Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows10_x64 -
resource
win10 -
submitted
27-10-2020 14:04
Static task
static1
Behavioral task
behavioral1
Sample
92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe
Resource
win7
Behavioral task
behavioral2
Sample
92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe
Resource
win10
General
-
Target
92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe
-
Size
353KB
-
MD5
1737388ce8b0b5fc2dbc22f5b7352b7c
-
SHA1
e62135254b3a51f0180e70a11e4c3ad4a59f81c4
-
SHA256
92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed
-
SHA512
e47d6fe5049e3019dfb1161bfaf7038171dad39c657200c115cbc26f2be46ead92319e20e5e77e0e91ad93d17562090dda75efc5fb5fb22bef1d47df2aef657b
Malware Config
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Modifies file permissions 1 TTPs 2 IoCs
Processes:
icacls.exeicacls.exepid process 3040 icacls.exe 4268 icacls.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 1 IoCs
Processes:
92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exedescription ioc process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exepid process 4696 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe -
Drops file in Program Files directory 5222 IoCs
Processes:
92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exedescription ioc process File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\PlatformCapabilities\CommonCapabilities.json 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\vreg\excelmui.msi.16.en-us.vreg.dat 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\win7Handle.png 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-application-views.xml 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\TellMeExcel.nrr 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ul-phn.xrm-ms 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\RyukReadMe.html 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\RyukReadMe.html 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-pl.xrm-ms 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ppd.xrm-ms 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MEDIA\CHIMES.WAV 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\hi\RyukReadMe.html 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\deploy\messages_es.properties 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.proofing.msi.16.en-us.xml 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ppd.xrm-ms 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\Office.en-us\BRANDING.XML 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ECHO\THMBNAIL.PNG 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MINSBPROXY.DLL 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\locale\org-openide-util-lookup_ja.jar 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-ul-phn.xrm-ms 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ul.xrm-ms 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\EssentialReport.dotx 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\nb-NO\RyukReadMe.html 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Grace-ul-oob.xrm-ms 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-pl.xrm-ms 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-180.png 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\office.core.operational.js 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\en\SpreadsheetCompare_col.hxc 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\feature.xml 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ul-phn.xrm-ms 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART14.BDR 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SAMPLES\RyukReadMe.html 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\1033\VBLR6.CHM 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\feature.xml 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\ATPVBAEN.XLAM 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-140.png 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTrial-ppd.xrm-ms 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\shaded.dotx 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONDIRECTX.DLL 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue Warm.xml 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.wordmui.msi.16.en-us.xml 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ul-phn.xrm-ms 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BREEZE\PREVIEW.GIF 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\VVIEWDWG.DLL 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\Sybase.xsl 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\RyukReadMe.html 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.app_1.0.300.v20140228-1829.jar 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-pl.xrm-ms 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\de\msipc.dll.mui 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-openide-windows.xml 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOARIACAPI.DLL 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-US\TabTip.exe.mui 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.databinding.property.nl_ja_4.4.0.v20140623020002.jar 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector.nl_zh_4.4.0.v20140623020002.jar 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\RyukReadMe.html 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-ul-oob.xrm-ms 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\vlc.mo 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Grace-ppd.xrm-ms 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ul.xrm-ms 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN090.XML 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\RyukReadMe.html 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exepid process 4696 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe 4696 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exedescription pid process target process PID 4696 wrote to memory of 3040 4696 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe icacls.exe PID 4696 wrote to memory of 3040 4696 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe icacls.exe PID 4696 wrote to memory of 3040 4696 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe icacls.exe PID 4696 wrote to memory of 4268 4696 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe icacls.exe PID 4696 wrote to memory of 4268 4696 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe icacls.exe PID 4696 wrote to memory of 4268 4696 92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe icacls.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe"C:\Users\Admin\AppData\Local\Temp\92f124ea5217f3fe5cbab1c37a961df0437d5a9cbde1af268c60c4b3194b80ed.bin.exe"1⤵
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Windows\SysWOW64\icacls.exeicacls "C:\*" /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
PID:3040 -
C:\Windows\SysWOW64\icacls.exeicacls "D:\*" /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
PID:4268
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
aad27a2b7aafd7847fa58ddbf07a2d25
SHA15a367ec3a44b5c079d80e414555675e316947d28
SHA256317a5d236c321ec9dc865b7a3de107bc160388e0b76102d9067830618f4b942d
SHA51252856b0a4f2ee114c19cccd110355e26dfe22c6366f9d755b18d98cac33f1a84ca56aba177fa105a1ae6cf46c11e2a738eacb389f9c1ad3271d61204cb1b0cf3
-
MD5
aad27a2b7aafd7847fa58ddbf07a2d25
SHA15a367ec3a44b5c079d80e414555675e316947d28
SHA256317a5d236c321ec9dc865b7a3de107bc160388e0b76102d9067830618f4b942d
SHA51252856b0a4f2ee114c19cccd110355e26dfe22c6366f9d755b18d98cac33f1a84ca56aba177fa105a1ae6cf46c11e2a738eacb389f9c1ad3271d61204cb1b0cf3
-
MD5
c79b0d65672cc56bb87d6d9052e4df91
SHA1a96f56cfea822ba59bfb031ab4e46aebe947558d
SHA256c3a49e5afa631d4a6ddf816e3b51e3fb9a7b9099c01b4b030617d367ed71627d
SHA5125ff83d73206cfafb46b278e1392bf59e36b378373fee58ed58013ac3e0018e7d6548c84c5b6d8b306da1d820c303cf21963c2a5591b2d0b5d04cd348b165bfc4
-
MD5
7893043f63da9d91445b6278b8922a92
SHA149ef8a9fd2fdf14a46ae3ee43b901f485bcf9a07
SHA256ce7370e66309de12243d72ccab534879e279b157e03c1973c5473bcbdde2ba3b
SHA51224e49a8ac6145d4dd21c718d1af905e54443ab3816307d685950ad8058621f67edb1ea3dde85842be9fe205bebaf17d17afa07768da6c7cad624a87db1016f85
-
MD5
aad27a2b7aafd7847fa58ddbf07a2d25
SHA15a367ec3a44b5c079d80e414555675e316947d28
SHA256317a5d236c321ec9dc865b7a3de107bc160388e0b76102d9067830618f4b942d
SHA51252856b0a4f2ee114c19cccd110355e26dfe22c6366f9d755b18d98cac33f1a84ca56aba177fa105a1ae6cf46c11e2a738eacb389f9c1ad3271d61204cb1b0cf3
-
MD5
aad27a2b7aafd7847fa58ddbf07a2d25
SHA15a367ec3a44b5c079d80e414555675e316947d28
SHA256317a5d236c321ec9dc865b7a3de107bc160388e0b76102d9067830618f4b942d
SHA51252856b0a4f2ee114c19cccd110355e26dfe22c6366f9d755b18d98cac33f1a84ca56aba177fa105a1ae6cf46c11e2a738eacb389f9c1ad3271d61204cb1b0cf3
-
MD5
aad27a2b7aafd7847fa58ddbf07a2d25
SHA15a367ec3a44b5c079d80e414555675e316947d28
SHA256317a5d236c321ec9dc865b7a3de107bc160388e0b76102d9067830618f4b942d
SHA51252856b0a4f2ee114c19cccd110355e26dfe22c6366f9d755b18d98cac33f1a84ca56aba177fa105a1ae6cf46c11e2a738eacb389f9c1ad3271d61204cb1b0cf3
-
MD5
aad27a2b7aafd7847fa58ddbf07a2d25
SHA15a367ec3a44b5c079d80e414555675e316947d28
SHA256317a5d236c321ec9dc865b7a3de107bc160388e0b76102d9067830618f4b942d
SHA51252856b0a4f2ee114c19cccd110355e26dfe22c6366f9d755b18d98cac33f1a84ca56aba177fa105a1ae6cf46c11e2a738eacb389f9c1ad3271d61204cb1b0cf3
-
MD5
aad27a2b7aafd7847fa58ddbf07a2d25
SHA15a367ec3a44b5c079d80e414555675e316947d28
SHA256317a5d236c321ec9dc865b7a3de107bc160388e0b76102d9067830618f4b942d
SHA51252856b0a4f2ee114c19cccd110355e26dfe22c6366f9d755b18d98cac33f1a84ca56aba177fa105a1ae6cf46c11e2a738eacb389f9c1ad3271d61204cb1b0cf3
-
MD5
aad27a2b7aafd7847fa58ddbf07a2d25
SHA15a367ec3a44b5c079d80e414555675e316947d28
SHA256317a5d236c321ec9dc865b7a3de107bc160388e0b76102d9067830618f4b942d
SHA51252856b0a4f2ee114c19cccd110355e26dfe22c6366f9d755b18d98cac33f1a84ca56aba177fa105a1ae6cf46c11e2a738eacb389f9c1ad3271d61204cb1b0cf3
-
MD5
aad27a2b7aafd7847fa58ddbf07a2d25
SHA15a367ec3a44b5c079d80e414555675e316947d28
SHA256317a5d236c321ec9dc865b7a3de107bc160388e0b76102d9067830618f4b942d
SHA51252856b0a4f2ee114c19cccd110355e26dfe22c6366f9d755b18d98cac33f1a84ca56aba177fa105a1ae6cf46c11e2a738eacb389f9c1ad3271d61204cb1b0cf3
-
MD5
aad27a2b7aafd7847fa58ddbf07a2d25
SHA15a367ec3a44b5c079d80e414555675e316947d28
SHA256317a5d236c321ec9dc865b7a3de107bc160388e0b76102d9067830618f4b942d
SHA51252856b0a4f2ee114c19cccd110355e26dfe22c6366f9d755b18d98cac33f1a84ca56aba177fa105a1ae6cf46c11e2a738eacb389f9c1ad3271d61204cb1b0cf3
-
MD5
aad27a2b7aafd7847fa58ddbf07a2d25
SHA15a367ec3a44b5c079d80e414555675e316947d28
SHA256317a5d236c321ec9dc865b7a3de107bc160388e0b76102d9067830618f4b942d
SHA51252856b0a4f2ee114c19cccd110355e26dfe22c6366f9d755b18d98cac33f1a84ca56aba177fa105a1ae6cf46c11e2a738eacb389f9c1ad3271d61204cb1b0cf3
-
MD5
aad27a2b7aafd7847fa58ddbf07a2d25
SHA15a367ec3a44b5c079d80e414555675e316947d28
SHA256317a5d236c321ec9dc865b7a3de107bc160388e0b76102d9067830618f4b942d
SHA51252856b0a4f2ee114c19cccd110355e26dfe22c6366f9d755b18d98cac33f1a84ca56aba177fa105a1ae6cf46c11e2a738eacb389f9c1ad3271d61204cb1b0cf3
-
MD5
aad27a2b7aafd7847fa58ddbf07a2d25
SHA15a367ec3a44b5c079d80e414555675e316947d28
SHA256317a5d236c321ec9dc865b7a3de107bc160388e0b76102d9067830618f4b942d
SHA51252856b0a4f2ee114c19cccd110355e26dfe22c6366f9d755b18d98cac33f1a84ca56aba177fa105a1ae6cf46c11e2a738eacb389f9c1ad3271d61204cb1b0cf3
-
MD5
aad27a2b7aafd7847fa58ddbf07a2d25
SHA15a367ec3a44b5c079d80e414555675e316947d28
SHA256317a5d236c321ec9dc865b7a3de107bc160388e0b76102d9067830618f4b942d
SHA51252856b0a4f2ee114c19cccd110355e26dfe22c6366f9d755b18d98cac33f1a84ca56aba177fa105a1ae6cf46c11e2a738eacb389f9c1ad3271d61204cb1b0cf3
-
MD5
aad27a2b7aafd7847fa58ddbf07a2d25
SHA15a367ec3a44b5c079d80e414555675e316947d28
SHA256317a5d236c321ec9dc865b7a3de107bc160388e0b76102d9067830618f4b942d
SHA51252856b0a4f2ee114c19cccd110355e26dfe22c6366f9d755b18d98cac33f1a84ca56aba177fa105a1ae6cf46c11e2a738eacb389f9c1ad3271d61204cb1b0cf3
-
MD5
aad27a2b7aafd7847fa58ddbf07a2d25
SHA15a367ec3a44b5c079d80e414555675e316947d28
SHA256317a5d236c321ec9dc865b7a3de107bc160388e0b76102d9067830618f4b942d
SHA51252856b0a4f2ee114c19cccd110355e26dfe22c6366f9d755b18d98cac33f1a84ca56aba177fa105a1ae6cf46c11e2a738eacb389f9c1ad3271d61204cb1b0cf3
-
MD5
aad27a2b7aafd7847fa58ddbf07a2d25
SHA15a367ec3a44b5c079d80e414555675e316947d28
SHA256317a5d236c321ec9dc865b7a3de107bc160388e0b76102d9067830618f4b942d
SHA51252856b0a4f2ee114c19cccd110355e26dfe22c6366f9d755b18d98cac33f1a84ca56aba177fa105a1ae6cf46c11e2a738eacb389f9c1ad3271d61204cb1b0cf3
-
MD5
aad27a2b7aafd7847fa58ddbf07a2d25
SHA15a367ec3a44b5c079d80e414555675e316947d28
SHA256317a5d236c321ec9dc865b7a3de107bc160388e0b76102d9067830618f4b942d
SHA51252856b0a4f2ee114c19cccd110355e26dfe22c6366f9d755b18d98cac33f1a84ca56aba177fa105a1ae6cf46c11e2a738eacb389f9c1ad3271d61204cb1b0cf3
-
MD5
aad27a2b7aafd7847fa58ddbf07a2d25
SHA15a367ec3a44b5c079d80e414555675e316947d28
SHA256317a5d236c321ec9dc865b7a3de107bc160388e0b76102d9067830618f4b942d
SHA51252856b0a4f2ee114c19cccd110355e26dfe22c6366f9d755b18d98cac33f1a84ca56aba177fa105a1ae6cf46c11e2a738eacb389f9c1ad3271d61204cb1b0cf3
-
MD5
aad27a2b7aafd7847fa58ddbf07a2d25
SHA15a367ec3a44b5c079d80e414555675e316947d28
SHA256317a5d236c321ec9dc865b7a3de107bc160388e0b76102d9067830618f4b942d
SHA51252856b0a4f2ee114c19cccd110355e26dfe22c6366f9d755b18d98cac33f1a84ca56aba177fa105a1ae6cf46c11e2a738eacb389f9c1ad3271d61204cb1b0cf3
-
MD5
aad27a2b7aafd7847fa58ddbf07a2d25
SHA15a367ec3a44b5c079d80e414555675e316947d28
SHA256317a5d236c321ec9dc865b7a3de107bc160388e0b76102d9067830618f4b942d
SHA51252856b0a4f2ee114c19cccd110355e26dfe22c6366f9d755b18d98cac33f1a84ca56aba177fa105a1ae6cf46c11e2a738eacb389f9c1ad3271d61204cb1b0cf3
-
MD5
aad27a2b7aafd7847fa58ddbf07a2d25
SHA15a367ec3a44b5c079d80e414555675e316947d28
SHA256317a5d236c321ec9dc865b7a3de107bc160388e0b76102d9067830618f4b942d
SHA51252856b0a4f2ee114c19cccd110355e26dfe22c6366f9d755b18d98cac33f1a84ca56aba177fa105a1ae6cf46c11e2a738eacb389f9c1ad3271d61204cb1b0cf3
-
MD5
aad27a2b7aafd7847fa58ddbf07a2d25
SHA15a367ec3a44b5c079d80e414555675e316947d28
SHA256317a5d236c321ec9dc865b7a3de107bc160388e0b76102d9067830618f4b942d
SHA51252856b0a4f2ee114c19cccd110355e26dfe22c6366f9d755b18d98cac33f1a84ca56aba177fa105a1ae6cf46c11e2a738eacb389f9c1ad3271d61204cb1b0cf3
-
MD5
aad27a2b7aafd7847fa58ddbf07a2d25
SHA15a367ec3a44b5c079d80e414555675e316947d28
SHA256317a5d236c321ec9dc865b7a3de107bc160388e0b76102d9067830618f4b942d
SHA51252856b0a4f2ee114c19cccd110355e26dfe22c6366f9d755b18d98cac33f1a84ca56aba177fa105a1ae6cf46c11e2a738eacb389f9c1ad3271d61204cb1b0cf3
-
MD5
aad27a2b7aafd7847fa58ddbf07a2d25
SHA15a367ec3a44b5c079d80e414555675e316947d28
SHA256317a5d236c321ec9dc865b7a3de107bc160388e0b76102d9067830618f4b942d
SHA51252856b0a4f2ee114c19cccd110355e26dfe22c6366f9d755b18d98cac33f1a84ca56aba177fa105a1ae6cf46c11e2a738eacb389f9c1ad3271d61204cb1b0cf3
-
MD5
aad27a2b7aafd7847fa58ddbf07a2d25
SHA15a367ec3a44b5c079d80e414555675e316947d28
SHA256317a5d236c321ec9dc865b7a3de107bc160388e0b76102d9067830618f4b942d
SHA51252856b0a4f2ee114c19cccd110355e26dfe22c6366f9d755b18d98cac33f1a84ca56aba177fa105a1ae6cf46c11e2a738eacb389f9c1ad3271d61204cb1b0cf3
-
MD5
aad27a2b7aafd7847fa58ddbf07a2d25
SHA15a367ec3a44b5c079d80e414555675e316947d28
SHA256317a5d236c321ec9dc865b7a3de107bc160388e0b76102d9067830618f4b942d
SHA51252856b0a4f2ee114c19cccd110355e26dfe22c6366f9d755b18d98cac33f1a84ca56aba177fa105a1ae6cf46c11e2a738eacb389f9c1ad3271d61204cb1b0cf3
-
MD5
aad27a2b7aafd7847fa58ddbf07a2d25
SHA15a367ec3a44b5c079d80e414555675e316947d28
SHA256317a5d236c321ec9dc865b7a3de107bc160388e0b76102d9067830618f4b942d
SHA51252856b0a4f2ee114c19cccd110355e26dfe22c6366f9d755b18d98cac33f1a84ca56aba177fa105a1ae6cf46c11e2a738eacb389f9c1ad3271d61204cb1b0cf3
-
MD5
aad27a2b7aafd7847fa58ddbf07a2d25
SHA15a367ec3a44b5c079d80e414555675e316947d28
SHA256317a5d236c321ec9dc865b7a3de107bc160388e0b76102d9067830618f4b942d
SHA51252856b0a4f2ee114c19cccd110355e26dfe22c6366f9d755b18d98cac33f1a84ca56aba177fa105a1ae6cf46c11e2a738eacb389f9c1ad3271d61204cb1b0cf3
-
MD5
aad27a2b7aafd7847fa58ddbf07a2d25
SHA15a367ec3a44b5c079d80e414555675e316947d28
SHA256317a5d236c321ec9dc865b7a3de107bc160388e0b76102d9067830618f4b942d
SHA51252856b0a4f2ee114c19cccd110355e26dfe22c6366f9d755b18d98cac33f1a84ca56aba177fa105a1ae6cf46c11e2a738eacb389f9c1ad3271d61204cb1b0cf3
-
MD5
aad27a2b7aafd7847fa58ddbf07a2d25
SHA15a367ec3a44b5c079d80e414555675e316947d28
SHA256317a5d236c321ec9dc865b7a3de107bc160388e0b76102d9067830618f4b942d
SHA51252856b0a4f2ee114c19cccd110355e26dfe22c6366f9d755b18d98cac33f1a84ca56aba177fa105a1ae6cf46c11e2a738eacb389f9c1ad3271d61204cb1b0cf3
-
MD5
aad27a2b7aafd7847fa58ddbf07a2d25
SHA15a367ec3a44b5c079d80e414555675e316947d28
SHA256317a5d236c321ec9dc865b7a3de107bc160388e0b76102d9067830618f4b942d
SHA51252856b0a4f2ee114c19cccd110355e26dfe22c6366f9d755b18d98cac33f1a84ca56aba177fa105a1ae6cf46c11e2a738eacb389f9c1ad3271d61204cb1b0cf3
-
MD5
aad27a2b7aafd7847fa58ddbf07a2d25
SHA15a367ec3a44b5c079d80e414555675e316947d28
SHA256317a5d236c321ec9dc865b7a3de107bc160388e0b76102d9067830618f4b942d
SHA51252856b0a4f2ee114c19cccd110355e26dfe22c6366f9d755b18d98cac33f1a84ca56aba177fa105a1ae6cf46c11e2a738eacb389f9c1ad3271d61204cb1b0cf3
-
MD5
aad27a2b7aafd7847fa58ddbf07a2d25
SHA15a367ec3a44b5c079d80e414555675e316947d28
SHA256317a5d236c321ec9dc865b7a3de107bc160388e0b76102d9067830618f4b942d
SHA51252856b0a4f2ee114c19cccd110355e26dfe22c6366f9d755b18d98cac33f1a84ca56aba177fa105a1ae6cf46c11e2a738eacb389f9c1ad3271d61204cb1b0cf3
-
MD5
aad27a2b7aafd7847fa58ddbf07a2d25
SHA15a367ec3a44b5c079d80e414555675e316947d28
SHA256317a5d236c321ec9dc865b7a3de107bc160388e0b76102d9067830618f4b942d
SHA51252856b0a4f2ee114c19cccd110355e26dfe22c6366f9d755b18d98cac33f1a84ca56aba177fa105a1ae6cf46c11e2a738eacb389f9c1ad3271d61204cb1b0cf3
-
MD5
aad27a2b7aafd7847fa58ddbf07a2d25
SHA15a367ec3a44b5c079d80e414555675e316947d28
SHA256317a5d236c321ec9dc865b7a3de107bc160388e0b76102d9067830618f4b942d
SHA51252856b0a4f2ee114c19cccd110355e26dfe22c6366f9d755b18d98cac33f1a84ca56aba177fa105a1ae6cf46c11e2a738eacb389f9c1ad3271d61204cb1b0cf3
-
MD5
aad27a2b7aafd7847fa58ddbf07a2d25
SHA15a367ec3a44b5c079d80e414555675e316947d28
SHA256317a5d236c321ec9dc865b7a3de107bc160388e0b76102d9067830618f4b942d
SHA51252856b0a4f2ee114c19cccd110355e26dfe22c6366f9d755b18d98cac33f1a84ca56aba177fa105a1ae6cf46c11e2a738eacb389f9c1ad3271d61204cb1b0cf3
-
MD5
aad27a2b7aafd7847fa58ddbf07a2d25
SHA15a367ec3a44b5c079d80e414555675e316947d28
SHA256317a5d236c321ec9dc865b7a3de107bc160388e0b76102d9067830618f4b942d
SHA51252856b0a4f2ee114c19cccd110355e26dfe22c6366f9d755b18d98cac33f1a84ca56aba177fa105a1ae6cf46c11e2a738eacb389f9c1ad3271d61204cb1b0cf3
-
MD5
aad27a2b7aafd7847fa58ddbf07a2d25
SHA15a367ec3a44b5c079d80e414555675e316947d28
SHA256317a5d236c321ec9dc865b7a3de107bc160388e0b76102d9067830618f4b942d
SHA51252856b0a4f2ee114c19cccd110355e26dfe22c6366f9d755b18d98cac33f1a84ca56aba177fa105a1ae6cf46c11e2a738eacb389f9c1ad3271d61204cb1b0cf3
-
MD5
aad27a2b7aafd7847fa58ddbf07a2d25
SHA15a367ec3a44b5c079d80e414555675e316947d28
SHA256317a5d236c321ec9dc865b7a3de107bc160388e0b76102d9067830618f4b942d
SHA51252856b0a4f2ee114c19cccd110355e26dfe22c6366f9d755b18d98cac33f1a84ca56aba177fa105a1ae6cf46c11e2a738eacb389f9c1ad3271d61204cb1b0cf3
-
MD5
aad27a2b7aafd7847fa58ddbf07a2d25
SHA15a367ec3a44b5c079d80e414555675e316947d28
SHA256317a5d236c321ec9dc865b7a3de107bc160388e0b76102d9067830618f4b942d
SHA51252856b0a4f2ee114c19cccd110355e26dfe22c6366f9d755b18d98cac33f1a84ca56aba177fa105a1ae6cf46c11e2a738eacb389f9c1ad3271d61204cb1b0cf3
-
MD5
aad27a2b7aafd7847fa58ddbf07a2d25
SHA15a367ec3a44b5c079d80e414555675e316947d28
SHA256317a5d236c321ec9dc865b7a3de107bc160388e0b76102d9067830618f4b942d
SHA51252856b0a4f2ee114c19cccd110355e26dfe22c6366f9d755b18d98cac33f1a84ca56aba177fa105a1ae6cf46c11e2a738eacb389f9c1ad3271d61204cb1b0cf3
-
MD5
aad27a2b7aafd7847fa58ddbf07a2d25
SHA15a367ec3a44b5c079d80e414555675e316947d28
SHA256317a5d236c321ec9dc865b7a3de107bc160388e0b76102d9067830618f4b942d
SHA51252856b0a4f2ee114c19cccd110355e26dfe22c6366f9d755b18d98cac33f1a84ca56aba177fa105a1ae6cf46c11e2a738eacb389f9c1ad3271d61204cb1b0cf3
-
MD5
aad27a2b7aafd7847fa58ddbf07a2d25
SHA15a367ec3a44b5c079d80e414555675e316947d28
SHA256317a5d236c321ec9dc865b7a3de107bc160388e0b76102d9067830618f4b942d
SHA51252856b0a4f2ee114c19cccd110355e26dfe22c6366f9d755b18d98cac33f1a84ca56aba177fa105a1ae6cf46c11e2a738eacb389f9c1ad3271d61204cb1b0cf3
-
MD5
aad27a2b7aafd7847fa58ddbf07a2d25
SHA15a367ec3a44b5c079d80e414555675e316947d28
SHA256317a5d236c321ec9dc865b7a3de107bc160388e0b76102d9067830618f4b942d
SHA51252856b0a4f2ee114c19cccd110355e26dfe22c6366f9d755b18d98cac33f1a84ca56aba177fa105a1ae6cf46c11e2a738eacb389f9c1ad3271d61204cb1b0cf3
-
MD5
aad27a2b7aafd7847fa58ddbf07a2d25
SHA15a367ec3a44b5c079d80e414555675e316947d28
SHA256317a5d236c321ec9dc865b7a3de107bc160388e0b76102d9067830618f4b942d
SHA51252856b0a4f2ee114c19cccd110355e26dfe22c6366f9d755b18d98cac33f1a84ca56aba177fa105a1ae6cf46c11e2a738eacb389f9c1ad3271d61204cb1b0cf3
-
MD5
aad27a2b7aafd7847fa58ddbf07a2d25
SHA15a367ec3a44b5c079d80e414555675e316947d28
SHA256317a5d236c321ec9dc865b7a3de107bc160388e0b76102d9067830618f4b942d
SHA51252856b0a4f2ee114c19cccd110355e26dfe22c6366f9d755b18d98cac33f1a84ca56aba177fa105a1ae6cf46c11e2a738eacb389f9c1ad3271d61204cb1b0cf3
-
MD5
aad27a2b7aafd7847fa58ddbf07a2d25
SHA15a367ec3a44b5c079d80e414555675e316947d28
SHA256317a5d236c321ec9dc865b7a3de107bc160388e0b76102d9067830618f4b942d
SHA51252856b0a4f2ee114c19cccd110355e26dfe22c6366f9d755b18d98cac33f1a84ca56aba177fa105a1ae6cf46c11e2a738eacb389f9c1ad3271d61204cb1b0cf3
-
MD5
555198ba067f1691aa3a854873c81b0f
SHA1cd049d70bd95fc16af71fd0e16479b4e31c8697f
SHA2566ae7068d9584147432cfb308dc800724ff734c3a37d6d3275fc9119632bd16ae
SHA5129cea21a7cba519fc35bae7fb69f840c97a2d29b72d799253b4f737274ed52388c79da4e1044115dbab4ddeb9693683ac263ab07e1715dcdd892b66212fd3310c