Analysis
-
max time kernel
146s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
07-04-2024 23:33
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-07_87bf9bce4bca123f08cd4e3f0329aed6_ryuk.exe
Resource
win7-20240221-en
General
-
Target
2024-04-07_87bf9bce4bca123f08cd4e3f0329aed6_ryuk.exe
-
Size
1.9MB
-
MD5
87bf9bce4bca123f08cd4e3f0329aed6
-
SHA1
ad1b9331ffe933ab3183ab3a0befaa65b62d9c49
-
SHA256
eac4737aa19dcdf0f11122849bf48ee8ec41d66302cce8642d36a5f2920ab734
-
SHA512
8a63905091fbcd25bfc27739a34d216b5511b268b9d9da7edbb1bc37162b9d07d0e865f745242750a52c8048dc2433b784207581d81cd1b9f1a6cdf825cafc2e
-
SSDEEP
24576:2BqBrH8sLSySH5jf02+JAa15ajVCt8RnXZ41Vi5ELpujFY:2B2rcsLSySHdqJ1IUKpv5Yu5
Malware Config
Signatures
-
Executes dropped EXE 6 IoCs
Processes:
alg.exeDiagnosticsHub.StandardCollector.Service.exeelevation_service.exeelevation_service.exemaintenanceservice.exeOSE.EXEpid process 3156 alg.exe 4796 DiagnosticsHub.StandardCollector.Service.exe 1788 elevation_service.exe 3428 elevation_service.exe 1132 maintenanceservice.exe 1912 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 9 IoCs
Processes:
2024-04-07_87bf9bce4bca123f08cd4e3f0329aed6_ryuk.exealg.exeDiagnosticsHub.StandardCollector.Service.exedescription ioc process File opened for modification C:\Windows\system32\AppVClient.exe 2024-04-07_87bf9bce4bca123f08cd4e3f0329aed6_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-04-07_87bf9bce4bca123f08cd4e3f0329aed6_ryuk.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-04-07_87bf9bce4bca123f08cd4e3f0329aed6_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-04-07_87bf9bce4bca123f08cd4e3f0329aed6_ryuk.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\c34fd69c990ca9c2.bin alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
Processes:
alg.exeDiagnosticsHub.StandardCollector.Service.exedescription ioc process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe alg.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe alg.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
DiagnosticsHub.StandardCollector.Service.exepid process 4796 DiagnosticsHub.StandardCollector.Service.exe 4796 DiagnosticsHub.StandardCollector.Service.exe 4796 DiagnosticsHub.StandardCollector.Service.exe 4796 DiagnosticsHub.StandardCollector.Service.exe 4796 DiagnosticsHub.StandardCollector.Service.exe 4796 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
Processes:
pid process 672 672 -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
2024-04-07_87bf9bce4bca123f08cd4e3f0329aed6_ryuk.exealg.exeDiagnosticsHub.StandardCollector.Service.exedescription pid process Token: SeTakeOwnershipPrivilege 1944 2024-04-07_87bf9bce4bca123f08cd4e3f0329aed6_ryuk.exe Token: SeDebugPrivilege 3156 alg.exe Token: SeDebugPrivilege 3156 alg.exe Token: SeDebugPrivilege 3156 alg.exe Token: SeDebugPrivilege 4796 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-07_87bf9bce4bca123f08cd4e3f0329aed6_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-07_87bf9bce4bca123f08cd4e3f0329aed6_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1944
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3156
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4796
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1788
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3428
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:1132
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:1912
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5cbb0859f229479ecd6ef0bf69bce78d0
SHA13745eb2a66468ca5f4cfffe4e04453b0581d151b
SHA25658b4355c8e7393bcd0ce1d99b6c6e6388cc3df8de47bf06bd7b7ed5f4022291f
SHA5120f04ea83252a04564aba8fc07c5a280801e09836095b70e6f6e8254d65d9474e6c4ba4285cf26fd214d374ff64194c66c04a46c4eb7620a0b58e366cf322f966
-
Filesize
1.4MB
MD5f0b706b5d96e96f0b3a7fd574651d73c
SHA1248600cee0b95a6c52855ae367809de8c87126d9
SHA256f03ce8c80734be67c68f0c60ad1d8b98b2fa693e2c0b38881800c6618d303ec9
SHA51240960b4e9ff9ef09adae709d590315fe77891b8e1b34ecbd402be0830646d221a3616e20701b670f8d4c8682044faa50376e702aaa56e028f105c55cb3142f55
-
Filesize
1.7MB
MD57ee22e80240e4da29615491e4fdb4d1c
SHA126ed435e60eb834d7be10d4e8bef93794b5fc23b
SHA256debf3f22afa7907d40f87b32829f7391146cc8ac74c9816a92a880ff4ae226a6
SHA512a117412dcd02fc507db40fc20807f421512b116b823c45bb5c324c98b07ae18b3f1df30f42b3d351489fd4d601af42f4ca3561bced30908849dbe3b5e9c31b33
-
Filesize
1.5MB
MD5a230a37323f523782c8695b3ca7cca8c
SHA1960451b36806253543ffc96c62e7806778cda635
SHA256ce046f79d54b57148a43f7e443fbbef127a6c34876f39222f5e748ee887b8872
SHA5122b2c20917bfaba1986329a9830b16ec8297f6234d3de87b08146aae4727ece3da8863b7a981b071bd866aa15ffb4dc42dc8577b5824cc72f894d44ded5e35869
-
Filesize
1.2MB
MD5b2df7f26d003a7923ab4bf2aba017a96
SHA141ddbe6ec8403fc06b8054c21d942e933d2baab0
SHA2560781f774d5a01768d060609f0c745e5f1054ccb01d18c35c63445158fadf6bcf
SHA512b28b7c6751ea6aa9cb72af5a0856b89b42a1c32d58a1306ba5d66b3feaef981ec936a871987113bd36a794a0a8a482d73711099714c36d59c1e16603fcb5721a
-
Filesize
1.2MB
MD57349eb0d80a46e1454c8dad2bcdcb47b
SHA1ae60a8c2cf82a8b2940a2f541de7d022c8b714dc
SHA2569f8c55cad0fec70e78b173e955d590450f1ec127cc3f592ff80e1345d0b4390d
SHA51216f7888c4a77f79c0d2033b89fb85cdaa70e61608f65ff211b921a7a45c5c525d270fbfec54f0eba77b222de034375c5cbb0ab392c24d1db973600bfb177fa22
-
Filesize
1.4MB
MD5ddecd1f168fdb3e4d1ec3c38f65cbba3
SHA146c8f5edf7c04ac7e7a2cd314f7a88052ff9cdb6
SHA2568eca466fe9c59f1f0227bd956a68af5281d0ccf989ca70667a20613bdc6bacf5
SHA512de4048ae2558856b142f724ce12a818dfc8a003d5b6e9a685151792dc47e33ac338f10e3706a1d91ce02fb577ea2abac487267de10bef9fcfdfe7b5e611b83a3
-
Filesize
4.6MB
MD565edebdb80d0dcabf43bd2addf5e66a9
SHA17a29327dd8c6d3d290574ff0d87c436169533fbe
SHA25620fa027d0131a83b86f3304550d80dffd55a1100e1bb55ed20eec1906f7be946
SHA512536d8baffdf10827181d961ab8bba22d33eac5978ea4fdbbd36c247ceb09805746db2682bfd9fd6f0222fa9d7adaf2a804464c74f09c072b19a822b791a122bf
-
Filesize
1.5MB
MD506138303fa02846e15ff90bcf1b27f04
SHA1a09d859505a3481b7a3b830bb1fc621585f5c3f1
SHA2568daa97079ac15574eeb6b6cf46e6886c18d87149c6b1a33dc8ed5a2b91665a00
SHA512bd39c8ab6ae838dd48f1c9c8a6f40823d56106e1e0ff3a3869208ddca1cd6ad2a1cb9bdfe09aa13201d3ce653823172e3f26efb813a053a439f26a5d97980d82
-
Filesize
24.0MB
MD5e90a799723de91be18326ef3817a68c8
SHA1a7982bd0371f10d0e07a137a22e7d8d48b54bf58
SHA25673a243032999ab1c59e652c1422e2d36eaff51e030d4930079f9837d792c9ddb
SHA512d2151574cf8963f667016661a0fe922f9ddf57e0b378605002c24d84d59a4970ae8264f8e3b5485edc6bbeba1d211d16d3d0b305b9b92714ba9a5017c1f21138
-
Filesize
2.7MB
MD5c0888c6bdd1d398c32f6e030baa76138
SHA12cca9bbf493ae6986e1c8377de3b6944ca759243
SHA256f565f296762e5616131bf8778f6e1ddc269c5f462bdc0926da476eac89d1f3a4
SHA5127c3578a62abe7d067d77a932288ad85714510fe3c71ebf800fedee38855aea63778bbeb412f95b9fb1997a8db64940c3f4d5c51d65f60e0745ad6950d3247e8e
-
Filesize
1.1MB
MD598fedc887002ab618dd4c9d5d5fab0b7
SHA1a88093629e71af01e0d492ad9405adfb72a1a941
SHA2568fe4d022a7c83c7138c9050ef206f649056151c82a6434546ad3cbacddd310d8
SHA5120e22aa9c57cae2b312f490e4e2516211aa536d24a079b20bf21c136526f082b7c7832cc2f271b8b1d733a91090601939d990fd4c60de27448591297e90956b1f
-
Filesize
1.4MB
MD59f30328be175b70585670b977c657a18
SHA1c0dcbd7fa087ec2e752a8e3477398df922ea5535
SHA25613d3ac8c4c9099a4f3f12687adbdb3b40a88c6897a1248da2530a0a95e48d2a0
SHA5128a38ed8e6fbc6b8abac9975c0917646ac51df756e4357010dd10d20a5ac0bc56d1c530ab5d0ff6cd9148e6555d933837cb93c472cd90073e0b409cddc0ba5d94
-
Filesize
1.3MB
MD518f96f332a9886faa3141574520b29dd
SHA14e0aef9517a4ccd9ba3db1baea61a7b387964900
SHA256a12777b5b12d7f78e70bd56509c1a4aad115ed50654971320a5105977c6ac533
SHA5122a867ddcad414bb9eca0f384d99c8937fb81e46cda052d841f0662b7451dfc1d48e6fc7ebeade7f601688ae89607fb1850683e5760f9ce803f134727ad581941
-
Filesize
4.8MB
MD5743a28e6883e49fdbe621554471d60b1
SHA1f533105ae024b21f9e448f1be9a9ffce0fe3cf24
SHA2562371ff9897b4a3f677e22e2bd58bb8057b1951824397c12b83156c630433cafb
SHA5121c5c7d9f8ccaad9303c452a8d03834923779a5e3d9a4bba797ebb8730f8d48a2cbde0baa68fd83780f8e7c4df6cd6b96efa160666ac306aca092e8e2797cf572
-
Filesize
4.8MB
MD533b8db91ae69c27602e4d46228532f80
SHA180c31a006359fa781a5e9124226e0273e91b31e5
SHA25625af4a2f7a7db50d9a58ea22b0d5b89226fda7129e8336668baf22e58a9fb780
SHA5125014cf5c2f6bc571a3766681fba727a59ff534589c4d3ae743e4c086d2229301a372916be7f637bb37acf85dedf11e7220c7faa73c3b5d6487e75105a7a08624
-
Filesize
2.2MB
MD5c12c97265371f1bcb8d2810da21857fb
SHA1ac8d22ef7cb7e3c852aa0625cffba83f448cca81
SHA2569063ac0af328948665a9e93d5e23ad08035615ba3a081d95dca556f1683e8485
SHA51229db8156b990e857f4f101d429dd66d71ebc4521dbb4577e47bd875342af424a29e4abcd705ff7067f79208c15b28b46557fc5c91c82d2fc358e363e875fb469
-
Filesize
2.1MB
MD5c6fb80b9f0f4962dba1a16aa7434d19a
SHA1c74ad76f7512fd29d8f35c7f09b8f7f16d384c22
SHA256a543ba3f2bca3f46d9a34a28527b1bb5e757debf56c69e33b673c201bf8aa394
SHA512ac0237ff602c4db1761232b5457ec0c15ee6dab5d0f755bad20d836770ada1e0f239bc9c11fe19fa354c92db8f8c53b8462a6a238882f244b15bf45054ced6a2
-
Filesize
1.8MB
MD5402fa62262fb837fa72a779aa691ae1c
SHA16385c374422405c7ff3d44395c7a11ac258517d0
SHA256a729cbd7455af66b87f0ef31bf2b39abf3a0ea8a14e72b1a2e89cba999a9a9d2
SHA512299ae55a44b901652b6a3ed7e818af2e9fa3b35335fbb276bde19d13dfc9625b8eceff9a9d4029569572775e2528b271fdda176d78a4fea949599f1aa0f5e0e8
-
Filesize
1.5MB
MD524d97bc1ebe7b67a7421b6f9f6ada851
SHA1c1027397449f41f2e89ea15d21e6460cc48cf0a6
SHA256103496e844af72d0593eed413189960f2694b3def5cdf93165df23c36de45c04
SHA5124c36f1f910abb74e2a5e1e092d02c067d739ccf1b00566ac0e28f3120e643444d83df8462d5d5c35d68c6252d7f3e99e1a08c0f12446b649fff81abe260a2a05
-
Filesize
1.2MB
MD538f7119e3064d81467aff2a232666e01
SHA1cc653c1ea6f185a3be666e6bede9eb1d20437182
SHA256e618bac4967e20878d852ca97e5687616f5f1ffba80aa9ba0a4f5fccec079c45
SHA5120db9c0c9e642c5dfd62a3241b07c4a9b1d8ebefea996afb1a8bc44ea08a3da2dc22e079cb52d842daab31f40246a3e56f08df4c67100823934875db9c5487cb9
-
Filesize
1.2MB
MD5abff7383da9f4b5b7befbac1dfd42182
SHA1666ade4d582a60561af61991914c568fdfd0a22e
SHA2563f62ace932be980eebd7a7ca91da994624391603ec154e3c06dd263dd9ce4c79
SHA51272f73fb6e871f72426d1c8fcccd15a2b9583ee1c3938bdea077983118bceea916b10ef309a63ac40f3c6f35f87fec35d90f008c4dfea8ebdf9330002b4c099a6
-
Filesize
1.2MB
MD51cbf74aaa461926996de5a667b88d94b
SHA1ecb3817d65f3d4af166abace8935fd8fd757a87b
SHA2560a1010c3420deb0cd53470026394d28d4430c6a0d73daad3e9237addbd96faa3
SHA5126555de7c63406208b9edd292d21a2ccac5a002755c82859ff0515d2003d8de05c78473d1e9e7e6f242866319d277f60b3df4a794e9fcea769fc1c356fecaeda5
-
Filesize
1.2MB
MD5fc0469210299560e5a848f9d438899c8
SHA17fb068de15197d3d755134207d5e974ae3387fb8
SHA25627ab972e6dd0f68e7c2c85b822bb514bdb62004186550788b1ffd8bf59d6cb6a
SHA512f26bd3843dce124629a41dbb9fbd997411feea1a09f4a5399eabe0d87bfd4e9663cdc7698de72e00cc51a00ef11e176d7155d77e6001f51e62895c53e1749da7
-
Filesize
1.2MB
MD52278a6733000f922fc519b22793d9d5e
SHA14d245c2f194f1d7f474beb348785d91dbd399fad
SHA256c996d639fbe9c24800f83fc6fec0beb2941be2cea1c0a8c5c077e53efa7625d2
SHA5125ed0b7ddbff49850b59a381580c6bbe7f0021655e94264a1f4314a98d883adb54301e6f8e40526a0ae1ef9d2c6bad59fe47c0f4e4a35598a1dca1875418f9d2c
-
Filesize
1.2MB
MD507c322b24f8ffb557f9f9e1e2ee06418
SHA1f1c094a3ee2d7b793478c51faa1ffb631be8ecd4
SHA256a54781eb81ac953cfceec97fdd7b5f2eb844c715de0143c24031b8a7b4db79b1
SHA51294f6741766aaedac46ffe620d71d36425af481a369c37dc56c83c5d5fbb55fb61919f77528bf39a09db70f95bab3c0b45bd5b5df1f581f665a624acfec370f64
-
Filesize
1.2MB
MD5bfb428c92acddd87a7b8713453b09109
SHA13aca5cb4a317f18b1d5313b4ba9680fb1fc67d9a
SHA25620129fb5248ebdd1d15ec0ac5774559a5ea4571bf71546013cd1e7d0b959adc8
SHA512a1ef774ac9a2cf6f57925d367fa5f4158d5d3f5c36a52d72d18fa532f66cbfb883d66a3b494a803fe44f470f87c01dd90e7dc9e90c522cf24aaf121afd697791
-
Filesize
1.4MB
MD545a22188dd4aae1b19078f17658a1494
SHA1eb6b2644e7e559195a0a180a1dd4fce2d7a9714a
SHA256951b224f7b2741977c1583f8ad75f4461039215e2186bbcc06a2a96d5fd530a0
SHA512304064d6aeea940f586e2977fd3f4ed5b0a6f3ae34231c85f4c4a37382828450fb8036c9bd3cf7bf7eaf02f3d8bf9befa80308b494d155237ba1fe9da4a95b82
-
Filesize
1.2MB
MD50181f7a12540434a79c0fd1309800ddd
SHA1377b2519828aebc54da238ce909c4ea10e542213
SHA2561cda726ed0da798644130c6fb82ad31551109416bf85c559e1fee18e945ccdd0
SHA5125fd224843882f4651e1ac16e6202f06c0929388bbbb0544bd4f0e0d0a7c26a1646f1d4aa9ed83727286edda27360ea60e235b0d7a4521ae38b8429285a2826ba
-
Filesize
1.2MB
MD505595106b0129dd6669ddf25fcfebea7
SHA10c98dcd8cc6af296d207880ff7fa3eea17ad296e
SHA2562b16c280e9bcc82b2e5f25359f210658f626dbf9e3229f2de5aee45c657abab2
SHA512f4ecd9c282c42a9a6e53b1563d5868d6a51ee660d4664dd54b1819648cad48c897c305d90b195d6622fb5676b00c1e9b19fb48b6a47352d59fb3b5c13d0dbddb
-
Filesize
1.3MB
MD5c64634fb868810511366e8a05f1267e4
SHA16781c7a31359e7c805774827742f67f06936bcf3
SHA2564aac1ecd8d987a428b0fccca2d5204d0c4c03fef7af52add9c8d2ee49d69e879
SHA512ae5cc9fc2dfc3cf8f62d5f068d7bc1959523f4598524d7054d623fdc56080564f14864d448fc48bfd36f898a0380829731094a996e0500b2092038c5512aff4f
-
Filesize
1.2MB
MD5067b1cd73e597ff7f15d971236464033
SHA172fd56bf04fc2d85091b8e902cc23076d7f1c416
SHA2568dabb170ac4d56ec67d39038dc0880d0bd8a94837c898bff7fda2cd12fce1c7d
SHA51232d52634b4cadb0e38a565d451cdcf0e4d9b79b1cf6ab673136855e4a651ef19dee4fafae71e5a72716459cb3e19f7c5f5f0b12cffc5d7cbdbd0b8c71a72fb5c
-
Filesize
1.2MB
MD5cc26567a676d4754c05681c624b2c417
SHA109529314d5eb137a525444bf9451bf747974be97
SHA2560600384645b29c71fc005aeb33384896ec2b0c7026d9608633a744eb5c759adb
SHA512967f48fff95b30f84add8e979e76fa63acb284b24f27f6c96ab232f9496abe0fcc0f8f083fc181ea73b00e189348539d973cd1a7c480d967093754cc61bdc7cb
-
Filesize
1.3MB
MD5831b92c36f66d23323e38e66a68167fb
SHA1547d544dbb2e4ddca48b0d7a089f2a8663b5d927
SHA2561e8df1823827040734b0923bf805cf25a984776c0309bc439af1188c66e95091
SHA5128b5c69bfbdf374d402804954b4f6e42e4dabab9a5219cf9a536838cd6a9dd48e3a79042187589a9ea4f4fd0bf6688909c9edc8ff098b8e46d40ef77cf5fd242f
-
Filesize
1.4MB
MD50fbe2dc660c2366340c2c2cbf0eca688
SHA1dfeed169f738b8daea7b62a5a85f63bef69c4f96
SHA256928b4f7ab76069e207d97989772438852a7f91ea276309e32c41d2f11bd44e97
SHA512a27abbebefcfe0b06ec18220abc872537437f2c0bb9d87b4fb112ae2afb6af8963a52d05e4a0fc089a4c247ca7ed27cfe01c3b38ae48099626c89ea4dd22f23a
-
Filesize
1.6MB
MD5c11ab2aad80d04ab6b735dac6535998e
SHA1f3faada955d97e2c173fff5864fd65584464e4e3
SHA256aa7012c5652454282c1a3c8f0253f3535bada7b0528ce60076ba1b5d812576e9
SHA5124c3e649fe562ac012269815b8fce38cf39ef230ebf27f9f7f5b267017dc320431f6af416fca27f70da94de5202aa962b0eef8d151d4af7af94eaf6f02756a853
-
Filesize
1.2MB
MD571279d1704bbc23bf2f04ae503899433
SHA1e67c7599e9d0dd9aede7d9c2d3e771e9756df9f4
SHA256e96cc84480d10a30e6faffd1916dcf51dd9aa18fdd39a20a916e01c6831a0550
SHA5123163198b50a7fc34b0c17586e98ba903664715ebe98394888ae552a09a510060a976155a6ae4420acaba83bab2664f09e5d910d9fb8e66ec4ea287af8a4efbe9
-
Filesize
1.2MB
MD57fa757f6b80dcafb89cfe5a8e7c24ec5
SHA1bfde029c7c1fe9086454b4059d00ea6aa7c771c9
SHA2568a026e78a01913a6880956425f47d769bc99825365ed6bf70d653436a851208a
SHA5128b32f3bb2534af0f17fd32cbf3ead04a78cdfe051bd42869033b1d1fdb4e2c36e98dcc400cd479c48422edb0987e6f54ebe373dbc16881da5c70a781c5d75eee
-
Filesize
1.2MB
MD5f5111d226ae51ebe2a59bbee7d1eb5c6
SHA1720884c6a07f0571e31f53d8256f540e2f9a1412
SHA25637bdeaf3f34bb5922338cee6e81b9025e528d25c8fe046dd95f43a90df49e18f
SHA512c36006289af550825279bcb4c102942fb2e74011e0ad0bb356a2427ddc8c3dae396f5f8e6366267fbd5d66aa584d99d206f41a083cae105a2ff2696061d8599b
-
Filesize
1.2MB
MD586ee42c9e96579de1f20957d35876a81
SHA12f420f8521591c8c9d6f0e81030537bf3c92d435
SHA2562953cf0296cdbc376358fc6ec8762b1088fa79fb83bbf3cd3ce8d9d95bb2b89a
SHA512122622a683efe08e1a91db9d29c1a6187ecd0a9f5e0d2d7cc3eca5b5cc0aaff3c7fe6efa17e47ec8a5807fd538b2f6d2d1ebaecb74715161cab06b132d23cb8c
-
Filesize
1.2MB
MD5c06281072b87cae89c37458a9b66f61d
SHA1a9b340ada44d49122c73b4dfb26cc73ef1e3c644
SHA2569f64e8d28dbd19232da8bd349d303166fadbc24193875f39163bfef0b83dcf6b
SHA51253024631ea552c515bc624cb90a36c40bb8db22973ffb154c12d8ad0b18b7f1b1ed7c5728aa0207894d2b6927b5c469c2dcc82275425713799dbf46ad6d6a4da
-
Filesize
1.2MB
MD5df7799538e2574389106060409b33ff5
SHA1810889e4c40808e20776e0468d0aee385c7c11f3
SHA2562fa19d5bedb6c8e695a1d48116ee831c0994bb95c66bcda325ff450cab713efb
SHA5128fa71c4bd1ab9a3b0ee789457714d4b94aaba1e2735e30cf29545cd5581f48855873283653ee94c974a82181d626eaf8bd8c7b2c4d8ed7d6a26b177dea32705a
-
Filesize
1.2MB
MD5f3152636954b0353197de86556c1ca16
SHA1514bc60ba5e2134f4df67d74019e4b695a0c1a0a
SHA256d80cdd3dc7460c93efdacba51654a6b64027bf405466c4426a6c5ba3a25e24cd
SHA5122e6de1cf0c13457c629e8ad4789c8985e47605780317135f1f6daed681663c55d99c86ce921bc63b60fdaea8ef24c1db209c6ecb024e41bc33c570130039c88d
-
Filesize
1.2MB
MD5d7b8a9aef5e0d4c20752acaca9f8b1ad
SHA1dc59fb29c835fc2293d9621002417a8b262eb3fe
SHA256cbfdcdc77341eb0977b7ce95c909d9e14f4190f8e1da3a5a74ba37e129820fe9
SHA5129b13ed062a74db671ce2d944a885a9111dbac5c2cdc29a1d9977d0673286c196acda87c00e3098471ebbd6d34a614776c0feed87ff6703a5f92a1dd5d0f514f1
-
Filesize
1.2MB
MD5d506f231055e999ee34c716c42a47898
SHA192866c0bcd53a96ff1188cf0a090b60a0e4d8acc
SHA256d4e5fcc1b47bac1a15c79a56a45a0d9206ec4d530cddae86a0c03085b2c720ea
SHA512d415e408a19cf108559fbaee13f131eac8026060cb3d5bcfe615f8322a31ef1d24e337ed3a032ef0f03c09d6d470917bde140cec77e8bdb28fbfe6f8c4184eeb
-
Filesize
1.2MB
MD59d3f14a6464c6dde3094b5fa4bcb0475
SHA154f0a9410ba1c605133c86769027d37e5f17120a
SHA256ce5875ad24535df7085e08ddfcd6d3eed8c7e28df530f20aade7002ce628f850
SHA512b8e0bc6fff618d04cb9ab317bcec4469adf36e9bbdf73c9796453c28b8bc0bb5c2a27ae04f7c52c70963be608459489836ed8c7d08251dbb167cb543a2cf2835
-
Filesize
1.2MB
MD54f3ef86a0d3ddf6068be0b0f8f5cde8b
SHA18d85dbdb6907471e2d04d033b5f80f668caffca7
SHA256f8fb9673823e8fb52cc106aae5ec5aad6b7671d7d209b559ab7d121a30580d05
SHA512169a931758aa30f67d527115f36bfec5664c9a932d34e2f70ddad19f21c72590010d2fff47127614d7c3ac32aadc63729f9fdd173f82c3d69ebc66fe9d44851e
-
Filesize
1.2MB
MD5e0fcae0dbdca5ee3bf1c9f11f7dcc697
SHA18a4d2101398921b9ca938b4e2bf5cb3b7c36e52e
SHA2562f428ff7945d7a503494c7f216f7bdadacb52089e5fef46338e5fc6d556f9ef4
SHA5121cd9254290075c02b1bbffa6881575d98563cd3d28af6db056324b557ad3eeb3c685d783802f9c0a74bb4f46da99a02b7cb2d56294a5973364b02111f8aab759
-
Filesize
1.2MB
MD5ae4aae2aaafebb3662569b4e83ce6412
SHA11dfe8dd09d80c75e1be148b739a1c70171b34b3c
SHA2567ea89673d7386c44b3d0dafba9c5881df7b1e80be47d7c630c8ffda1131e532d
SHA512220f072bd3b458d2137bd7ece360908317b3c2f2e684e559a352553a1080d174987774b3b9a301c2c74a77bfe52af289e6fe2679be0cb1f00b76a7cdcc997050
-
Filesize
1.2MB
MD549d28107c23d90306cadf94494d07006
SHA1513ea560d1b3781dbee3944505fec10c7ac10921
SHA2567d367cd6791e33f02a722ba608f7246d62ebb145cd73d96fa40966b0177340f2
SHA512ce3b358e4ac79585dfb40067869333fb9f3483f53696898d8f17482ab09e3e849887dd929d7691b7e893838b7e2f2dda45540562a3367c763e281c0bd33426bb
-
Filesize
1.2MB
MD57cf19a41a1edf7e7da02f4c858aefb21
SHA168f39ba75743cfdf781f34c6bdb5b7fb8c51e537
SHA2564191547285a05917fddfe384e8219d1b62624f7883b010dc6ad945fed0210293
SHA5126ff52313c0c5b658951fecb470cc63c99fbd07362693c970a45c3b0e3a90ff891ebf89e6aa7b2843161a0f15363e7d3f1f1af4dfe833458ddb3ad5407eb13c92
-
Filesize
1.2MB
MD54238d2ed15a8a9b8904743995353ba7c
SHA102b615e747ccf568ebe71ded90ec6496bcdcd0ac
SHA256072f112b0469d99be664341558071f89a91c5a962f2bcd06a82a89243ee875a0
SHA512d1b679dce90df782949b748df7b40a8ce3e2e034586f63f3321aad7167331b0b10de6b0fb888487ff718f940e2b10926e55a4efac6cdd0b8312e536be5e4958e
-
Filesize
1.2MB
MD57205a5af76c627d51cc273405e81671b
SHA16deff4ecd3c3640812dbd0a960d37f035074817a
SHA2565bdf12a03f586747a4bce945ff66b19e661d40b41b29e266ef5418475940a414
SHA5125d1c85d76fb0c94306658b09cbf6312f735f12bb64706ec7b1242b150ba250f2fdd11bf1898198db8b16f6f2c25da510f40f7cc27e0fde11fd8f1289caab293f
-
Filesize
1.2MB
MD540d33544f0806f7ff85733e930363cf6
SHA185d6c187be4b8762ddeb86fee31b0eb1564f74e0
SHA25614d4e2c1fcec0468487f4f95e7465c9ce6a40a0fc329b281a78a326716ad4ec1
SHA512b353e87c758c94583b8441ed3021bc8c917b2c5422f4573509bdf466528da3846a3db114971170db866c3fbc3e3fdf8ec9ee53c4b3e62e6adefa77d70fc971f2
-
Filesize
1.2MB
MD5a7c7a729659de42d4a359a19039175ad
SHA197a4dfc38fbcaa3b3e7e2f31c8cda481a213a448
SHA25643870b4a77aeb6803c325e1df098a0c51817d80468e58e76262cbf09b42da689
SHA512676b6043aaf49c769b6d10a626bac0ac348852c592387e9aa50573fb89bf37469cda24887b612dc1000daa231ba3caad0f3727d131d6e347586a6005ad6c0c3d
-
Filesize
1.2MB
MD541a7b6a4f76ac52fe53f6f70fa90b0ec
SHA164e1453f6baca02a93d1506483af0350564cbdeb
SHA256372ff63765cbb7dd02df8de50a339547a92d093694fa00086f9d57af1cff7c1a
SHA512b19f6bedb9c654248feb0f0be9e8a77db7dcde358d1a0ad7e5dd93b3b4300a2b3d5f0058bbb3cecc6f745b5b374b5db9678d310a0d70b2bbb31c4341f99cbca6
-
Filesize
1.2MB
MD530c1e5528ef585b2af64ddc149acb10b
SHA179ad7c8b513996e67ab393c9c40bd1353d3b7c8d
SHA256df08de5dd675ab0300953723d4a49c1fe0f97fd90f81d0bb1041a1c1adae8680
SHA51294f048d3a74283798cd8f8c27737d38a56a570536923552dd0dd259aee489b99d1e4bcb7b8804d517e6d2c1c56079adaa250e07c9d6d56aa03dda07c9c53904b
-
Filesize
1.2MB
MD5c288ab59f49329ed4919d321eff05f60
SHA1cca68c48a3a704e84e1ab5b8463af158e05e8742
SHA25689bc52bef16d5bb9cd2e9bd9a33a8347154fcd3d48bfdaa93c046638068e2530
SHA5124ee71c291eab17f389ebe1de6f5583e630ef3388d4b174b380f98e8e28592c7a0938dda459d88d68a9e7edf57715ace951c51cc317a81a8964ab9956174535ee
-
Filesize
1.3MB
MD56f9a1f50789c57f9ccc47a55b4a16153
SHA14ffb672cf79fc9afcbb782279e775c69ec83b3e2
SHA256a2c84ce17a73faa2c733d33f365a3f8b516a974dd6ee91c0ce6f5d613b96cbfa
SHA5129080b0e09d013e3f84240f95f5b2d015ff8f4eb6aff2795e1711e0f64616be47ce2dd9dc7da18d0caca3dc15ad393cc46b8bccd28feed36ffb2a3cd2a8073b10
-
Filesize
1.3MB
MD5d3e4e7dc391ff152e95780b1421cca42
SHA13b9cd0882c62f412a2078959c15d2218277aad42
SHA2563e0db6ef3f611a8cf3fcaa97f5615b310d9d8858c3f55e5952989178f3a9bed6
SHA5129854104e7b74dcb8ecbc64577cebd09b5338dff9f336246f7bf7895a90945d2970adffbaaf197018f16f27900f23eae0c044813a03160f6dfae779c8f7102008
-
Filesize
1.3MB
MD558832a6154354e18338d338c4c033c79
SHA1568cc6114f8a4192046dccb057e63971f0d93d5d
SHA2569e5667b05b0ec61ace3e63acb769bf3a1decbbe0db3e16632a1ad50aee542dac
SHA512ff098495df04885c917c183f8f2152c1e74202196f604d41dcf541558194472c4c5a8a9dc574f65971bfb19ce2d391849d5938eb4a64628c2feba550aa0ee423
-
Filesize
1.3MB
MD585e183b3c07163f3d1a1d9a95cd2d13c
SHA1791bcd55ee50fc484c042f065f9e0f5addaf29d0
SHA256262e5b8c9b8baa2778729e598cbb50665f54d98911dc7b40096e79233d43dd6f
SHA5126993131019a355b065cc21eea55ce0c967a9c7e3c87c5a0a337cb3b57b752f3aa21e7f5959f7e59653968c66b1a0968eb12c1bc8eaa2112129b554ff93a3d8c5
-
Filesize
5.6MB
MD575448cdeec72c1e071b2b903bf17af9b
SHA1196240afd94b2e905461bd091a7bbb7858bff6ce
SHA256fc2fde94f654c29a7990e9fd5cf948d0a0c3433865aa01e39990e13717f16258
SHA512e8e5976f7d2c066004d439dc02bfd75a80edbe4c52adaddff5f7311171c2e0839cff30bb88836206cfbf2018c36b9e313c10676ea63429c366a8f803df090792