Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11-06-2024 10:34
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-11_def31512ee2d126813cd7c024886bc41_ryuk.exe
Resource
win7-20240221-en
General
-
Target
2024-06-11_def31512ee2d126813cd7c024886bc41_ryuk.exe
-
Size
2.2MB
-
MD5
def31512ee2d126813cd7c024886bc41
-
SHA1
9cb295e28d97732519eb428a47a36aa5851ea889
-
SHA256
778cc8fc9573d7c4369501c107e3b1d529fc9948bf88e08c859f21a7236dd7f1
-
SHA512
e93db561afb099a65405112a96be26528bdda01a4f613e49523bcd22a587e16cf342e5307bf56ab49dbf945451caed5c1f1ff49ca139ac0cfbebd34163983f38
-
SSDEEP
24576:TOObVw4TaN1wdkukCba4oXtgLhU3wEdmh58tsRjhm0Ijr/eax8JXO02q3A:TOOh3aN4kuLbegmtGCEjhMjSax84
Malware Config
Signatures
-
Executes dropped EXE 6 IoCs
pid Process 1208 alg.exe 3424 DiagnosticsHub.StandardCollector.Service.exe 3224 elevation_service.exe 2180 elevation_service.exe 5012 maintenanceservice.exe 3176 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\system32\dllhost.exe 2024-06-11_def31512ee2d126813cd7c024886bc41_ryuk.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-06-11_def31512ee2d126813cd7c024886bc41_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-06-11_def31512ee2d126813cd7c024886bc41_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-06-11_def31512ee2d126813cd7c024886bc41_ryuk.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\47bee47a1ed82f9f.bin alg.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe alg.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3424 DiagnosticsHub.StandardCollector.Service.exe 3424 DiagnosticsHub.StandardCollector.Service.exe 3424 DiagnosticsHub.StandardCollector.Service.exe 3424 DiagnosticsHub.StandardCollector.Service.exe 3424 DiagnosticsHub.StandardCollector.Service.exe 3424 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 656 Process not Found 656 Process not Found -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 5108 2024-06-11_def31512ee2d126813cd7c024886bc41_ryuk.exe Token: SeDebugPrivilege 1208 alg.exe Token: SeDebugPrivilege 1208 alg.exe Token: SeDebugPrivilege 1208 alg.exe Token: SeDebugPrivilege 3424 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_def31512ee2d126813cd7c024886bc41_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-11_def31512ee2d126813cd7c024886bc41_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:5108
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1208
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3424
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3224
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2180
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:5012
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:3176
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD524de7f441ffef152f7153594c4ef50f5
SHA13443ce91d2c0dff878155780141e1c23597a158c
SHA256dc5d47d863726e999a0e9c9c624ca6b1abb8779b88669282e4a9d9d0eae98d4f
SHA51236bd4335627a39f19ae0861a77ed13f2097057d3b0d3c1f3a8548613506f4e19b3d7afa705a9f40aadf1fb73bb72bed2842c3f4725cd1f23df146b9df0aeb50e
-
Filesize
1.7MB
MD5f765ab282135dad7a0e5a5905d6fcb53
SHA1e38d1adb98f87e6f5bdb3d483e41a8b236581dfe
SHA256bb8da94204aebc1e776ebf29082ee67bd93139975f58c0776b64ee6dd7417c30
SHA512e48a253922788048088fd45faafab9e6a2929ee1487ba726701f7f2855fa0aec4155d6407baee4649b66cb019b12a021e5734909ca11318bfe1ac910fa50d448
-
Filesize
2.0MB
MD5b669295ef73a993e07e4cce54f4c9096
SHA1eb8ab33b6eabd504f3b6f1f726aa04a63d5a7eba
SHA2566721b7b97632272bd6c6ae4966d83d1d9b68a4f7bb4d430bd362217f28ee3d82
SHA512c33866a7f79ab31499da8b7f0c5e257d353bda38c3ff4deac29188f35bbcac0f711b30792c550ec9aa1628a3b708ee8d3dcf9a2e0febda3514d353f9bcfc9cc9
-
Filesize
1.5MB
MD58998703609771457d3bb5450e6037519
SHA11826e75aacfe75394affc9fa2ab6fe6d1dd72ded
SHA256a4ba9ef58b5cd577c13e8776f0551abbac5b78178963714d37a8511f70ba7a74
SHA5124a2aba7d59a8f6bc71c4e865b3cd1e4a6a62231b9c95d0a6ab4e32f395bcec0326b6c43060e51248aa0c822fef02c9c8ab1d16b9d863472d499d110e8a1169d6
-
Filesize
1.2MB
MD5696d9425a61a3f7c54324a49a1e936f6
SHA1a6b95c12b1867ae5697780f70788719ba2a08d48
SHA256bc1037220a27ca9821fd45a2dde72edfc105e03b1a129cc24bbbc80cb42b1f34
SHA512b7d30b15d262f048c0a2486fdabc50627f9b54fcb3fce2f6d39af88ad3971b660883451f93d542b50268a883fbeb9ea1212feee0b50d45697131f8f78c92a5ce
-
Filesize
1.4MB
MD53a95b4295378e8dfe82946bd7d57c577
SHA17f5acb70f9faee6ee34c90f50be3a51f463ff85e
SHA256536851163cc32969990e107d10b1e6840ee2c50cd0707847c1b606cf4c66ab01
SHA512f7a8d773026e3360a4d95955a76de240e2eee485bdab8a528cad11e9a580a2adf903ac587c5b2849c537b1ffba0780297710061bc945ac5f08afc867d16cf290
-
Filesize
1.7MB
MD5a0674f00bcb6c6d8936315fa81c4a2ca
SHA1bf1ddaa56665bead5cc48be4d2a494457ed24ba5
SHA256726c721701d24ed902949dbedd6f6f416be0c6bdcb69b50fed0321202b641b30
SHA512422b4d802fec111f8533e7e8709d9bb9d1b048ce2e1dbbb53050db057bd573b1bb3cdf0e90fac8f795e8a502444b4649e3fd485af0e80c51c9dd3198cbc44950
-
Filesize
4.6MB
MD5d63d9388da3a647fca2a09c7b38389dc
SHA12dd035faa77093c3326ede11e9ea0651efcede82
SHA256f0a404ad415a6d660206941e4210180b53f08abbb087b74e5f21f74b54ca26db
SHA512fdd01880e54a670599c2ecb8b05e7ef193df68f52928743adb34e2914add0bd14d38f2c04892094950563dd7073b18e23f42c35a2b3a0fb3c90e41026e1e097a
-
Filesize
1.8MB
MD59d295170943e3c9b0d6bd5172981eaa0
SHA1ba40259b993c3175aac1aeb5385df6951ca20800
SHA2565df62800e3468e048378d581e0b46337ce1a99495c03053fcfe072d5166b0e5f
SHA51221e79d1ae8e8a2987011d9dd825e185b647d06d2cf6628002e2fd0c62b2206098696908c8088cbcf31616ea8d17920f1261640b879a4809c8cf5c64bedacd8f6
-
Filesize
24.0MB
MD535a40a315559df88e411fb83a7184e7e
SHA15c699ae55e22186ee35ed781b8a647c1ec5e67d4
SHA25605dc8c402695a1039e2822ba1a3bcfd8dc05869b98860c1fa9e1ad9cab977f5e
SHA51275352bdc099c04c34d841129d74593518d1c88d0d050b360744c8f21d0bfd0fa6fca8a78f03ca947ecf7b0c7a8ed72d2e3eb8a5d125b50ed0707efb5029212ef
-
Filesize
2.7MB
MD58358f5bdf59349398cf2a80cac488c35
SHA115d9859fcd6a96a564631b2fa4e1b8f31b6790f9
SHA25611df8dbbfdb3d4218796ce8c4a45eea1f54cb57900e21ad933dc91c6977c7e3c
SHA512591a77c48b845d88ed41ded4faed48615cd8ad2b931029a62923594c2d8c925979380cd003d5d7b08256e5c12808764c3d7da66094f42c2b8fdba51f19c90620
-
Filesize
1.1MB
MD5ab257c2060ebf88bb2d70d31ea27f446
SHA11b7d04c362d52b87af5502ff2dbc9f612ce1daa1
SHA25675897a4a8c365debd115d22398d63ac39351c59e185e91031491a1133e3cd2bc
SHA512536d8dc56f070608becaa117cab8428abec1e3c96bee63941aa9a07c578138bd0f205b31a0d54b1790d82b8b4eedac7da037f03cb6a5a9ed9c7e881054dbf7b8
-
Filesize
1.7MB
MD5c106d055e3e42ecaecfa41d956d07f96
SHA16531e4e53d5c9a50b55cf454d6f059985f80cc1e
SHA256f2a6dd603d2e50e26e0eba4b077f8a04a3b8107184b53e1a044cce7b4f7b6b96
SHA512394a0cea8ddd38fe0782b2763b6b0efb42f211bf562fee7b5b29bbdacffd530e07317ab2670e179b735aebfa48b7a38e3a6d193f2c9611f966dee9cdca1b180a
-
Filesize
1.5MB
MD5d3e837f0011735528384f6c35363e0d7
SHA18a0fc5fa570c96f8c654af3d95ee7f5fa083a98f
SHA25625158a7d39c0e20584ab85a1c89117847369c496e974f787d57a28cc8d84e9bb
SHA512bac928ed64a1b158f84ca28fd96fe4430ff811b6260020ab9188336e8be67d1af32c3797f415700106b13fa251561f7bdb5599ffe237e4a6ec0479c2c4328245
-
Filesize
5.4MB
MD525e7e29a4c87fb6ee7400f809329dda2
SHA1159265db3f2f6c75608ae8e50c132dc3e84d4d3a
SHA256a0432f2c77f6ef8fdd13526e162c40f63e0b928212791ec693a56ead956c9879
SHA51210e0d2b61b90d20dba2bdcef1ede7f58eb552081886088c75a32752eb9e635352cbb15063777dff20b441d31db58e62015fb07e98391c1d5d16d324ec3ee6dee
-
Filesize
5.4MB
MD5772161ab3d039d5797298b1989617fe7
SHA1470a2189bdf98ba064cc1d9d29b46c7d778221db
SHA256133b3b27ce8636a60b1d7f8a54c24158812e7bb19f2103303e4bf84a9d734998
SHA512693656187586b6f1128845a8d5cee7ceb97e757c818a19d3cdc33290da287ac73c0b8fc9f9000edcf287bb0815a87e24d5f147a6cbedf6ba6fb9ce2233bfeb7b
-
Filesize
2.0MB
MD5e864e02b19f3c06392ed1e79fdea422e
SHA176841f92789e1cb1ef9ef6d11c4764b32a127cc8
SHA2564d900c795e412d6941639ddf2f8e3c29010bba23de4699c6e9ea3b1c8d082607
SHA512b968e1cde8f43ab4fb2819c7c75945aca4ff0530f2bbd9ed2d4aedf9767744ad19a630bdbe3990a9fce53c07b6cdc3cf003928bb0d879bf55d459a4ad26000ab
-
Filesize
2.2MB
MD52607545fa70c62f39af01f94c508c57f
SHA1584a579a817d14f3351c9ea5c3fa1828a3611693
SHA25665e6c5d2cc44577984b3a9ef13ae04bdc0c36d3f51ff58110adb76f502f0f8c7
SHA51261c9421c765d28e444e42eac0a16cddba7b3147d2230ef0626390f1a8b6974d912127c869b62b35b1a3aef035188784f173f99c57a6c34d491d13faebf306f67
-
Filesize
1.8MB
MD5d6a57d246ef11635595b17ea9a5da992
SHA1c18e00785e465c982ef0f1887db197e092cdb16d
SHA256019af97c2c768d5904a723f19d2f2bf5652671c924cf7adb52d40ee856ff2cd8
SHA51228aaa981ddcb6f742490e420e4d47ae0fde6f2b753d9d41bb2b654a3b0db51955ef291a0f910f706549dc747e840e3e9cb973e66a21de6aabf464273a8d3777c
-
Filesize
1.7MB
MD51246376dcf829dd4041aa1ec81282b24
SHA1b937aa1fea7c8086ee1061e66da64195ea2f0d94
SHA25667d1fbc84185bbdfce2e7263a54302edcca5077716d7aec0161fdaa40a01ac57
SHA512377d3cbcf2ad406529b583a33250130b06656be11683ff8081adc3a221c66c41c4822b1ab9cb081f32cd97b8fd89e34f312d91658dcac8a6b79ad549abd3d7fd
-
Filesize
1.4MB
MD52c3b6b5eb828c83be898ef055e9b7264
SHA1df3d4de823cba3c9e259400caf238ad256e7e848
SHA256c515ff08e13079e7cbf66284cc5e4f54da233ff5ff0bc923e77364609fbeb6e1
SHA5125e4dca9cb7d0f404a5804d8c5bc3d557339cfcf429d3468b14d6648a8d1875bc3ac8020b7b2f101c42470574171db89fe36cdebbd880d47e2f9b1733d6ef514f
-
Filesize
1.4MB
MD55c11b28c30b552e004ebe9bd6e38d188
SHA157b06c5eb5c65d23d4706221d50272aa4931ba8c
SHA256ed3630d649def477abef5862ac03136a945ee32ab5e61e08a860aee34b999ec4
SHA51278ec04aba6b7791c18d7d7f1929a2eb6acc8e050662aa77a9a63ba94f65f3c1767f5156a2567774ebbbcb0393965316a2a3e6c91717ca355221142e8ca67ebdd
-
Filesize
1.4MB
MD53db3ee74725a3c4b1179357f646683d4
SHA19cf5bcd7deb41b4a26739b4519c85d8f302b2101
SHA2565c5d065099e187b839f60d62dd62383ae22677e8ce116afeb830b6044f7f8136
SHA5126cda804c6443b7446490d6d5ae49d965a6675d761f5828d5f5f6ed5de4dcb765a27b9c40448ee7671e1a41ee3f97122e53ae53c70bb68de3670d2da8d35c2ecb
-
Filesize
1.5MB
MD5edf824d6cb872545ec204b1bb705c8a6
SHA126813f83be690384968828fe87664b8b6cfa4fb2
SHA2566f384acfc0fdb460ed241926a02f5a0976a0d0d57029bce8f4fa7e6a387ce153
SHA5128dd8363bee3e7a5ac1abb049879991f3f807d08455282db15f9bcfb70f3193d33c12e9f4475f8d904087b859f30b924d687ad89a51a4197e3160d2abda1faabe
-
Filesize
1.4MB
MD56e15e217ab6ab0cd018f50392f85fff4
SHA1b9ea59be25a2b658194bb9ff6487830088ef394f
SHA256b8c6770fdcafc88bcedcc2f3f6ef6cf104aa0ad6254fbcdad61e31f086678428
SHA51297a44902a0e649cb88193e7bccc700b6dcc2135a749a69a48a9e297f41681c3d489723b8179cc1de1a55284584bb15a30090f82c8b78b1c8ed4c8c358303c360
-
Filesize
1.4MB
MD5c51c717159df4bdb2546e331504305c3
SHA1f91c0f3932b266a7c7cbc2a04096b9fbcf1d3499
SHA2565089b1c196a0a48dd042a42426457061b3ed6f21b7f0951c5fe00ea766e2cca7
SHA512b7f3ccc35048d10f877ee10ac70849f4f93b6a55d19ac3f8cc16f0a65d09ff6f46974dac75b50f6c9b6c351ccac64a714793649c53ecef89bf38528bd0f926d2
-
Filesize
1.4MB
MD58fd831233ee08465b0b459e7fb0d3e22
SHA199f91a1ebda017b872be20f1b5797664322bb63e
SHA25661ccc8dc5f1b0255bfefc5229815115a28e0a5a41c2ee8a88f30b32513afa76a
SHA51215155f486a1d928f31499a85dfcc4cfb7629b42ed6486ebeeafab47dd6619f4b91bbdc6176e22c6e3c058ab5da329f45dbc2fa8c880f484553d3f64b87ea421a
-
Filesize
1.7MB
MD59dbd0c6a9e8566072e51eefc54d75b2c
SHA11f6dd00e8baadece2992edc5ce0894e31c05202d
SHA256a8488bdc7ca5b5c4df59017ac4a798ad3a995099afc5a02f9e3d9c12835673f3
SHA5127c3232fa7cd01077d8017876148b4797eac3738a89b816921472949a1118e8ca6276e63c4f61432682e139076082b37e6ce530b4ad96060316c9f7859900f0c0
-
Filesize
1.4MB
MD5061088d70ce4a6f71b1029409bba9850
SHA13fefd942e4ab17cbb7c3ab0429106e6e7aac3275
SHA2560761cfecb1ad9ab355099ff1180923ffd9f57683fe0e80c37019b1c5bf481b19
SHA5125f2f3e80a70f247c7808cd2dd21f1b56f8d8677d90634ae8cabf76340289c3d96442e54aa44989135f82d54ce20c7e4b3e4826f63ee35ec8fd6bda214f599bf8
-
Filesize
1.4MB
MD57b60e02d2d32ec631da987d6ea911e62
SHA1ce286090aebe6dea883cbad33d89dce1e74b3269
SHA256b3f36f6c38fefc3feb0b3da884481c52856ba26c527dc1756f96d7ae8f39bd43
SHA51203cff5bb0705775caef5b3ae94ecd6e6aa32f2de11d85b7d0ec46499e848b50135289c271f008868116b3eb9462369078c97afcfc9159cfe720068447de7d9ef
-
Filesize
1.6MB
MD51bebc66f5018ae3ec420184a3a4a9972
SHA1cdf9f9d5240894440238c87c78b1f25d18e8c8d0
SHA2560050af64c4e4ccb2db82408d02c17fc6278234b53061705d3a1af761609c1086
SHA512775e518fc2b18a6f6dcc40a5a46b4cc92c4e15d3834edc3a9368815f1ba8f4394ececc8f9123e6ecd527ad9acd2e9f8af36bd9e4a4bd6e78688c7c4b89dd3ea8
-
Filesize
1.4MB
MD535950ec8823deb2554080af0976d2f57
SHA1a14009d2ee37bd39c7b4cf4bb08b0cb2e673184f
SHA2563cd7d70505a29c3dcd92076be5f3b280fa4fef21023697bf9cda4276ca09d469
SHA512311b28009b6a483947b7ce30dd334bde992bb3de71340dfd135800abd30aa869287fe258f03fe97f63899064c5288c21e0b6d22d6b5d329c87517ffc28cf85e3
-
Filesize
1.4MB
MD56894b226fd8ea4d3e631bf6ab512bece
SHA1ecbf013d6aff15fc87961d73939255d1c9efb30d
SHA256b80f2167fef21e6d8dbfd4344dc5de9e5e8e6a72836f0be2ea3921b29c918a73
SHA512e325a4d3e7cfa47b02bc3c9b1f2d3f79567f83366688421e85c91125dd3473a4c7525b04a41e909a4595c413e55f91395dba596defb75cee27c38e654713b821
-
Filesize
1.6MB
MD50eb3efca8a170909da91a07bf19d6c8a
SHA109b1cbdb48b363d037ef12ad07bdaad5897421fb
SHA256e8d82d952ee566a8116b9880ba8c85280e749f770c872f02d43cadba71a05c35
SHA5125d7d83b3f0eee21c2f20d50e3f3fc64767ab61ead02fa55ea557ec29d80b13c878b0633ab4d4e025c0195e2c2df65f9f053900999ba81f4d7ba80e1266dee781
-
Filesize
1.7MB
MD51686aab33d6ea9c0ec5a0285ab6593cb
SHA1423b4db621b6919c840054edf7784f824c02d834
SHA256593c10967f23d5fc963b246eed233a37b1468632695d2c9076c9e7761b73a84e
SHA5122521af4ac5101928f2a7b7d6ab02c63b91da4c9822610171ca147c47371c65ae5cd0c9528811c02504735755bc28c7606d294d7b69387c5861ec0bd355826538
-
Filesize
1.9MB
MD5940296c223b5503095a41c268ec05211
SHA13f64f7c09db2969075b4eb8c92fa6714ff685cec
SHA256ce15fe93a704f6991b8c304114273b2e410461f98eb939aa6bbb055210467491
SHA5120b46e3cea07ded54427735b92681520e6510366ba0ec385d2ed7fc39454d9c195f2cbf0cf8b4db35ed6160aa6fcb00290df40faeb7db31078c45e6a0c6a4d76d
-
Filesize
1.4MB
MD5946c65ff4dd0a9884f5bbca8e54aa4a3
SHA181a6e97a3035790806c88ffbb907a8451f0c882a
SHA2565a09acb07cb63c5ab1ea8ce6a91894aed0d2b6a10ef59ca801b11ede687ac5cf
SHA5121c3286aafa24523a0d31d649471a4eb27ff2224095000c5817561a4a883a7e4a061864808942987142193c61fecccc5ee6676fe77ed2d23223c0b6000d83e37f
-
Filesize
1.4MB
MD5f1e586c8181a62ba6edb3743f54e95a6
SHA1100f458fac4fc4ef0662a16a89169649105c611c
SHA2563e7e696ab32b2c1603bb55ab159aed994e50b81f3430e3cfcd1740d2e2c43799
SHA5124795dd7a0efeca3ed225a068db4d1e312bd88a6cee1a5888dfc36bfec05a8878a277008e4dbe486e2c9a3cc5596d982f92e0a4f59c1fc094b7879ff7fcc637e4
-
Filesize
1.4MB
MD52c874107efbe1a4443b97598c9d4e4f1
SHA16b3499d97c31f60bb57038fee44233098135bb6f
SHA2565124d3c91af5a61ec53175a9d4fe524167c2f0e9e11be9d53a5d32dcc8e68a8c
SHA512f5e819b241f183cb758ee80ac435f1905f9a9fc61aff4b72d42e87ad4eb80fc493380522b317ab6c9a1c29987e307dae84ef854579df31a3b2929dca3d5b2570
-
Filesize
1.4MB
MD59659f42c7466a0e2c6a0b1fd6546b5bf
SHA1a2ad634b24fb7e09d14514533a0ca79015d3c3bf
SHA2563078554a307279f5506ffc50e5b2d9ecf74ecadc4538887befaf0b6eb0cc2145
SHA5127034a4253045ce31eb145fdde6e9762f51d58b28472495bb0ef926c322ae110a6c817905eb27a563feb16d769a0bbe23520f6e2bdced001a0dbf80e03b436e8a
-
Filesize
1.4MB
MD59b84b163b5e576e6bb1b4710bb9679a9
SHA17ae054d310f5abf547be983b7a219e3775efed43
SHA256ed112f117100e9913fb2b051551cfdbeec754e49b0e2b9a21a54a8a9b4d78a84
SHA51228ed01e50a973e07174bba369741f94ad989878b4b7f7c6779b43690756c3016fad4e275a73037b47f4a216a0c56967180b9ece58f1f662240160d6185cf546a
-
Filesize
1.4MB
MD568a00b5fe1c7fc963e17406615fc4abe
SHA149c3673de42c4a22efcf4c7891f794f53da75e42
SHA256a5ea0d0c890024a4d8be618453490af2f0908c1fb3cb7c96eb995a51cf0823eb
SHA512f1de483dc1a1a6e9e912bb641d3014ff27a7a992da83a3e58076255e25699cfd1e2bb7d4eeec803c64c5f480b2214a19b06447056b62b5619e2a83927c7fca98
-
Filesize
1.4MB
MD5a13820c65466fd4dd553ae329ceac528
SHA174d0cf9275c806f322adcf096f9b7aa556a9a486
SHA256b9ddcb26de1ad3fbe2960201c89aed6b6cb6e0b55d6710cf13b5b90d508e1484
SHA512278b1942e641940466f23380701fe06cef5ff2461a995ccb8cfd39d1659753c3ba630385c351dc83e887321d37ea6f2f02485374d0ae07a54fb8fc6514a0dcbb
-
Filesize
1.4MB
MD5abfb128f76b915579cf28869584140e3
SHA1ae1ff3a17678d02e49b623533917207a3b7c8312
SHA256286d96c90c8ebecd6923cd5147ae6b332ed5d56280f26b94cc63fbadbaa75b9d
SHA5125b1da16718c18ac8323e25d21ec8ebe57a68a3ea8734da6a8803d84a065983d4d174a5ded758119d9070459f633faa2e2ce225b7ac712d7f4800b26543ff3b66
-
Filesize
1.4MB
MD509603969420d29e051a5f5c2b8343f71
SHA1b60d8f29c49bf7413748cd9a7516b71c25b68f1d
SHA2560e440af829e954b960bf7abbba2f5478e1b0b27a625952cc07ffcd4ea49931c6
SHA5120abc03438422fba650685988fc07d670a29f0756ac0b2dd10b744b7737dadcee4f63efb73e4bd6c4dd868847234125acf9ace087e4b15d6903f969504705a9bf
-
Filesize
1.4MB
MD5bd7207da219ec6d012e627e9958060f5
SHA16ac8ed21cb783f22ead355f763eb7bd93fc8668d
SHA256acf066d32e66afecbc6c1845b3a000da49cb3c3f1ce47b8a802f6513c14a36c2
SHA5123dc3a4682342c75566e9c8737670373ff041c3fc068d4bea893688c17645d9f983e35ab6daf948bac9205249a5e83e38111092c74a57a4e31dcb500d7e43ad1f
-
Filesize
1.4MB
MD5ea51e469e6f16c9d26546df31d8d7c17
SHA1b7c843f6f794b2862d9cfb15881f4c2b6c470313
SHA25631d98b185f06c1a5e0495ffab013ec951019d20e919f82170637a9db7e5f5b1a
SHA512635f750d2754fa0821ed96043b9edc9ca6ec4625f6fb2ae10d5c744e182bdbb4dcbf8b8a6681e057fcaa074867424f34deb47353f5975a14d517e9c57b667120
-
Filesize
1.4MB
MD54384a8fb25f0d652c03ff729fae8c5f7
SHA131e1008a8ec6d23c127ccac6ed84c77e65c87c9f
SHA256dc24de2f08d63a4a50660e11dbaf2986b6d1a513b8771ec81b9c3b17ce5dc962
SHA512c627f4d8e90dced6a736a39b9f626d43b02b735e9ba412b4c2b170b46bd443052c10576e0aa081dde93090815aff9fea488fce60e371cec6b98c4ec045026af1
-
Filesize
1.4MB
MD5890271cfd82d18377b39e593822ca44b
SHA14b3f7396e14e0bd690dc825edd1e3a4b331d13a8
SHA2567f68a96f5cdbcf36e09d975d05693c17593ae8e63985d80579bf635317c669a6
SHA51299c44cb32f7593f4126ec483bd923237b46f2775c3b2ff340c2513c4f7af6035ad4488f4d3559596dc39d9feac3957638a1ad53bfe2179b112f0164683ccc5fd
-
Filesize
1.4MB
MD5f8a852fdbf428269ab717cdcd2e080e2
SHA15e22feb3c4fa5982051ec4cbf71a71ae4f6c96b5
SHA2567a3f0ed42e049eb740a547309c3acf0eaf0bcc564b7b0a82128d0bf3a72c6378
SHA512e304001cad5b5eaa6105947ebb8af8e892ef2cd6edd546914b4dc07a49763fc8431ca0282707c734dda527598d5c34526881f59a3b4934545ea3e27a06fdadd4
-
Filesize
1.4MB
MD56f4e8459f972ff26fe91aca470e423c0
SHA1025a807c6e3fa56cccc4e09158cf1935636d872e
SHA256fc71634a9581be8e7f000d468978f10b69c3d4fbaac97d0b90b106f2b09881e3
SHA51271a9d5c1a44c62f467f681888546bb950ee5b21e24da4fdf7f9396f22b3edcb03f6c28d916df298c4263893bb556f8f693ec3d31186142c2b8f9b4c8d036f0f5
-
Filesize
1.4MB
MD5cfb6166b487eea26cbff446e0c9b924b
SHA13ee4de07abece95cdf0aacc08baaf53a0315a588
SHA256687d3ed4d972a544e35221c134fa56beb5e7e25a9649ffdd576ad7e2da86e277
SHA5127ffcca6bf06e834122b12516e796bdc20d4b064645187014099500b8282209915d5edc0cca6f720ecc9ad52f1600c71db723d222580815f8cf98958fce752338
-
Filesize
1.4MB
MD59b45a9e5b77f3700c82aeb4dfe57c1d2
SHA193f7b8080f0f602715e00367bf713a2d05042c2c
SHA2567af9bd4fd094e509ef67dc9a12dc4c2d8e2cb9637df4645de9f5dbfd08e8d1f0
SHA5124672ef05371b020928c6c5445c70193cb5e7d6ffd543063e9db132b659f82046c7f9220f0d011bd185d8c0ce528c90d5a8989a0388380893d5b66cafdd44fe45
-
Filesize
1.4MB
MD508447eb6935d0afb01e5e328493812ad
SHA183f35a2c1a1bb0dbe90e8dd3fd81b62e759eb50d
SHA256d494fa263583eb34fe4c5506c576936772549ddbf22b6369e01877916bb54d6e
SHA512a8a958a0ac6071542157049776754c30a010d7d6918375f312777b359c43c5646963304edc7e3110ed87ce1dbf0e7b5f92b426659525e85bef4836d36558477f
-
Filesize
1.4MB
MD584d705bacce701a36355a62558d596cf
SHA102d5ca67c782a8bb867f733941f4469e405be527
SHA25658d060323ea1604476b8e88645cb88cb1d725e77e864061a79d484a014d22db5
SHA512e913f1b9ee7c214d3ab8b0c1fce3950a23e55956bd5bd5d2119096172783fa577b63af983afb95d33a1af303e8f30977763abb515eeddfcc0198ceac55628387
-
Filesize
1.4MB
MD54245a22a1661ca66c53d3bc11f8ccf65
SHA183c1f767377cf4869efce513e522d8a457f0365c
SHA256d5ee144844986b60d27be1f78cad7f0270024f5386148829112e922afa157d7d
SHA51239e36ee99c7374e1e3b5191cb96e4cd7936a6d14ce882f711a8b5830e84ae1a9912a3c9a69c72b8666c160afbcc76a83e70b5cc85fcbc89db8417e3ece7280cc
-
Filesize
1.4MB
MD55bb25aaed2c0dc28bab3a356b2311f1a
SHA164dca69fded0448f88f81df62367009028572dc8
SHA256e320a0145e60c8fcc6ab33e1e7908209f4cfdf7d0bb81e0d2fad60e822ba8604
SHA512d25a4f85342177397910e64e64019d30df73288a188fbb0a6f81169772a92fc29ac5299fb7b17256a7324926906951827af4fccece3b837eb35c65877abd3218
-
Filesize
1.4MB
MD5f285d234e04b5325595107d1ce93aa1a
SHA1ef825cb0cb144ae863ddb1617c3363995b4e52f0
SHA256fa6d01098d5d2c6f547ccf92a17ad10834ad5d6b4f4d27690f12384dd5883284
SHA51280baab6b158f8f701e20957d8a4dd918a1687e84d4a37cff4e2c75e93cecbd104719047fdaf130c5fd36ba9b8bdfa1fadcbe910af68358a8cd8727c9a7735148
-
Filesize
1.4MB
MD53995f36f88dc81ff1bfddece03ab73fe
SHA1b05084ec42a9fbef49254b346c05586041e7ff16
SHA2565164bf46182b624e3b35def71945b38c9d1dbbd9d94091b68e42d212e62f8743
SHA51243bec5b79e3a32b4c10ee0ca34ddb762a28e0b5b0d1829d6cf2ec899427fbebcfd524451407d040c61280a649e73f244a301405885db0b7c24ff44517d11e44d
-
Filesize
1.6MB
MD520ec6fd4efdeb673895c295ed7eb5a61
SHA16478b130f024dd8ac8f76b5a62427c16957684ff
SHA256c6d50a25ab6643d04c885e04e151da8fae546f28405da13a3d36fbb2bd54bf3f
SHA5121f554b7e321a383ff6e4da010b58af35a48a6e47711d563a681b0e25ed57aa8df3302acd73ee015e2969fba6245b9a7920afa9eac0fef88d57e347f7c1301394
-
Filesize
1.5MB
MD5f49a90c5f172f93aa28c98acdd921eda
SHA187e2a7c0e66b439d98a07eb5b6e54edaabee9a84
SHA256d1c1fb51fb10a05a0020808098dcfa7edd83bd1f2968da579f4d7d975fcc555c
SHA512972e76eaaaddaa8d604c22025eca94d2624ecd8edb864f943d88c289ab9f55275702de71bc058748d8718e6e89f1f8bd892594322fb95620bb9282b3edcc17bc
-
Filesize
1.5MB
MD59263bd8afa5c94c6b0d9523c27c5769f
SHA133c902abc50d97f1644e416fba97f924e3f7c629
SHA25660080803553c8cbb6afb6b493c53cfe690fbb9d2df1ceaabc4201e2f4bcc4c16
SHA5125e3c7614acc18194037d68740b46fe2ae8a232a55e3f0d263234c14a448886abd112418180173a640cc97e2bcca42ef99488f464e1be3ce16d3dece88a1e61a7
-
Filesize
1.3MB
MD5a38b02f379a8ea1304ee82d404ad46a0
SHA17ccb8a97c10d781eaaef9d08f62741a41009c5e1
SHA256c70a0a9fea99d8557f9e56d1d87c0aee28fc527c7c4da1191358278e795d5436
SHA512e0b9169138d30220599ec49c583a15a289a188fe58b5d0c6ccedf4c62e21d75ca9d7570ea3fd17ce66cd62ef84f6d6171b284bae0cd324cf98c749720c30cd5c