Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 20:34
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-22_5f70eecc61409038065295a831f5b74d_ryuk.exe
Resource
win7-20240508-en
General
-
Target
2024-05-22_5f70eecc61409038065295a831f5b74d_ryuk.exe
-
Size
2.2MB
-
MD5
5f70eecc61409038065295a831f5b74d
-
SHA1
b7170e3eb084468506dd8dec29c41e7d7af4f760
-
SHA256
6aeddfdea9721f875d0d25a9223a75e1699ef4c2934bd98c2e2e7d86a597587e
-
SHA512
cdba2af90c76c29d5040fb8f4a8dea15ab0a43cdc67efe25551a991ec2e0f506f62fa97243403ca37ebd62fcb15aab63029467b40a09d3c29f808ef3a764ca47
-
SSDEEP
24576:6OObVw4TaN1wdkukCba4oXtgLhU3wEdmh58e4+mIJz5IcuMlQHJxrDiSi:6OOh3aN4kuLbegmtGzisGcnlQHPxi
Malware Config
Signatures
-
Executes dropped EXE 6 IoCs
Processes:
alg.exeDiagnosticsHub.StandardCollector.Service.exeelevation_service.exeelevation_service.exemaintenanceservice.exeOSE.EXEpid process 2524 alg.exe 4924 DiagnosticsHub.StandardCollector.Service.exe 4984 elevation_service.exe 3464 elevation_service.exe 1648 maintenanceservice.exe 436 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 9 IoCs
Processes:
alg.exe2024-05-22_5f70eecc61409038065295a831f5b74d_ryuk.exeDiagnosticsHub.StandardCollector.Service.exedescription ioc process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\f539ff15c3136770.bin alg.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-05-22_5f70eecc61409038065295a831f5b74d_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-05-22_5f70eecc61409038065295a831f5b74d_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-05-22_5f70eecc61409038065295a831f5b74d_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-05-22_5f70eecc61409038065295a831f5b74d_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
Processes:
alg.exeDiagnosticsHub.StandardCollector.Service.exemaintenanceservice.exedescription ioc process File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log maintenanceservice.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
DiagnosticsHub.StandardCollector.Service.exepid process 4924 DiagnosticsHub.StandardCollector.Service.exe 4924 DiagnosticsHub.StandardCollector.Service.exe 4924 DiagnosticsHub.StandardCollector.Service.exe 4924 DiagnosticsHub.StandardCollector.Service.exe 4924 DiagnosticsHub.StandardCollector.Service.exe 4924 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
Processes:
pid process 652 652 -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
2024-05-22_5f70eecc61409038065295a831f5b74d_ryuk.exealg.exeDiagnosticsHub.StandardCollector.Service.exedescription pid process Token: SeTakeOwnershipPrivilege 2720 2024-05-22_5f70eecc61409038065295a831f5b74d_ryuk.exe Token: SeDebugPrivilege 2524 alg.exe Token: SeDebugPrivilege 2524 alg.exe Token: SeDebugPrivilege 2524 alg.exe Token: SeDebugPrivilege 4924 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_5f70eecc61409038065295a831f5b74d_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_5f70eecc61409038065295a831f5b74d_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2720
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2524
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4924
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4984
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3464
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1648
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:436
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD51848264d4f740aafed6d5f5b9359d121
SHA14c6c9bfa2989759066505bbe69fa7580e3156295
SHA256188d7e97ef36691f3c60da519b22b42f4cbb43560a7adfda8b2209bd0904064f
SHA512827d5a9f3401ab9bc182b36d094d6ddffab2412fe96af745dbfe3dbc7b8370f662055da42077fbc39f4ae47cff0b125dca05040aa1804ead1408677ddcc6ff8b
-
Filesize
1.7MB
MD524a92431db5784f598e52ac06eb60261
SHA1bfad6423fd27d36ffee5ee219de45ed167f8eabd
SHA256808d727d9b510a7a6ed833d00729bd39ebe960496b4450917b749b7d31bf7ebb
SHA5120e5ef682a62fc4368ecb070d8b649ee67fa915d4209abcef90a2a54f763bdc97231f847c215d2f2a0a2bc7aad73cca643998bde232d1a23cc45edfed81805520
-
Filesize
2.0MB
MD5d3b9cb1d1f987ec0a285ab7b8ff4fe57
SHA1a9f43d8cecae42897bc0b064324236d6a182d2f9
SHA256a2f212d99b77421e2a62bab78117c2b96c9670a1c7e1379c7deee0f0467271d8
SHA512ff4edb592cf5d47f3798e2e747ed8ff3ff784a8d39e445193c102e9c5ee031ca14f9801d674c7778705918bea7cb0ccc53946091acd680746cf10bd22b1596c6
-
Filesize
1.5MB
MD5eeb5ef209300468d174742b222877dff
SHA14209cb9b2ffcf044920775acf4bd641315e95a58
SHA256744f8c919de7d3bc867143a66a09b7bb17182e5b4efcd642f36c52d3abf82301
SHA512ee414150a86b172f5971802562bfdc419cb94ff1b209dfc9ded7f4c8d9f532d7c4aac37123d8fa6af510ba7ef11a652e1355d271d6c7761243c29eed64a89cd9
-
Filesize
1.2MB
MD5a24af95f76283921c498c457e47f5243
SHA121bbd5f74a451b6edb52125e6f42ea80f8c4f814
SHA256fa782a15c4d633478ce7eb0326d3925c952e6245c4bb125069de975015437331
SHA5129d48022a39b78f89628b2aa48e0d2b27d1b72a25f20081b21f24564eb56c6940c564bafa0366355c63257e263fd136973c62d72ae3ecd466052385e60d8393ee
-
Filesize
1.5MB
MD5e74a4b3c1a392150a87b92baa136ee8b
SHA1f4f945dfe2994235e6a8a32744580267c2cdddbb
SHA2567bf6b103a5a8c60f0fb969078ddb19a24916894afa3d674eb1dd22931e4ac13d
SHA5121b86867feae1b5ebb300b6be67d7469663702fc8a25284e96b5a6ab12b23360c7a3ea03dc059dfc09efa742265c627a34ef6b17d17b21216641e8c7bd8b67bdd
-
Filesize
1.8MB
MD51f3f847eed870c91d7e53602571f0c82
SHA12d9b39483ce7f30e67739296ac8d633ab4d13b36
SHA2561dbceec39a64c59cacf6ddbbe8bbbc49ab74395d165ab93127308c2fdd98551e
SHA5126690a3f39db8f5f98609b8e7814679013be17ce72e353ff49dd44b3e8c10ffdd4a1494f2f7fd87441511d9d83484aec3e1bc3e7a3cc5a1d83d93b527f28afb1b
-
Filesize
4.6MB
MD5342fcfbe859eb93ca738abbf1ecc1d97
SHA19ca216a2140b17aa04b66fccd830d85afcbc06dc
SHA256b916a3719e2aa475c1301faecd879ef631a3ca8dc5cdc60d846130f904822998
SHA5128f5cddb0ed967d3f63bbe461880d3f40f35e35a574730d86d0fe3f6023ff9382f0da731acf1c342ffd83125d03262d92f528d5ab9eb2f23d4f982180a2ed31af
-
Filesize
1.8MB
MD5d8d26aa92ecc95f66b60bd309daa1123
SHA1d2863936333552a614672ac762ef476c5cc79c75
SHA256184d48dd7ecc9176e57b4d3fd9aa1dc2f24ba1d5054539fb8dacc4309908035f
SHA512e98f0610b0a31949d76232e833b67256292659da0b6677aadc33f5e16e8c0bd5c898bb5efb033851cf83e84ecf5238d3649b535a31dcf16edbc66961e48441a2
-
Filesize
24.0MB
MD59082e0211a67d72880ee1fa20b72983e
SHA1711002042c37789c73ef5d4f534014e83c0556b8
SHA256c6790875d939a45e852b79fc289253b43dfe829a0bd5dde64341ca3e882918a5
SHA512347e83d471b8d5c56890e0e07de6d33f1b3dec42bfd7bb239df93421d4b2a3e7982727ce9ba3183519c3925201a59f2b14c6c1d290d1618f6eac29010089b526
-
Filesize
2.7MB
MD54ac451f8a0bec4bd5de83550bb43fe8b
SHA17948cda048887d4266b1658dfab813461d1f79e2
SHA2567dc3804c0936610cd6bad0d744f9bf6ee1c714d0c5b6228e1056a7dc35855a6a
SHA512266e8aeebf80ce72e9d3930b6e46038ffce2b50787ebd561930da4e01ab5d95811273c4611b030d6cd4fa8b656399b4de34fa7412334b2d265bfce9da3c9916b
-
Filesize
1.1MB
MD5f133b46e0474e4c7fe16e20b653df6cc
SHA1cebd0e8456185b356910aa33f2a2f4c5f2afb07a
SHA256a1ffc5d1f4b4c6418950107a5b95aba2162e15369dec93a20be140f92d87beef
SHA512313add4a38831f9a24c184bc27972cb6e22842c6848f63bcb1e2c747023314bbe415a5ef7bc4596b8e28b89a277ae08ddd9f61e7f2758f9d048dfc06344257f8
-
Filesize
1.7MB
MD5689df19bc50573e4c593a096a0f45c7e
SHA1283e79359ac6a0dda68e447f9a99b9a47bdf9a81
SHA2563c77ddfd010ada8784d95eb19184b4989808fdb6134ea49115d1ce1f4f7e0e2f
SHA512c6ae757a409974dd695bac10e75760634342d59e4048eb121822d3fabc6e6cbdbd0f3bcd42feb33ec1314339ebe7bb2fd67c145924e53e46a28cd60d0a2ed1ee
-
Filesize
1.6MB
MD511b2a7c67d38dda422d55f424cc8af81
SHA17a9db71ec054d542246c3626886ff14142288bab
SHA256d35d8adfc6c4eae08924aa6aac562283479b8a1b279f04b2defbb9109bba9f2c
SHA512161632ca265d7d97ee615b0c5496e2215d15d5ccdf654db38edbaa0af5af922eb6e3a1d137cb556a1ab980eaa5ad624844a07f29eabcc47e1c206bd7d6015669
-
Filesize
5.4MB
MD569dd5d44bdffb3755f9f01c2d81c81bf
SHA18ddd5fa55aec4105a53c60d94dcfe8e4d7813887
SHA256dcc46cfcbed6638bf71416ab353112ef3dd3b6450f6ff5480bc62f6611b6552f
SHA51248b1dae139ea936c9fb7eaee7241e1d1b7a9c644db73a9bf0479fd8ab8943096d48dc1e31c45aff693f02a3ee5671fda8fc43871fd9bb8d9229b3691e7c4826b
-
Filesize
5.4MB
MD52d6fdc17e84c2c52e2922cd5b0e478b1
SHA1ecc561687cbd4f90f9721d62d60d15165df3a8c4
SHA2560a6f5c0dedd3a43a4334a80c6d5582305cd4fa116fd7e26bcf4df87f5790b4d1
SHA512a4243656f4d7feedee656ce54a9d52091cb1029c47c1cdc68af6471c5b2016697664d727be2551305b18763bda4a55d0b2a51b753466937d8db9606a4ebf3adb
-
Filesize
2.0MB
MD5f64123220d7ae522c8a30a7bbf2e1e8d
SHA19647d84ecc08db73aa9896aef8e5e17d2a54d7d0
SHA25642d71599e7b67cdc0a0b6f0fef4ade87cc392372bd87e1b2fdebc78a43e2c259
SHA512411152808fe38f0409bd2625bc0936add97fe7b922c01c2b8805bdabd507fc90a404e1a4ad69f02a37e0207ff036e67c0bd868f61e414c881ee5b24b59f8d78e
-
Filesize
2.2MB
MD55e1cb34227f8043363d83efc68bdbd4b
SHA13949bcbb3bf4f992354177e3ca0480ba13eec3b2
SHA256d0ca2aa2dc7a0ba27760f636692f88af7d7d712263617ec6beda56aafae753f3
SHA512030bf3d7562811fa81fe05ea8227eb7465cb047222be88d6ea7bc4e8169281797bd7507b7e1ecc31e8ab126f05172f8994112122d0434e11256cae7849c3f224
-
Filesize
1.8MB
MD554779421c425b30684f09ee4f664bf59
SHA1319ec9d5a0c43de94e6242c076a0311b95fecfab
SHA2562b394c1ae9ffb6eb3b5a01627ec4b50d82cac83d17f9b1dfc6648c7f62a9a631
SHA512316d0bcbc326a0c40aea1856d80ddf6103c787169da91bf4f489966118c97fb5db8de96e2810562a92535c93ea76dcfec284f3c758d928a6c4a3ffcf5cb6de3a
-
Filesize
1.7MB
MD5a35faf29cc00d183fcd79f102901f55f
SHA1d6bfa49361f443a03f23200ac9d12ddb7ef2bebe
SHA256f296cf04a44dcb3e7509f1680046311d027d55ad30bc8c2b37f543d3a4ecd3ee
SHA512e6cfdd3e453e04bf2e586711cc4b6b41e0b468666f3bb68075b023288824e89fb2a45447ccf5a2836593efa8689ae5a476102cedf189887f37891269e753e976
-
Filesize
1.5MB
MD52d5f9a27535e838270b450dd6575b84b
SHA11bb973d4eaf7cf608fb1bc43c0be49c4f85c9cc8
SHA256aba0f19c4a9d502e586bde340c66c25cf5e77f495fd98438204e7dcf12c317d4
SHA512a647665e21edfe3251a1f1b243d8e63e470f527ae148014fa82f5cb025f0f2777d92476c115ffcc75482c1cdceb79aa6508c6b34f049742f50b37d7da5a3de30
-
Filesize
1.5MB
MD56982c7cc70754c339176775c2d61a7c6
SHA1c2a010efc54d015d39ef8c8a9d4ed68e8dc49759
SHA256c734e28c3e861d3bd615963ed63e2cee2570296cd79f5ec7648a20ecdc482db4
SHA512cdc9831aa77a0a4c1b52f8e0883cd7c2bbb93d64bee2914f5a28568ea5756a36fcb2a91d80eecfe3a5603486ac415222c8d19f66859c9c1d0c4ae9d7ae4270e1
-
Filesize
1.5MB
MD5d3f6ccc1d412f98eb7cd921ea63feac0
SHA1527be7fec89767a6b95704c263ef6d9589a359e9
SHA256807bfc1b3de73fcfd3a38213f46e8951be62d437daf562a9c229ebbc29365347
SHA5120f8f2456b5bac7126d442d6a41928f07748f73184fefb5953e5cead18b1ae9aa2f4f4405ba81c41b7c68e3c4d8c7aa525fe9817f4cf5a3bbc101033989e52cdd
-
Filesize
1.5MB
MD5550a6ce8c5c7351c2ac2a2b3a681046f
SHA155839587ff0f32cdcb7cbd6785399e28bb020f63
SHA256958ed9966a09e63e52e51020c612834f1c3a87da0b343cc6ce4979f10049f818
SHA512e6b0973e84f00fc197fcbb3690c04ddff28a08511cea2a4158dcd6137d709b6e79fe0770a25679710aff1f7a1255d39552e0cc913a20015e7935372784d04794
-
Filesize
1.5MB
MD5194e77e2314b4224e0a8a7f429e4817e
SHA166f59f58bd9949b332f01b13998e7deeb57a1c03
SHA256fef8598502f50d524478dc15ecaa9a305c1133fdbbbce8603c556f00fe4d32b7
SHA51261e7d95cd47342a996341bb049e7123dd0d80af71710811e62a12bfb08b90b665777e42be41638e5e54a2a353fbb710e35fd36775a3fa8867d9624bb3a420279
-
Filesize
1.5MB
MD55ec093428027df810362d75ca0f2c0b0
SHA14a7a6bc3ddb70ceb8c9e5d22c1081e590d7f88b9
SHA256a5b5f7db7d49b0825caa3a02da6003d062e241fa7448aaab0d77a996f1fc0620
SHA512c7c2a93a1a744005177bf323d1bb62343f3e4da27e3dffc0b20f16a8c00f06a07bfd2382babb05bbe42f17b60a99b2dd0f1122cc0239d601ff4b2d074d354cde
-
Filesize
1.5MB
MD5d8dbd05d6831be784f26422b306fe803
SHA1ab175b9720f2dcd0c4333ea2573b3102f909dd28
SHA25631c5ada7628e5e9f97b63245e114427ac2ab952e0fcc78d0770a7facc063801d
SHA51203d58f589156cd37928f7f9ea9f6a1190d37720ce62f214904747b1216e61baf306084cf8b50988e2749480ddeac06433a694c2810096d3dc169ab0af969ee3f
-
Filesize
1.8MB
MD5f04fc3e62802565fbaee79a7148e590d
SHA175ee5db96d17a5f16e173ac152c69846f5dfec8e
SHA256fa1724932ab083406f2e3c9066130a5ea688b0e8bd08d1d5fc29fbfc5d958000
SHA51207ea4d230be6f8339fda294a4996970eb67d75ea877cc924d8332307de8ccb8531abafe22bdaf124b08a9f8c8e2a4cab73a1b2b646b64c85a52da7d3a9ee09f8
-
Filesize
1.5MB
MD53f180f7f7dfce99db6155b7f8c4df493
SHA12f425585177c6d61acb54832f07d1c6a1a23ab6b
SHA2564ae4ac8fa02c6deb51b25c57d2d34678141cdb77f6ad4aea9357470bbe9ea707
SHA51290cad99de091893c3e46b07bce88059ed4d475d894e4b6fa81171d721350e619a69bac16aca6f8a7a8bdc836af2df9018c1f8776177b56b6cb6eb6a9b514f8fc
-
Filesize
1.5MB
MD5d2780decc742a4fd91e5eff9b774d7d9
SHA112306eac0dbdb11f36f8cbe3bcea6bc1fd3683b7
SHA256c4aed9f455a45a0dba31578929fbc16dc139ea1c7e6306dc0afcf769c25a59e9
SHA51220be36b6516c1b6d35733ff3577627ba30e9df6c4309a1a2e513f65c439fb1b9f05f2f8b0ad916f3201cbc5c04fa15178263beb0f6742ba71074da08c8f31aef
-
Filesize
1.6MB
MD56825071e04225aedd580dfadfca816fa
SHA195f50366356378b991445d6fd965217034c7ab7e
SHA256b1265c01ca27e6f8c843b3ac3a74090697bd908f965fd18dba76065948573a98
SHA5128d30b4e724bd2a93d32a5a5919156441f2083293c646825c69d3141c2c117f58758d6b36c8c5bc54501bc54f131fd365f8e0e4e678777c39e3595d0b0959b52b
-
Filesize
1.5MB
MD52ed059753502cb45aa5c2e7030e64044
SHA1381d96cd49acd233fdde07e7a432d1ecf6d38c87
SHA256b8f6ad94e5faea6a4ef6cd9d9c2835c64979e011173624c7a3ff685818c881e1
SHA5129ca68a676c5e70e7506c80fbcf0f18b5c99bb45144cf3808fe6d709c4bec0a37ed3485e63684127870e8bb47fcbb99ffdda5c01f4b12ad1fb111b27b49d86626
-
Filesize
1.5MB
MD54cb9a3e8f2bcf7a972920fb3b031fe5c
SHA1856b69dc08ba7e7376ddc3106625e55e1ace15ca
SHA256634c182906f356ba24f679cc2aa8974dde12ef54316527217c772b05317e7603
SHA512313da8de7600a3e37b8171d6a5e941db4ea29c280c71611f9707bf22c786447fd472c0f46990367756df3f9f56dd514892c867060e6a542f6109cc68243d8e61
-
Filesize
1.6MB
MD581b565a4d73101cfc2d74421cbfcba1b
SHA117d2e2e47bdf91b866b636b552c32c34a21aec68
SHA25632b8ead0614bc741c97bb29aeb348e509ac93b2a9bb9acfb28d00a8a82ed16c9
SHA512f688069c085e6937e341a7639d8530a599829df841503d01c3a6e5c930a758c9a7a976b0439acc450c637391ad71d912a30cc12f6d368d75153c7a903d3be2cd
-
Filesize
1.8MB
MD511981614bbae9814cddc49c8cad503a4
SHA145ad3df1f47a5b2fcfddf8a45d87af6fb963fba3
SHA2560878094096402ebe0d3b5d9e58713c29476d04f047893a3931698ea70cd13d4b
SHA5122d4fded1db7288ba6963917d203463c4994dbe6a33ce11bae7f617d2f08cd277fa80beb04c90fedd313d19be93c9550397eef9fdf70821372aeeb58cdc534068
-
Filesize
1.9MB
MD5df2e337d3eafb520ea965f5398a9657b
SHA177b9b1c575540680a9637c855d472cc49a9b318f
SHA2568af741c5746e7137bdf6178a42c69b34930f5db97abacdc1a3dbfd78b3c98997
SHA5120fd2dc837ab4413c08c3ff68dae4d0ab3044250ff19dd41792367302cc008410a31b28269fdc8d60dbfe9136404464a4f75713585a169cdee0815243b469c06b
-
Filesize
1.5MB
MD57b7e29f5fc70748509a9858a567979b7
SHA10514efae16898f3e4cec8619548a0c0365a2a171
SHA25608ab2aceb3b6fb60a49fa13daab5ce4f4b823341a6f9f8e72040bcb915b1563c
SHA5120ea0260fc571461637daacedcc4e46719a5207d3bd63d92334d4670c733e10b7d84723d9ae04b49839921d487bbf0d7f38b5f6d9b34274acef2770534c3bdbc5
-
Filesize
1.5MB
MD5f5a6c86e864ff80310f94a5bf6c56f1c
SHA1d0af180eefe305a025db0f28dfa02bdf61008bef
SHA2566b34f81873120bfeec8c79e118e9e71cd0d554f3d513bc3fdc7bd5ab531a6f9b
SHA512b4e7a362484b66e965f4b789d079f199f2cee1f92afd53f57db8b66e8f583c2326ce718d75c44125dbced31cf2db8624ef410643bcbd56ebc6467bf354f2f888
-
Filesize
1.5MB
MD5d86a0fcb7b01c3abc8c5bf35d9a2906e
SHA1ca5924d560924ba00db3f4278c2dc7d6c6937371
SHA256319939b95264fcfc662443ae0568791fa53c904152393f42b2cdf56403e619d6
SHA512bacf897e1b0d5d1bdd86396217bb2a23917335ec22985cda84da4c28e61927f2df71b4b00c522fdc1b48dd1dc020c85527b6756750798d4b2af98a9058f9ebc0
-
Filesize
1.5MB
MD5520bd92118e2c19bf64b82cd35e0f107
SHA1feed08b01b6e1845f71c23f8f6eaf6cb0cc2db26
SHA256fe4191023c1cef0049afe2f857a65c77161bd40313076a0c773fb60be0ddc12b
SHA512db6aacb28e8dfaaecef94bd162dd8697ce3c1f8c5f997018d73c46d06b763b2f9a1b60aff677921b8fc5c0d5592f842cbfee6b92c8c2f4176e76a318518ee6dc
-
Filesize
1.5MB
MD5e20ddf5dff9c5a1f1b8af10556e8a9a4
SHA1cfed66839e8c3902a87a64e2a43e3cac49eb2edb
SHA256a857fdca79d6e69999e4ff014c27863812741c682e95f11b819cdc437ec58df8
SHA512eb90de91c2102a9adc8b253bd9980a337b17d21e4d6c9670d4ed87db5f6243da3092636f322320ea923c7a38b3cceaf68c54822d9232f24440e33c77155b7e0c
-
Filesize
1.5MB
MD5e04069edb7cf540d950a5da6e3d996bd
SHA16a113ac2e69c48e30af84cbb46652172d6761834
SHA256af63c5a17810987ffbdd1404683da8ab2db91820c49fb163ce43838b50a4dc78
SHA512fc2bc8a88cbab5f1422e49342c8f3775ae646fac8fb9c49200a630ef8d4ac826c367bad24678ae38a103ca1d9038562993bb8d25582aec4a09d4b4f81b1ca49b
-
Filesize
1.5MB
MD5c9ec47b223e5e6f0ee802c94ddaada5b
SHA14b4d64f9a02892fa5d49dded6a545f9f511b7d8a
SHA256700b5b61491c5308ecd77671b43f5c2f0dcced75e100117968f03feb05949c9c
SHA5125247d126edc5b887fb439fed830b52ad2ab465772daf5e82fb0cbde70e6ec0e6aacdbc32af08aeb8cc666fee2d77e538a14e1fd764d37224524b8277fb6ce8b7
-
Filesize
1.5MB
MD5af2130e73bd7ad44a7e3b54866cb5469
SHA1202ee4f6dfa38fa3a48136b9b721d6e2a62549f7
SHA256a9b081116322d1a941c15829399019ea5aaca7f89f4e78465585b19ed5eb1fa2
SHA512aa7b0ed5299cc18ba1358f134ef78f4e0196ebcebc6381892b9e435013f24db690cd61d7a7f078be62cc14f9388754062d2a1b1b4e7a00dd5b8496172d1ecb16
-
Filesize
1.5MB
MD55b15a9e0eeb124cc73eeaeda3440d535
SHA10f1c4e85fc0e0c082f0fee9e1409e6c4bd6d2347
SHA2567f7a2a230560c9d007745e7b77af59fc17d6a74389df1919ea83984e1e51f2be
SHA5122f9af639c67699871506cb14cb02b2e0c4b2abc9723e455ba86b6f9df48a9222c556321f78dd3854183c16843d782c8ef2fe25d8d739af8eac4cbaf7cb684d1c
-
Filesize
1.5MB
MD59c67fa8fe91d67f86cb24f5017f89a2c
SHA160a5db3528db578246b8f67bb0c0d15c45c1f44f
SHA256163f1c4a12d0add6123837c72cc2de17b89d2ae830fcbc39d9b7003dded7709d
SHA512bfc3e20054c97ab290c86b3d41475037ce539923f2817a0adf9d94c960cea857cb09e9fa05df8b524469126656731066507f710560466bcd419a094d065df18b
-
Filesize
1.5MB
MD54698f403302886012ce757b223706f77
SHA1ceeb32f2b8b7c699a5f8418b61e1316f3ec80813
SHA256f1fc1c69f23c0c521f4fc087f4c766e5f1d99562182d4016f8d43a1fb25cdced
SHA512f68c49850d5a5b23c759af48720f73e2cb77c02cb8b260d02634a766cb3aa7053f304df545ed69c6d88eebc28f1f88e9600c0e405eb9c4ec643db5a84869581d
-
Filesize
1.5MB
MD5a79c19b515a2c951d7d4383cf17f7332
SHA1d673524de04567f9b04733af5294622a8fcf44cd
SHA256113ed11f2b65433dcb5f40eb7dc4fa1b3fcbdf53a1b864390b7cc13da04dae85
SHA5128e3bd348624b1ba4e9404d5e7a7f4074c0e32b8c1b23bf66a069e7a130efecb29fa9016dc6824db9a912274a270c7c729186943841d9e83db59e9d422deb551f
-
Filesize
1.5MB
MD52e80537b2b2940512970be64f7f29a8c
SHA10a5adeefa919e1915b42bcb8b536dc06c66ff7b3
SHA256be6adbaa0f83c7a880ad888b16a2086e8ee1d85cc031c8ddbf89821427d964d0
SHA51209effe7fc6d141164fa8d5706fcf2c64e96d4c440a3ca70e0792b2a4966916a20cbd820dd6811af654ac73018ee5a99b0d48812b83f982692a892196dcaab253
-
Filesize
1.5MB
MD52a19272b36c7947e55accab0b646d469
SHA1e39669432c031ad2bb5c1e01e1f963e50f3343ee
SHA256eab0020b22dc72c029508d49f1c2983ea897cce78536e7cad7f553b3b82e3a28
SHA5122b7dcfccffeb754d8495011f66561398ca8b1ced3447b08a6122855f95d17c9f2c17897d3dc84ff7a993d8df0ef3cadd3c41c0123149539753c006c2cffb6aaf
-
Filesize
1.5MB
MD5422a417360d63e36321683123d955989
SHA1600951f8992dfe2c2f5e49085ef5737f8c191a5d
SHA256eba4b3be0c3f39a4847800da072245e0777198921a751b0a9302e473412dd231
SHA5123f25d60e38482369103a7d70d4af9ee22b54919100fdea65a0ead9e6a93f1a37ecf3176aa6ae1485c596fbea93caf463f10722603023efd34e6564d70653268c
-
Filesize
1.5MB
MD58cb7bf5abd1b27baafd5c0247a79ea1a
SHA14f78c5580239c7c67b1e740c1ea3f4d40c1119a7
SHA256a7c51082905bf36200cd53ad7f837e60c335769d893ec4568d447595f5b586a0
SHA512245e9767c87a67975bd599fa5c779e9f7c83566676f21efb811048646cd2e6e81d66bf7527462d3ceaaffc1faf44a9a9563f74864f866c8ec9654e83229d9bd7
-
Filesize
1.5MB
MD5ae66f24d34776b90c786ec55bb0265b8
SHA1aa70ea3a3d01b3148c366d7d874f74f6a2783547
SHA256462769a8664604384049d574c11e2aec4b557ed0ee88b44d50ca9fecd023362f
SHA512904418bd7eefa9be01e740a271fd796dbaca0db44ddd7a85ce3a1c66610b2411f571e416ddc1b474dcea4808887768822ddf2e2dae37c19f9181f1ee424b223e
-
Filesize
1.5MB
MD53f511bb3929142bb6d8324cd9288019b
SHA15f57007804febb7dfe636026f541fb421e0db07b
SHA256aa05163456f10fa87760ee7e126137bca84affc78c2f6bea747dd6c5e5642a7b
SHA512b788837b39958a080fb218ea478d17d924a5d0d29bde9fd0ce2a77ce9448d0420cb65908230983935bfd529043a0b4c6ac0dd3f2f745aef87f398848910530e4
-
Filesize
1.5MB
MD5a678421020d6388b08255663aae57270
SHA1c6ace3e19fa641012600b667aa8556d01221bd1b
SHA256eda5bb16cab9f224e25effeaf01c16af2725689ad046e3c89d317308643bdcbc
SHA51248f2e9a6ae1cf832257a6a8057306bd630500674d93ec75edbf750eb57c8d34f08681420604ce5f2c8b2ebbecc48e0045f5d572c198bcf78044c611d6a17b83d
-
Filesize
1.5MB
MD56bd09b740da276739ebfa359f8dca2b7
SHA1ff6c95ae305b8fac706cac11721b40136e98b48f
SHA25615df7835c3394ba021fd1eb090ee4a830d8ed9ff4513ffd2367a6e7b4bf23dc2
SHA5120091a61c173ff82a068fd0768d3b659699298f4e89a67036e581ff57a8c27c3dc10297970f88e1af93d1adf6eac93554dd9b74c6f41b72548fb6ed044d657b67
-
Filesize
1.5MB
MD502cf7d0e74b4e1965920577b93acfb1d
SHA156f4ee4595620cfb14820c80f4c18ae8583d1843
SHA25695e94697ddacf88a72c05099c9d21426f17e74529245bd2a337f5c5d15edc6c9
SHA512376a62bcac7181be927cd3cf2de6ee154aec371942d38bda6d81cb6a5a3984c4dca0a7a0829984fe76c77c4e9d62a9bf1e849f2c54f44a6a267b9cab2571a92d
-
Filesize
1.5MB
MD58537ae4b104613d24a9cd486db49b2f1
SHA1b13eb327ec1807e3288ff5231395cc0a9bf05ab6
SHA256cb5ecebd773a9f5cc1df87f22ce6dbf39f6ab25c9a1cc3d0a2d678ad4cef6c2e
SHA512e644948594b20c915c9e2a3aa4d3545c31908dbacefb50a814c92c00386c5dcc66cf4678c162257c7f6b0d090a2c8f0245a95b8bef43e7976325679536891bc0
-
Filesize
1.5MB
MD5146460b168170faaffd3e03522fd4adf
SHA118fc22cc9e819314f001e79eaac38a5e049b459a
SHA25617d27df81ad74d15c3539d26a563a3348aa035bb3dfdd0a73cbf16b75c22a87b
SHA51270a233768162158da71a98c107f2fe1797eb7b27d734b4985e2c7a916cd1775f9d2099523622dbfe682d43d3c37c60f284addd18b0e567af0b0ef43ceb90040c
-
Filesize
1.6MB
MD5f8f10b28de2b31e9da10b1cdb4991874
SHA145dfc8a74fe4111f14cff7994c4b70aee3d20d4d
SHA2567e0626a4c5b8f9fbb1f13634d0f3b1349dc42775dde2c9eef784eeb9a3eed9b9
SHA5126b4a27f3a28771cf3014bbb1c166aa6abeef95b57871a50ca2a2780540d4d41e0ba1a956a1cf08e8f4e6562e56d9d02c13e0deeb7fbe01daedaf9869291ad2a6
-
Filesize
1.6MB
MD513661f1ae5d17d307bff6ac3286d9381
SHA18ebce5dd69de984ce86e73261f9db9869ffbf136
SHA256f3485e8bb97621096772b53600e6610cc81182800cf412239f88067c1c25089a
SHA51209b607ee0cfa41f5ab52f641699a55df56ffaa248061067e119c0a63f04d042b0136101d1f7d39f1502f55cc0e217da56b24fe8fdbd935b0ebf2ff8fc72e970c
-
Filesize
1.6MB
MD5be1ff64a7e37e8884e8531c06c45a88b
SHA13b7b9e8dbcf5b806fab9613418e5d816486820c3
SHA256cdb90b96dfbf3f0d6bc5dcc0646cf31d46c90021fc9a397b719dcfcb4c43302a
SHA512f755553e354bf7d53be670ca77d929f18fe7c2ec0086943eabfdcad5d3db7f06b94a77088bec3615db45fa47bf92e59ab3d73310437b396dadee53feda7241fb
-
Filesize
1.3MB
MD561cc31fe34bd03b2386d858b8bb0ceaf
SHA1ccb7cc4206c52104a9a6e53f9941853498a8c17e
SHA25645a1db2dfa55cd0bbad72d5fe547c1d4efd885563e94c8108877b58c3334a556
SHA512580d40b5500f18e6a0b39cc6be8bf8a88be721564f9ddc350d4b17df9499d10fe296834cbde5c83c8360dd2299e68e5c28a74a00f3201fc347fb85d0eea7da44