf6c5395e8f353e27c1be66
SHA15b256332a19ffb9e984c6c7bc5e737e83d248d46
SHA256d9f4d869baa3a4a86391573e8a5fdfcf2f3f52fbcce1caf25ad99bc61db4b0a8
SHA512c59c9e428b006d8b80790a15dc633d2b3d20204ca696f67d2717ca5e392e6da09560ecdab796c20e4a608e137cc575f30dea756dd9fe0694bcc3837f02a7fc7d
-
Filesize
1.6MB
MD5968a208b7443df6b4585e392d6fbdd84
SHA1a1287649f3265e435ce3f0f8360bcba20eab0f5f
SHA2564a3f5afd14453aa300cf802f127bec96337dfb3b5daeb6b15e0125ff87489c6b
SHA51221ad9773af09f5728388dbe7cd2b2e74e5399b32c57101505cfa9fedb77ffd1f3eba133d4bb3ca7b57849a33d991785e0263a4f006972147176e02f6e47e0dda
-
Filesize
24.0MB
MD5257397e6ca8ba9944e737429da737b6b
SHA1b08a0cae27e33e1f08b5fa43ac762789a7d547d5
SHA256a01f94bdb09052434133190cff2c98183b7b5c8448fbeb5d928dd304d0e39b06
SHA512350bb3992590df1dedc04cbada75e15092a1271442c7e336a86652d92cb1eef4d908a2460056eb500df59db9145f94040f9587139b00394115d85cb99c057fb2
-
Filesize
2.7MB
MD52aa7e8640a2213b15ce996a4b5113bb1
SHA1b3f12dc01ebc365c19f45ffe9ec5d609b2ad3cde
SHA2562c17f17641a8d6c16983d521a16d583ad2b6f4b39ea1e77ee8960f9c0ea390fe
SHA5120998cfbae55d8287650a2de128d814a10d1169b61d414a71d9ce315ce38593875ee62772f29d29311b43b5216c87a09a988925c9e70e2a1837a35d8d473da441
-
Filesize
1.1MB
MD5a155785f1fe21b770d746aff85e908d2
SHA1fd898a64baa41452e6be27c5f2bf016f97e38779
SHA2564be98869c36be400960e7f35c9426d4cff64b86e80c5ada14577f2e68292a3ca
SHA51234951c579914e06b803d0840cff29b2c50c42ccc5b1098bc9b89afa8156597593abec9c0b72abbbbb3ccf784c651b757ee8be2dbbdc17ba2c740d61061335426
-
Filesize
1.5MB
MD558e4e50eb190681d39b204bfa4c9563c
SHA176aadf06a2cd6d90dd6d277ae1fb62004b8f4ac8
SHA256950c62d7799a60531f0c673e8b55944264b2f2a83ebb7d043001a58a3afafddd
SHA512589a9eb765182c44ff549ce41b9762acd11965fcd3d0db24c832dcd174863f923f2a95768a9e3904bc3923c12a1554a60fb51be8f8a99c278f5325d7c58547ae
-
Filesize
1.3MB
MD576475d972350e70a5a18dffee937441e
SHA186b0c265a12545977e92df1e7cb3a1314c050e52
SHA256aff439092417c83d04c7f47d84dc5eab08c0c1302fa7fdcf1b411d54d7cd9bf6
SHA51202a8919de9cabd39c054e19aab488bd8dba9cd841bf3637871d73c6daf19a204416005d47083fd7ae84f569946161bd51783c7fe2a53f20dd7626b4e796c19b5
-
Filesize
5.4MB
MD55d492060aaeecd265dc606ca44f58583
SHA1bc5837248fd3927fddcb07a74d78c61761db4114
SHA2561344ee41518548f426dab407d722bb5a715435a17fa6139ceebd5f063aecd002
SHA51292dece21e55edc8822c1be64946397147d1e239cb13aad81bd13f6f5357138a48a886cfbfbad8304264956e7e6b17f55b939c275cbe120ebbd35602d64f1fa8d
-
Filesize
5.4MB
MD5eb760714ef4b94d473ace6801629b17c
SHA12a0672d420d0848d0851a150487d07d5c606ccdf
SHA256143e1fcb8c5b84297f3e8881eb4781812349dc390a826291efd17a6ef8056518
SHA5127cdd89f154d934f19c7821e45d5df790aae1fd630a72c8b418e933ee6c2a58cc3edd1ff5379cd3d74b3804c8b08301ea331df11d75fe6e043ad3bdce6cea98c4
-
Filesize
2.0MB
MD51daab525cefe61819676c628fc6744fb
SHA1176294bd1ae7ba8111b3e70ae5f90183b2f40f6b
SHA256f7715d497d92cf9b1fad80ed25d2f3274f506502c2bd2605c131e61ba0991170
SHA5129304157d2d949e9579168d76f536c098689c844e19e63a018eacecc8955f15fa1a9b8844d5d63d1299b07cc5e8aee7108425f973040342b5d3554ed11748b58a
-
Filesize
2.2MB
MD55d66550094deb744a53ba8f8603062c1
SHA1acf660958bbd2a0d92e9269ee557023ceebfc1d7
SHA25679749a5b4ed8bbfaa7ed6afb64d3852838ae19900cde228fb29708c8fd7fdcc9
SHA512db6048bcf614f597c3e076beebda9b255f4315f99badf60d91feb4e60bc9d571462480f293e406016fbdbe6acf7dbe662715fb9bde0d58596cec05cc22027cf9
-
Filesize
1.8MB
MD544e4a58c676f56d6e40ed338a509a9eb
SHA1dc5e746a4e3f57c9b240df88881a793b25b4392a
SHA256fd3fc86c455bbb94a265fd8b7a47b67d22f2932d8d9bf8c333422eef9695c2d6
SHA512cb6fdc673269e33115d8bcf6b0d12d4998c8b2a9a64b4e48672abf386e4a2a95b0ca5911242ab95c7f2cbae6e3ee0cba39f23c4b5cbb1030704010b0a94f21fc
-
Filesize
1.7MB
MD528f605373c28119e34cf5f2f7e9ed028
SHA1e36300e36f1d128ed9dc55d1f50fb1ebe17fd739
SHA25628a0f4129d749bebb647f99ba33a3aaffe4e58bdb28f8812518fa9e59f71d68e
SHA512f94ae92baf88233c2fab8e4e8e99fa8d554511d3492ae8076fafec0566f5910b94ece91dd5bd684fd36851b4297defb062bd8c385208cb0e32f79c4a1ebb5ace
-
Filesize
1.3MB
MD58df29a9249d63db30833d236f3d3bbbc
SHA16846eaf66eab1cfa910361015449acb4d4a72072
SHA25634a37c2301589b14cdaf3788d056b3b70020dfcb3b38d185e9e647841432059a
SHA512bfb39923a94538e50426302849540548d21b34a969e1239f60bf1564962c80ebd14afd91014625ad5b8c12fdae343d9dc30207c793e988fbb0d9d61d5df6f655
-
Filesize
1.3MB
MD564c1bb2efa0c64825dac1a9df72f09ef
SHA14203c38649054d86635b9b82332736823834dd12
SHA256e05b5ec891b663dcfb3125e266b14412fba604b35b2d23124d19167a1cd4b5b2
SHA512bf43b83b99febfacc0b81827503261d2c67494a30e7f8df0444c515fd68aeadd121836b513fae6bf61096a2139f8150b931a726a8cd8614b2e2e8dd4a66664b8
-
Filesize
1.3MB
MD574f9d0cf5d069efb71eeaa5dba352889
SHA1d948baeb1916f735bfb9dcfbbec427f6ff857605
SHA2560a17672636083989bffe92c8fa7d54b659b2ca68729ee8187c8abbc981d94da2
SHA512e8c915154fd11f7b1184ffae9aa94a3fc9a1e055b89d0d439e2f0c58e9c4b3506a952d14ae746aad30e2a379217ea17a186913f3a60855eabecded3d3ecb9bb0
-
Filesize
1.3MB
MD5a8efa054161332fdbcd7926a9758e7ac
SHA13e8d22bd501472e2ad1204557d66667940d59492
SHA25665f0a5d591bda6985f57447737de307e98db8d6bf60c42010891bfb7f19d1e9b
SHA5121ceb314fb45db7d94b7baa1cf58d5bc7658adfdd506d3b83bb5ed265cc162e3ea5430b2cdb2f010276a5cbb68f9064502e18fc2d5189912ced3cb1c9ab02f46c
-
Filesize
1.3MB
MD54a04dd2f937a80084f4b850dc4adbfcc
SHA1e9c2d2658a24eb2da175c11e59468644283f9949
SHA2567cab4508bc7d8d6a60ca0d3e0cabb84cdadafa23e379b9dcf779419b0fbc4ebc
SHA5129551a5bfeebdb4c5c966c4b8a9819da0c93f7750d58181881e4e697ad6d147b4aa6709a7e6a7dacb4fb1409e6285bfa37dacb3e834263f90c490526fe90a4f9a
-
Filesize
1.3MB
MD564922f664b6da9f76e4dd733a774a584
SHA1c903e8ad7de2000b2878ecbf1dee66d6fc315064
SHA25612207a39d5900f8bc207b7f9f34f8ebb8eefa08de60faeb33b9a5e8196cf544c
SHA512bf787489dc44fc57f0b107cf7bde8704e59b34a18ed9d537a3adf287f18e2085b4ab7c3a2f97d9eabe2b7698cb302bbcfc189fcb3af9a0772da9fb9f04cfc587
-
Filesize
1.3MB
MD53bea2d2ebf1ecca8ae1f242775280463
SHA17413630d3e24bf15bc4b61bd5f95a3697c839786
SHA256f944ae9d523c0ff08b60271acc0fbd25e3cd7de6ee6132fd70c7108a5662213d
SHA512633903e3b391379899214cf7becf60826d57aaee2d307b0905b0ced9a86ec46d5baa215496a14bd4c3c6df454f3aa05de2f71b34740677716ac41dd55a44804d
-
Filesize
1.5MB
MD5aaa0732ded24d82fe6c57a7a89750f5d
SHA1616e101a9dab34cd852f4423dd60351dc53a0641
SHA2567cb654a4bc11bc20dcb813200a9acf004bd28cfb1f21ca5ba26d7afa395c6438
SHA512c59166af317771cbb7518d21c6f76a7746080b542a59acfc432b5d2bd0c51a54b2e865c39eb1901321f2037d9d82607ba76a67c9453d8bf9d0527ec8e0d51f45
-
Filesize
1.3MB
MD5fa1e5bf99b5fa46210a0a476597f62b6
SHA16ee60e53896c4f1814ebb3c4db59cff59d05d258
SHA256a4efcaf4787eef2014b2e36df073a5cacde1061deeef0ab5d5553d71a3f5df7b
SHA512ecb6e27cdd0f33d2045a41b09505e21837184000450fd29cd0458f7f6562e23550109958a5c99529c0f888ec138d4f09a9c4c1e4c5aa3bbf1ab7224743253e0d
-
Filesize
1.3MB
MD5aa51fbc7bdc5d96c4ee41bd108077854
SHA14c22a89436002c16e27c7e98c0090e51e27903f4
SHA256a2cda04f459545fcf61fb1501720f55d541604adbf1d02d49ba62c180b1bd58b
SHA5123c6f3eaf00b6bd9751bffa64b4dff98b401e911197539478f19a0c787bb017d97b33eecfad9665f9bd3904d8f9999ba596023b09951d9a4c433d71d4a0cebc16
-
Filesize
1.4MB
MD5df2a1d90f9f2115c704d22ec5f552379
SHA184bb9aa3a19c70ccee37283430ec38c1ed84c313
SHA25693b90f6b06fd15127d078e02cf0a7953498ed5a0c5af8accbe52bc1290741e4d
SHA512a94f745de40ccbafa03ebd71d4839ac0f27c910f3072525f5326bad13771128c955b8b71776c0d1b3a372068f09b221fce3e0a364865c75467c1d94a807252e9
-
Filesize
1.3MB
MD5978d5d0c8b551defe0856f5b68a82e22
SHA1e862dd0256346c89000d988098bb6f1167aba966
SHA256f1491e083438bfe7596d52e039c1a39fd6bb96a0000ff2b9268004978176eabf
SHA512252974446af4cd4d98d4e9c02e87bbf5eccfbc678612cda6c52b37c062f47796eff7cf581eaefcd2caaf53e028aa46d086f584e44334fc0f3ed304846895e27a
-
Filesize
1.3MB
MD50440cc60a809ee57dd6c05b8926daf2c
SHA18257843db93010ab562eac315baf83d5e5afe6fb
SHA2565338636cc359589db824ad9bf59f09819125991a9889a08a965b77a9bb3e5f10
SHA5124633bf1f170eb649a8385577a3db6dcb7b7449372110c6229050476934760dc63fb619e4096ecfce959e52f0cbb1b25acc3781c69698e4d5a3e2d252e18050e0
-
Filesize
1.4MB
MD5dd464701265d69651d2a81122ee4cfa7
SHA100d5534f55b0f4788fe04437e1488b8d8f5db06b
SHA2567dd2646b79675a41a711196ba1c4e9c9908e7eca97998618c7d3217efd86fe8b
SHA51275a7c7c729a8fd9557de0378f97e2eb024e173a8630f544c73ef92826ee3d0bb00fc2e3b6a1e10cac2194e18f5519e493a46cae206e1b7e90e89a83090a91f41
-
Filesize
1.5MB
MD574a0df3920c2ef130c8035b50bd5918c
SHA1626b425175239b805f99950d10f5ac6819c261d5
SHA256e182b01c64984684dedbca166a1707c24fa3cb1def292971c6dacd40ba3c3883
SHA512e95788f8af05b2e37e5da2b3e7d7ada8979df49ca0ecb32c3345b337aa10257aba1846081c1d206d38097a1df0e1f34cac0d93bb3a7609549a5fa8f86a771348
-
Filesize
1.7MB
MD5a14c72e3c58f81931cacdf08bbc478c6
SHA165595a6c3cbf42ce28e481e33abd6c22d04f137f
SHA2562162daef1b8c338775ec9a24c6b8e80cca15e7436c5c8b6085a8db5f996c0b71
SHA512bf13eb11890f83d4f062ddfb63c07ac7b88d62dcd7a3fb065cc59d1f4785bf01a01e15607b7f5af8ab23f5eec03e0a85eb751498a55cfb3caa3bf43a0cb97bb4
-
Filesize
1.3MB
MD5a751b56d08eea3dba2aca922f5acf19c
SHA14443afc4043ac680a5e5d06d85b6d8d3a4ea5607
SHA256aeb00049bfe9aacb58e182cb2d912615ca3aeb17ac1e0d4c51c3b5f0e55121b7
SHA51213eb92d9a923d9f1eebdc313e1ee2146b56ff22e9fe3105df82bbd0af804d0af5389acc45ed570efa56d144a1d02da5ca330b7c1cba3a6deacddf0f06fc64610
-
Filesize
1.3MB
MD5e2c1777552ccb809d2a5a6c44eceeb7e
SHA132b4305da5b28fa54f2ca24ecda01220d8aa74f7
SHA25674f51008c5330ee0021e92180082fd9a011f10f8184f393c727a3817b6921a26
SHA5127c79abd15518108bd76f7a48ac295b4883475150f79dcb29030940396da02ba196e441c118132c604cadb8e9453966342697ca0a39ccb8e0a332635c5bc5fe71
-
Filesize
1.3MB
MD5ce603bfcf172a2f720cc81c83a1bdc69
SHA1eb0c940c1d72d806b72df4922de6813fdb153d0b
SHA2567a81237b7e3e022bc246293ff15dd87f52cf54752f5787fd22fe33ed4d607a4a
SHA5124821b5b264668c31e0374d3c6a95293fcbbab06a14a0a7efbfe4ab175cbf2cc1138b893dbdc1ace266eb9d1138960b2991fa67d7f990ef804f4718407cc07609
-
Filesize
1.3MB
MD5573a8b35870f990b9148a21257974380
SHA1322003e2b82ce0015792a53c5901d1a62890b9d3
SHA256eb41cb07c0af6986ba4cd9692370f4c06d5bf7f3cbad63babe4df31958fc9273
SHA512af71a11ec0a7722ffebab99216af498ff9ad78f82c1a1f364b02c1469344fa2ede90ba0ef36e32626377d86b380697b1476509b5655ab087e82c54e81db850ec
-
Filesize
1.3MB
MD595f86f139b2f28ff26bca268daf2dbc7
SHA16f4e2522e12b9db8e74cf37a4f2c0f8c20d1f3ff
SHA25669a5cb2f544f18d4d7df1707888c66faf7ff5c98f09495928211e715f6512dd0
SHA5125f639f40a7db784ddcf6ddcc469921bd38d5974d7af4654a5d4ec4fa1bb2f7ad2f1246fd9451e80bcf3098a39233eb7cc9f02cf3bcd4c84ce9d80f0000414b0a
-
Filesize
1.3MB
MD5cf461d8aed846c66df7c0aa26a14a625
SHA1df3a1d814ef2f2e671ccf14b40cf738db683c084
SHA25600695152fc02e35bd2b8270f1da072adebe4dbb7777f236f092bf78b5b79efeb
SHA512752f417e055240d41ac1c422f9e2187a1ab46c3ef305bcf315814908178fdc48580959dc7ac197b54687696a49056d5779f18fe51325fe6b7dddf91ec6fa6e69
-
Filesize
1.3MB
MD5e1aeff07cffa5de375e2aab81e34226c
SHA11c415849c86b6e2e847aa0bcfc31bb6a88792429
SHA256a7393b86fb62751fb222453c6c1f547c0ed754221f1d54d75234c6b2bbbe125c
SHA5124e7303d035f405fd3b2228ebebd2cc94c7ba14368a150ea8817b56f534f69ba395110888cb3457439fa7684ce38d319d0ed65e89edf3f1014dcb0acf425914d3
-
Filesize
1.3MB
MD5ac5d1db71eb0554beeb26574845cca9a
SHA19ce20256889e95a278b8221a3c980775671d969a
SHA256faa90bfc59ba934bcc2649e2aa3b0474623839ddc0a64597e12e9cffda2ab06f
SHA512ee5d45ae6b213150850e76896ff1a556a80aff9cd5bcdffcd746e595b061d9a39987d83b6b3b2cd8d47c1fb55ea147d7f39f9eb686d0bd85f16ce2fc08bf56a1
-
Filesize
1.3MB
MD56d248060d159834845627c305235ce04
SHA1b25ecf17dc6f561b7ba9fc5009f36ae56c141b24
SHA256800ff663c91f06faf679db9ded87ee307dbf0024b79104bd5aea3b1fae987522
SHA512b5096910bace784d352bb3fc4f8abf72d88329d2111ff4cd823463fdde4981305509c542274ae6daa9e1f682fa09f913e9a91ba3f1d768d58c6f08c7c7d3a011
-
Filesize
1.3MB
MD5b19890e232b5b20cfdc95f545171234c
SHA1d95a1b034ae5a4ec314a7dec1cc07f22ac449691
SHA256ab82a710e9bcc35fd194de330b7c6bc536c2ce69cb4d35bbc65befea19085fdb
SHA512378306018cc159b934463cfe04859307cbb61bbdb6a657f9976f955a8e7de2ebedb300d32a6c3260afbf9233d934638d25b5a47ce1c349c7bf0ca4dea30db4ee
-
Filesize
1.3MB
MD5517d15e11b461a65a1ed036f49cbde04
SHA180962323aebad875d5dda13c9fc27dd19197654f
SHA25643efdc6fcdb04b516ae380ed736b20d6662289e0a0837436a12f0fbebe69bd8e
SHA51238fd715bf4ce268c87988472d06595dbc68c33b2402a46890bd9e06acd781b5bdb5a7ff9f082b1fefbad535cb86f40eeb169e21b4d7b682fb5df1c3ad66b29ca
-
Filesize
1.3MB
MD51dff4acf005aa8e31797d5f269980285
SHA1eaaff866b6e8b96f2e301a1f3c7e077e61ce78c8
SHA256ef58632d58695c604ef22c016d9259c892e2eb365bd0c3e34a5412d3e4191d0e
SHA512b69c57086bba12f48d0d495b67f2a4fefdfc1b6344437a45394e058c8bea35c006ca4dc19fc4ace0311704edb8e3c4e4ee406b82a7244c676a555e28d1428aac
-
Filesize
1.3MB
MD5c55dd2579f9951cbbb54b0d4688a5c15
SHA19c25ab0b0201200d3991ce691b09aec622c1b517
SHA2563eadb11611fc01ad0c0ca4c82a731fac61865b46857792915f91b020f85b1414
SHA51222f6388b98bca8d1ef6806c6731ff481743deb42472a9e80566a78fe3d24b8b30086ba7bcde769e94ba5030cfed93b68543f8ee24a2d514bc2c1efc0292ee1ae
-
Filesize
1.3MB
MD53da99d03b256fd6786d6ff6ca5239bd5
SHA14a259f750c27d8905e37cfcba13f39762949c7ab
SHA2567d6a5e62a8fb15dcc9c4dcb067be696d0f293a3ccbd2374cf936cd5fd3a7fb1f
SHA5126601c24807acf085a4a70a4e044bac27ac4b388c47e8eca28395324a9a9b46450ec59c821c5ac88a69f6b5d83fbc05bc9a784d40a8b647f48dd888c5a8c1d086
-
Filesize
1.3MB
MD5fee8357c493e69d21e1e9e2280ec6ea5
SHA1a8e77de8c22d0110709a024dd729c8428100eea4
SHA256581eb37383b28af50ab3afda6fc4776208689022df968b7d1dcca3e43405f5db
SHA51292d4b96b6bc95f7bac2fb6eb0ac15f857677299b4a4d1912cc05d4c9074fa0cc937f4abe6780bdab2b3b4db02b439787d9b525ce5768f7c82c1ac00dba590e12
-
Filesize
1.3MB
MD558b723b28c41a0f4ec2b1944fceb3e31
SHA1a8b7837cce0dab6c259da8fa6debd19ecc506be7
SHA2564bd9902afbbe8a1c3bda1ffb508fa6689399038e83e661b56a413ec7643442ce
SHA5123ef531950ddea2345ba874d0752c15436ee2f2300dc358e63fb2fd4b0932447905336e962a1909d84a706bd758134591595b0978f851dc0ec89d5c28be3bd063
-
Filesize
1.3MB
MD5d38daf14880d960101813023cb583a53
SHA101171ba623755eba8e73274c391155289df539a8
SHA25633c707353ec6828220e787ad95dd10c12aeb18c4465fa5ce1d1aebdff7a41600
SHA51231a684f42c973745578767e36adb40e957edd3d39fcfcb64d40870182e710b2b7b295074e77a549bc03d7b32e1557844338c149cadb87b80fe07f0d93ae3cc01
-
Filesize
1.3MB
MD560b8f2621f56712f1f36988936e618e9
SHA12dc78bc65af8a847dbc2c448b3a8c40219017552
SHA256e1fbcb15d90e532697a1496d80e1a3993f37de2a2641cf3e0482621606a5bf1e
SHA512fcae9729cb4eb909edf6312013d2d10b37a8b30fec6b6564ba5339a09d6eb9d6944a65c53fc0a87406b40031ada2f8c0d843364c101d4f9af6f337a678557550
-
Filesize
1.3MB
MD5a76ab3c5d93c1f843507097c37491c6a
SHA1bb0234b3d27cf2ff9f2c051008b3435108c0d110
SHA2562fce741623f5fd505c3024719ade6cb47436fdd8aae58aab6a71a7209c973a80
SHA512510faa1b82e4cb00e57db190efbb05972a3ba30e994a84ee22cd90d4984edc4ba568e13cdb2a6251ac39f91b9523bc81ade3cc3a0e3d445e53231781e2e97135
-
Filesize
1.3MB
MD56ad18216fedad7f421356ac346c5ee11
SHA1d4626a770253b219a7338c64f12b889289db9515
SHA256210aff6dc61d6a4439d0c900bfccf8d05e0e4eb54d32d571b4d5f8d1efb4f5e6
SHA51271e19645d334070e2a8ed2f6d07e1e613f223d3faddb79ae90516e52c9c77f3ce50f1ef66ba1598bc0084b8e4b01855aff482f74d87968c8262774755ad44936
-
Filesize
1.3MB
MD50ce48e59bbe8665d4a7a48dc2c3f3408
SHA119a59840f0b5500aa0e8cf2aee87e7cd0e4a7566
SHA25605f413488cf0a36923a73b7e7874d77e9b19b0b36523d36c2bce599b045a189e
SHA51239b2cc8e3466f0486acf716a2ed9cee53b19d1e71769ea5d53e7c34b8ba49b7f5280576bd711e2bf68f3a2a8fdec761fe2e6554ee0011ccd607cd275427fbd69
-
Filesize
1.3MB
MD52747016a79503234e6478050b4a0732e
SHA116f0c1a76cea388b93c78e001b8aa6a53d73937c
SHA256dd113106eb6e95c8b2b4c46b09e5b563a99100957705e6012bf1c78d254492a5
SHA5126fd51347783fa60f6a9edaa4c8bd3fa5e95c10be88c48dbd71010c82845246f13c7acbb7d8e4b599511e833ecae955eff6d0e8ff9a81f74e0da63f6118c7cdb0
-
Filesize
1.3MB
MD5c9004dc81f46a6e7c5a6f188e57ebcb4
SHA1032d3b44c648586d7dc90b839bc20df42430452c
SHA256c15a0c511d6504a95bb8a367d46d64c6af978a5cfef8b23ed5f24859e20495a3
SHA512c3dd4f21684e8c766da35b2623de06d71f398268f2a7047f9ab5650a47573837687d2b8e0922b0a58ce12050a7bcb1e397d849df872308359b7d583d2ec999ac
-
Filesize
1.4MB
MD5a9f79c0d212e2115cdc70b454057432c
SHA13fbfeab7f2e8edee12a0a63d1c9fe2124d97b6f8
SHA256385b76bf413696f6389c910ae89dcaac6bab4628dfdd3e8c79f5f85c1649109c
SHA512929a9c15a84b8a70d14f4e562c96987e313f9b0b2989756abab520aef0f73d2a609c9eb6cbc60484fdc00b08dc4d6b2eddcb1f346fb0c43512b041ee0212271e
-
Filesize
1.3MB
MD56a96736e3fcaf7cc98d22238c78aa637
SHA1f3645aaff5a91bfebe992c211bb0200a04a35450
SHA2566ea0bb79a235005dba7a04ef56d0103ee1c787b837b53c53fe31806b1af6154f
SHA5123eb96d3fb13eedf1b7514f24e81278cd9b58a4b0c55a14feac45cb1bc4deab418ac64bd1226835aa6bf61bd83598a7eca73fb14d7a08ecb9a5e8571ae204b56f
-
Filesize
1.3MB
MD5397280f5943bb4f19bed3707a8485d05
SHA1b790aa7a4c7d4c4187255cadca6b947d660401e0
SHA256054cf83f59d708ea55b8310c40d2b1590ad9b3fa6afd93bda7255ce65ed3751a
SHA512f0aef74d1fa7d1f46226c172a17af5481ebd26ad0f741bf796f14f45cc2064095be7b771be5abb1f610bc26005252dd5eb6552e98de9e05e785d7124397367c3
-
Filesize
1.3MB
MD57a97b8dd0b70604c4b48d329a738e68e
SHA10d6d1aebed722a761329d153a558bdd83958e5bc
SHA256fa82bbe602f3fe1aa802e067dec9186840a780053084670f12af32720f01c158
SHA512cc7ac4ff73df7f7d8e67aa862f6d584df85d3c909d65d67c23dd3d1dee51dddec8239a7d41e14a71f0412ef14939e7cd62f4640344f773e1429f6f17f43130bf